Qind Find privacy.
find-2026-10-09-beta1 — approved activation version
Who is responsible
Bozorgmehr Jorjani, trading as Qind, Sweden, is responsible for Qind Find. Business mailing address: Vällingbyvägen 163, 162 63 Vällingby, Sweden. Contact bo@qind.net for privacy, correction, ownership or removal requests. No personal identity number is published.
Scope and purpose
This notice covers Qind Find under qind.net/find, not the separate white-label operator services. We organize source-backed business and place information so people can discover and contact relevant businesses. Listing information is not a guarantee of opening hours, prices, stock, availability, ownership or a recommendation about a person.
Imported information and source transparency
We use licensed Overture Maps Places data: business/place names, source categories, country and locality, source coordinates and addresses, available business websites and phone numbers, source identifiers, license metadata, confidence and observation dates. Source email addresses and government identifiers are excluded. A source can contain personal information about a sole trader or home-based business. Potentially residential locations in home-service, professional, health and unclassified categories have exact addresses and coordinates withheld from public profiles pending review. Other categories are not proof that a location is public; privacy concerns must be reviewed promptly.
Proposed lawful bases
For the directory and accuracy, security and moderation work, Qind proposes legitimate interests in useful business discovery and accurate public business information, balanced against the individual’s privacy expectations and supported by minimization, holds, objections and removal. This is not blanket permission to republish every source field. Account and profile-management requests are handled to provide the requested service; security and abuse prevention are separate legitimate interests. The controller must approve the documented assessment and the information duties for indirectly collected personal data before public activation.
Business accounts, ownership and edits
An account stores its email address, a user identifier, access role, hashed single-use login tokens, hashed session tokens and expiry/revocation times. An email link lasts 15 minutes and confirms access to that email only. A secure, HTTP-only essential session cookie lasts up to 30 days unless signed out or revoked. Ownership claims store the claimant’s stated relationship and public verification route, decisions and memberships. Email login or payment cannot establish ownership. Approved edits and moderation decisions retain the previous value, change, actor and review evidence. Do not submit identity documents, personal identity numbers or sensitive private information in claim or report fields.
Corrections, reports and removal
Reports store the listing identifier, issue type, supplied explanation, submission time and review outcome. Publication can be paused, inaccurate details corrected and duplicate consolidations reversed. Public removal is distinct from deletion of internal source or audit records: a request must be assessed and its outcome explained. A source refresh must not silently republish an unpublished record or replace protected owner corrections.
Retention and review
Login-token use expires after 15 minutes; sessions expire after at most 30 days and sign-out revokes immediately. Rate-limit records use short-lived hashed buckets rather than a saved raw IP address. Expired authentication and rate-limit records require scheduled cleanup before account launch. Accounts remain while needed for the requested management service. Claims, reports, memberships, changes and audit records are reviewed after 12 months and kept only while necessary for administration, disputes or an applicable legal obligation. Source snapshots and import receipts support provenance, reconciliation and recovery; retention and database size must be reviewed before expansion. This notice does not claim that every record is automatically deleted at the review date.
Providers and technical information
Hosting uses the existing Qind Vercel service; PostgreSQL uses Qind’s existing Supabase project in Ireland. Sign-in email, when activated, uses the verified Qind Resend sending domain. Providers may process technical request information and delivery logs under their operational policies and applicable processing agreements. The application uses verified database TLS and distinct, scoped server credentials. Exact hosting regions and applicable international-transfer safeguards must be verified before publication. No new paid provider or spending-limit increase is authorized by this notice.
Search and analytics
Search terms and selected locations are reflected in shareable URLs so you can bookmark results. We do not create individual search histories or use an LLM for every query. Find does not load the company site’s Cloudflare analytics beacon; its document referrer is suppressed. Compact aggregate directory metrics are not activated in this version. Nonessential tracking needs its own reviewed disclosure and consent handling where required. Browser geolocation is not requested automatically.
Your rights
Where the GDPR applies, you may request access, correction, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. You can complain to Integritetsskyddsmyndigheten (IMY). Contact bo@qind.net with enough context to identify the listing or interaction; do not send a personal identity document unless an appropriate secure verification process has first been agreed. A refused request must be explained rather than silently ignored.