Privacy Policy

Quivi is operated by the Quivi entity registered in Portugal and Denmark. We provide POS and payments software for hospitality. The data controller for this website is the Quivi entity in your market.

Postal contact: Quivi, Lisbon, Portugal.

Form submissions: when you fill in the Contact, Book Demo, or any other form, we receive the fields you submit (name, email, phone, company, business type, message, and similar) plus the page you submitted from.

Attribution data: when you arrive on the site, we capture standard UTM parameters and click identifiers (gclid, fbclid, msclkid) into your browser session storage so we can attribute leads to marketing channels. This stays in your browser unless you submit a form, at which point it's bundled into the submission.

Analytics: we use Plausible Analytics, which is cookieless. It records aggregate page views, referrers, and outbound link clicks — no personal data, no cross-site tracking.

Server logs: our hosting provider records standard request logs (IP address, user agent, requested path, timestamp) for operational purposes.

Form data: to reply to your inquiry, send you a demo confirmation, and route the lead to our internal sales tools.

Attribution: to measure which campaigns and channels actually produce conversations.

Analytics: to understand how the site is used and what to improve.

Server logs: for security, debugging, and abuse mitigation.

We use a small number of trusted sub-processors. Form submissions are routed to: Resend (transactional email), Pipedrive (CRM), Microsoft Teams (sales notifications), and Cal.com (demo bookings). Each operates under their own data-processing agreements.

We do not sell your personal data. We don't share it with anyone outside the processors above without explicit consent or a legal obligation.

Form submissions are retained as long as the lead remains active in our CRM, and then archived. Inactive leads are typically pruned after 24 months unless you've become a customer.

Server logs are retained for up to 30 days.

Analytics data is aggregate-only and retained indefinitely. There's nothing to identify you personally in it.

Under GDPR you have the right to access, correct, port, restrict, and delete your personal data. You can also object to processing or withdraw consent where processing is based on consent.

To exercise any of these rights, email [email protected]. We aim to respond within 30 days. If we can't resolve a concern, you can complain to your local data-protection authority.

This site does not use cookies for analytics or marketing. Plausible operates without cookies. We may use a single technical cookie if Google Tag Manager is enabled — that's currently disabled and would only run consent-requiring tags after you opt in.

Your browser session storage holds the attribution payload described above. It is erased when you close the tab.

Some of our processors operate outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses or equivalent safeguards.

We protect data in transit with TLS, store it in EU-based infrastructure where possible, and limit access to personnel who need it. Our processors are SOC 2 / ISO 27001 / PCI DSS Level 1 certified as appropriate for the data they handle.

If we change this policy materially, we'll update the date at the top and, where relevant, notify recent contacts by email.

Privacy questions: [email protected].

General contact: [email protected].