Quire
Effective date: 3 October 2026.
Current offering and what this notice establishes#
Quire is operated by Nuits, a Finnish sole proprietorship operated by Bapusaheb Patil. It is pre-release: the public offering is a waitlist, documentation and a browser-local demo, not an operating hosted customer learning service. Contact legal@quirelms.com for supplier information, data-protection questions or a future contractual objection.
A subprocessor is a supplier Quire engages to process personal data on behalf of a customer for a contracted service. Suppliers used for Quire’s own public-site or business purposes may instead be processors of Quire as controller or have their own legally defined role. A public-site delivery provider is not automatically a host of customer learner records.
Evidenced current public-site delivery#
Our public-site delivery is configured through Cloudflare Workers static assets for quirelms.com, its www host, docs.quirelms.com and demo.quirelms.com. Cloudflare delivers public files and may process request information such as IP addresses, request URLs, user-agent and security or delivery metadata to provide that service. This public-web delivery role does not mean Cloudflare hosts customer learner databases.
The demo’s sample database and changes run in the visitor’s browser. Cloudflare’s delivery of its application files does not mean the demo’s local sample database is a Cloudflare-hosted customer database. Visitors should still avoid entering real or sensitive records into the demo.
This notice does not assert a particular Cloudflare data-centre location, exclusive EU residency, account-specific log retention, contracting legal entity or executed transfer instrument; those details require the applicable account and service arrangements. Cloudflare’s general information is available in its privacy policy, but that external policy is not proof of a Quire-specific contractual safeguard.
What is not an active supplier register#
Infrastructure is selected for each customer deployment. Hivelocity, AWS, Netcup or another approved provider may be selected; Vercel is an alternative for static hosting. These possible choices are not a list of active suppliers for a Quire customer deployment.
The product also contains optional AI, email, payment, storage, meeting, video and other integration adapters. Their availability does not show that a particular vendor is engaged, receives data, has an agreed processing region or is contractually prohibited from training on inputs. No AI, payment or email vendor is designated as an active customer subprocessor by this page merely because an adapter exists.
Waitlist confirmations and operator mailbox communications involve email-delivery and mailbox providers as separate controller-side recipients. They are not an active customer-learner subprocessor register. The Privacy Policy describes those recipient categories and purposes. Contact the legal mailbox for the actual recipient and transfer information relevant to your interaction; we will provide the applicable details rather than a list of hypothetical vendors.
Future customer-specific register#
Before future hosted processing or support access to self-hosted personal data begins, the customer and Quire must accept a completed deployment schedule under the DPA. The current register supplied with that agreement must name each actual subprocessor’s legal entity, service, task, personal-data access, processing and remote-access countries, and relevant safeguards. It must identify hosting, storage, backups and any enabled support, email or AI recipients rather than assume every available integration is active.
A directly contracted customer integration may be the customer’s own processor or another independent recipient, not Quire’s subprocessor. Its role and authority must be recorded before use. Optional integrations that are not selected do not belong in the active register. Any required international-transfer basis, executed clauses, completed annex information and transfer assessment must be established before a relevant transfer, not inferred from this public notice.
A self-hosted licence alone does not grant Quire or the listed potential infrastructure companies access to the installation. The customer chooses and remains responsible for its directly contracted infrastructure; actual Quire support or connected-service processing is documented separately.
Advance notice and objections#
Under the DPA, Quire gives the designated customer contact at least 30 days’ specific written notice before adding or replacing a subprocessor or materially expanding its access, purpose or processing countries. Notice identifies the proposed recipient and relevant processing and safeguards. A public page update alone is not a substitute for that notice.
A customer may object during that period on reasonable data-protection grounds by writing to legal@quirelms.com, identifying its deployment and concern. Quire will investigate and seek an alternative or mitigation, and will not give the proposed subprocessor access to that customer’s data while the objection remains unresolved. If no lawful, reasonable solution exists, the affected processing or service may end before the proposed access begins, with return/deletion support and a refund of unused affected prepaid service fees under the DPA. Urgency does not silently waive authorisation; specific written approval or suspension is required.
Quire will maintain the actual current register and ensure selected subprocessors are bound to applicable data-protection duties. For children, optional AI and third-party sharing additionally require approved institutional child-data arrangements; general subprocessor authorisation does not override those safeguards. This notice makes no certification or claim that hypothetical future supplier contracts are already signed.