Privacy Policy

Last updated 16 August 2026

1. Overview and who this policy covers

Quinta ("Quinta", "we", "us") is a search-intelligence workspace used by executive search and specialist recruiting firms ("customers", "tenants") to organize briefs, CVs, interview notes and related material, and to produce evidence-grounded assessments and reports. This policy explains what personal data we process, why, and what rights you have. It applies to:

• Visitors to our public website;
• People who use Quinta on behalf of a customer ("users" — e.g. a recruiter or admin at a search firm with an account); and
• Individuals whose information a customer uploads into Quinta as part of their own search work (e.g. candidates, referees, interviewees) — see Section 4.

2. Controller and processor — two different roles

Quinta acts in two distinct capacities, and this distinction matters for how your data is handled:

• As a data controller, for the operation of our website and the accounts of the people who log in and use Quinta (Sections 3 and 5). We decide why and how this data is processed.
• As a data processor, for the business content a customer uploads to their own workspace — CVs, interview transcripts, assessment notes, and similar material (Section 4). The customer is the controller of that content and determines why and how it is collected and used; we process it strictly on their instructions, under a separate data processing agreement. If you are a candidate, interviewee, or other individual referred to in material a search firm has uploaded to Quinta, your privacy questions and rights requests about that content should go to the search firm you interacted with, not to us directly — though we will assist them in responding, as required by law.

3. Data we process as controller

3.1 Account data

When your organization creates a Quinta account for you, we process your email address, display name, role, and the organization (tenant) you belong to. Authentication is passwordless: we send a one-time secure sign-in link to your email address rather than storing a password. If your organization issues you a personal API key for programmatic access, we store a cryptographic hash of that key, never the key itself.

Purpose: providing and securing the service. Legal basis: performance of the contract between your organization and us (Art. 6(1)(b) GDPR), or our legitimate interest in operating the service securely (Art. 6(1)(f) GDPR).

3.2 Session and sign-in data

When you sign in, we set a strictly necessary session cookie to keep you signed in, and a short-lived sign-in token to verify the one-time link you followed. Neither is used for advertising, tracking across other websites, or any purpose beyond operating your session. See Section 7 for our full cookie list.

Legal basis: Art. 6(1)(b) GDPR; as strictly necessary cookies, no separate consent banner is required.

3.3 Usage and technical logs

We record a technical log entry for requests made to the application: the page or endpoint accessed, HTTP method and status, response time, your account (if signed in), and your IP address and browser user agent. This data stays within your organization's own tenant — we do not share it across organizations, and we do not send it to any third-party analytics service.

Purpose: operating, securing, and diagnosing the service (e.g. detecting abuse, investigating errors). Legal basis: our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).

3.4 Support and feedback

If you submit the public contact form, feedback, or a support request, we process the details and text you provide so we can understand and respond to your enquiry. In-app feedback also includes the page title, path, and URL from which it was submitted.

Legal basis: our legitimate interest in providing support and improving the service (Art. 6(1)(f) GDPR).

4. Content processed on behalf of customers (as processor)

Search firms use Quinta to store and analyze material such as CVs, interview transcripts, recruiter notes, and client briefs. This content is supplied and controlled entirely by the customer, and may contain personal data — and occasionally special categories of data under Art. 9 GDPR (for example, health or diversity-related information mentioned in an interview note) — about candidates, referees, or other third parties. We process this content only to provide the service (storage, search, and AI-assisted analysis as directed by the customer), only for as long as the customer's account retains it, and we do not use it for our own purposes such as training general-purpose models or marketing. Our relationship with each customer regarding this content is governed by a data processing agreement consistent with Art. 28 GDPR.

5. Who we share data with

We do not sell personal data. We share it only with the service providers necessary to run Quinta, each bound by a data processing agreement:

AI processing provider

Uploaded record content and search queries are sent to our AI provider (OpenAI) to generate embeddings and produce AI-assisted analysis and report drafts — this is a core part of how Quinta works. Where this involves a transfer of personal data outside the EU/EEA, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses.

Email delivery

An email delivery provider is used solely to send sign-in links, account-related notifications, and contact-form submissions.

Hosting

Quinta is hosted with Hetzner Online GmbH, on infrastructure located in Germany/the EU. Your data is not, as a matter of course, moved outside the EU/EEA for hosting purposes.

We may also disclose data where required by law, or to establish, exercise, or defend legal claims.

6. Data retention

Account data and content are retained for as long as your organization's Quinta account is active, or as long as the customer instructs us to retain it. Technical and usage logs are retained no longer than necessary for the security and diagnostic purposes described in Section 3.3. We do not currently offer fully self-service account deletion or data export; to request deletion, correction, or export of your data, contact us using the details in Section 10 and we will act on your request within the timeframes required by the GDPR.

7. Cookies

Quinta uses only cookies that are strictly necessary to operate the service. We do not use advertising, marketing, or third-party tracking cookies, and do not display a cookie consent banner because none of our cookies require consent under the GDPR/ePrivacy rules.

Session cookie

Keeps you signed in. Expires after 30 days of inactivity, or when you sign out. Marked HttpOnly and Secure, and is not readable by page scripts.

8. Security

We apply technical and organizational measures appropriate to the risk, including encryption of data in transit (TLS), and database-enforced tenant isolation so that one customer's data cannot be accessed through another customer's account. No system is completely secure, and we cannot guarantee absolute security.

9. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15);
• Have inaccurate data corrected (Art. 16);
• Request erasure of your data (Art. 17);
• Request that processing be restricted (Art. 18);
• Receive your data in a portable format (Art. 20);
• Object to processing based on our legitimate interest (Art. 21);
• Lodge a complaint with a data protection supervisory authority.

If your request concerns content a search firm has uploaded about you, please also see Section 2 — we will forward or assist with such requests as required, but the search firm is best placed to act on them directly.

10. Contact

For any privacy question or to exercise your rights, contact us at max@trainbomb.ing. Our full legal contact details are listed in the imprint.

11. Changes to this policy

We may update this policy as our service or legal obligations change. We will update the date at the top of this page when we do; material changes will be communicated to account administrators.