Privacy Policy
Last Updated: May 2026
We never sell or share your information.
Your personal information is used solely to respond to your inquiry and deliver our services. It is never sold, rented, traded, or shared with third parties for marketing or commercial purposes — ever.
1. Introduction
Software Quality Guru ("we," "our," or "us") is a medical device software consulting firm based in Virginia, United States. We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at softwarequality.guru or engage our consulting services.
Data Controller: Software Quality Guru, Virginia, USA. Contact: frank@softwarequality.guru
By using our website or services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access the site.
2. We Do Not Sell or Share Your Information
We do not sell, rent, trade, lease, or share your personal information with any third party for their own marketing, advertising, or commercial purposes — ever.
This is a core commitment, not a legal formality. Your name, email, company, project details, and any other information you share with us will never be monetized or passed to data brokers, advertisers, partners, or any other organization.
The only circumstances in which we share information are:
Service providers we directly control: vendors who help us operate our business (e.g., our CRM, email platform) and who are contractually prohibited from using your data for any other purpose
Legal requirements: when we are required by law, court order, or regulatory authority
Your explicit consent: if you specifically authorize us to share information with a named third party
If you are a California resident, you have the right to opt out of the sale of personal information under the CCPA — but there is nothing to opt out of, because we do not sell personal information.
3. Information We Collect
We may collect the following types of information:
Information You Provide Directly
Contact form submissions: name, email address, company name, and project details
Email correspondence and meeting notes related to consulting engagements
Information provided during consultations, assessments, or project delivery
Automatically Collected Information
Log data: IP address, browser type, pages visited, time spent on pages, referring URL
Cookies and similar tracking technologies (see Section 8)
Analytics data collected through third-party tools (e.g., Google Analytics)
Information from Third Parties
Contact information provided by referrals or business partners
Publicly available professional information (e.g., LinkedIn profiles for prospect outreach)
4. How We Use Your Information
We use the information we collect for the following purposes:
Service Delivery: To respond to inquiries, provide consulting services, and fulfill contractual obligations
Communication: To send project updates, invoices, reports, and other service-related communications
Business Development: To follow up on consultation requests and send relevant information about our services
Website Improvement: To analyze usage patterns and improve the functionality and content of our website
Legal Compliance: To comply with applicable laws, regulations, and professional obligations
CRM Management: Contact information submitted through our website is stored in our HubSpot CRM system solely to manage client relationships and follow up on service inquiries — never for resale or advertising
CRM Management: Contact information submitted through our website is stored in our HubSpot CRM system solely to manage client relationships and follow up on service inquiries — never for resale or advertising
5. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal basis for collecting and using personal information depends on the context:
Contractual Necessity (Art. 6(1)(b)): Processing required to perform a contract with you or to take steps at your request before entering into a contract
Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests (e.g., responding to inquiries, improving our website), provided those interests are not overridden by your rights
Consent (Art. 6(1)(a)): Where you have provided explicit consent (e.g., subscribing to communications). You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable law
Special Category Data: We do not intentionally collect special category data (health data, biometric data, etc.) about website visitors. Any such data shared during a consulting engagement is processed under Art. 9(2)(b) (employment/legal obligations) or Art. 9(2)(a) (explicit consent) as applicable.
6. Limited Service Provider Disclosure
As stated in Section 2, we do not sell or share your information. The only third parties who may access your data are service providers acting strictly on our behalf under Data Processing Agreements (DPAs):
HubSpot: CRM and contact management — stores contact form submissions so we can follow up on inquiries. HubSpot is contractually prohibited from using this data for their own purposes.
Google Analytics: Anonymized, aggregated website usage data only. We use IP anonymization and do not share identifiable visitor data. Google acts as a data processor under Google's Data Processing Amendment.
Email and cloud services: Used solely to communicate with you and store project files.
All service providers are bound by data processing agreements pursuant to GDPR Art. 28 that prohibit them from using your information for any purpose other than providing services to us.
7. Data Retention
We retain personal information for as long as necessary to fulfill the purposes outlined in this policy, including:
Active clients: For the duration of the engagement plus seven (7) years to comply with professional record-keeping and legal obligations
Prospects and inquiries: Up to two (2) years from last contact, unless you request deletion sooner
Website analytics: Aggregated data retained indefinitely; individual session data per platform defaults (typically 14 months for Google Analytics)
Email correspondence: Retained for the duration of the client relationship plus 7 years
When personal information is no longer needed, we securely delete or anonymize it. You may request early deletion at any time subject to our legal retention requirements (see Section 9).
9. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal information:
Access (GDPR Art. 15): Request a copy of the personal information we hold about you, including information about how it is processed
Rectification (GDPR Art. 16): Request correction of inaccurate or incomplete information
Erasure (GDPR Art. 17): Request deletion of your personal information ("right to be forgotten"), subject to legal retention requirements
Portability (GDPR Art. 20): Receive your data in a structured, commonly used, machine-readable format (applies to data processed by automated means on the basis of consent or contract)
Objection (GDPR Art. 21): Object to processing based on legitimate interests or for direct marketing purposes
Restriction (GDPR Art. 18): Request that we limit how we use your information in certain circumstances
Withdraw Consent (GDPR Art. 7(3)): Withdraw previously given consent at any time without affecting the lawfulness of prior processing
Lodge a Complaint (GDPR Art. 77): You have the right to lodge a complaint with your national data protection supervisory authority. In the United States, relevant agencies include the FTC. In the EU/EEA, you may contact the supervisory authority in your Member State (e.g., the Irish DPC, German BfDI, French CNIL, or any EU DPA). In the UK, contact the Information Commissioner's Office (ICO) at ico.org.uk.
California Residents (CCPA/CPRA): You have the right to know what personal information is collected, the right to delete, and the right to opt-out of sale. We do not sell personal data — there is nothing to opt out of.
To exercise any of these rights, please contact us at frank@softwarequality.guru with the subject line "Privacy Request." We will respond within 30 days (CCPA) or within one month (GDPR), with the option to extend by a further two months for complex requests.
10. Data Security
We implement appropriate technical and organizational measures (TOMs) in accordance with GDPR Art. 32 to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
Encrypted data transmission (TLS/HTTPS) for all website communications
Access controls and authentication requirements for internal systems
Regular security reviews of third-party service providers and their DPAs
Employee confidentiality obligations and limited access on a need-to-know basis
Incident response procedures — in the event of a personal data breach, we will notify relevant supervisory authorities within 72 hours as required by GDPR Art. 33, and affected individuals without undue delay where the breach is likely to result in high risk to your rights and freedoms (GDPR Art. 34)
No method of transmission over the Internet or electronic storage is 100% secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security.
11. Automated Decision-Making & Profiling
We do not use automated decision-making or profiling processes that produce legal or similarly significant effects on you, as described in GDPR Article 22.
We do not build behavioral profiles for advertising or scoring purposes. We do not use algorithms to make decisions about you without human review.
Any analysis of your information (e.g., reviewing a contact form inquiry) involves human review and judgment by our team before any response or decision is made.
12. Third-Party Links
Our website may contain links to third-party websites, including regulatory bodies (FDA, ISO, IEC), standards organizations, and professional resources. We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies before providing any personal information.
13. Children's Privacy
Our services are directed to business professionals and organizations in the medical device industry. We do not knowingly collect personal information from individuals under the age of 18 (or under the age of 16 for EEA residents). If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.
14. International Data Transfers
Software Quality Guru operates primarily in the United States. If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.
For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on appropriate transfer mechanisms as required by GDPR Chapter V:
Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses (2021/914/EU) with service providers where applicable
UK International Data Transfer Agreements (IDTAs): For UK data transfers, we rely on the UK IDTA framework as applicable
Adequacy Decisions: Where the European Commission has issued an adequacy decision for the relevant country
By submitting personal information through our website or services, you acknowledge that your information may be transferred to and processed in the United States.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "Last Updated" date.
For material changes that significantly affect your rights or how we process your data, we will provide at least 30 days' advance notice by prominent notice on our website or direct communication where we have your contact information.
Your continued use of our website or services after any changes constitutes your acceptance of the updated policy. We recommend reviewing this policy periodically.
16. Contact Us & Supervisory Authority
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Software Quality Guru — Data Controller
Email: frank@softwarequality.guru
Website: softwarequality.guru
Location: Virginia, United States
For GDPR-related requests, please include "Privacy Request — GDPR" in the subject line of your email. We will acknowledge receipt within 72 hours and respond to your request within one month.
Supervisory Authority Complaints (GDPR Art. 77)
You have the right to lodge a complaint directly with a data protection supervisory authority without first contacting us. Relevant authorities include:
EU/EEA: Your local Member State supervisory authority (full list at edpb.europa.eu)
Ireland: Data Protection Commission — dataprotection.ie
United Kingdom: Information Commissioner's Office — ico.org.uk
Germany: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit — bfdi.bund.de
France: Commission Nationale de l'Informatique et des Libertés — cnil.fr
We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority, and ask that you contact us in the first instance.