Q-Courier Privacy Policy

1. Introduction and scope

This Privacy Policy describes how QuantumRonics Pvt Ltd. (“QuantumRonics”, “we”, or “us”) processes information through Q-Courier, a secure mail platform that includes mail services and responsive webmail. Q-Courier may be deployed and administered on a customer-controlled server. The customer organization’s configuration, policies and agreements may affect how data is managed.

2. Information we process

• Account and profile data: email address, account name, password-verification hash, mailbox and domain association, quota, account status and optional profile fields such as name, phone number, department, birthday and recovery email.
• Authentication and security data: optional TOTP secret and backup codes, administrative session identifiers/timestamps/data, S/MIME certificates and related key material, login attempts, client IP addresses, SMTP session metadata, TLS details and security events.
• Mail and collaboration content: email message bodies, headers, senders and recipients, attachments, drafts, contacts, calendars, aliases, mailbox settings and user preferences.
• Directory integration data: where AD/LDAP synchronization is configured, Q-Courier may process email address, display name and account-enabled status. A directory service-account bind credential is stored for scheduled synchronization. For directory-authenticated users, the directory password is validated through LDAP bind and is not stored locally by Q-Courier.
• Device information: ActiveSync device identifiers are stored when ActiveSync is used. The backend does not include a separate native Q-Courier mobile app; mobile access may use mail protocols, ActiveSync, or responsive webmail.
• Mail security and operations data: spam and virus scan results, audit logs, web server access logs, error logs, SMTP session records and system events.

3. How content is used

Q-Courier stores and processes email bodies, headers, recipients, attachments and drafts to deliver, store, scan and display email. It processes contacts and calendars to provide those features. For S/MIME email, the service may decrypt messages for display using the server-held key material. Mail is not synchronized to an outside system by default; it is transmitted to intended recipients and to the external services described in this policy.

4. AI features

Optional AI features may use Google Gemini to process email content for a user-requested feature, such as summarization, when the feature is enabled and used. AI processing is optional. Do not submit content to an AI feature unless you are authorized to do so. Provider processing is subject to the applicable provider terms and configuration. This policy does not make a blanket claim about provider retention or training beyond what has been verified for the particular service and configuration.

5. Security, spam and certificate services

Q-Courier uses ClamAV and SpamAssassin-related updates and DNS blocklists for mail security functions. Let’s Encrypt may be used to issue certificates. DNS hosting and remote mail-exchange (MX) servers are part of mail delivery. These services may process technical information necessary to provide their function. Q-Courier does not use analytics, crash-reporting, push-broker, or third-party email-delivery providers according to the current backend inventory.

6. Directory and external mail sharing

When a customer configures AD/LDAP, information needed for account synchronization and authentication is exchanged with that directory. Outbound email is sent to recipient mail systems, which operate under their own policies. Email may be transmitted between mail servers using opportunistic TLS; encryption between independent mail servers is not guaranteed for every message or hop.

7. Storage and encryption

The current deployment inventory identifies PostgreSQL for account, mailbox metadata, contacts, calendars, preferences, licensing, audit and scan logs; Maildirs for messages and attachments; /var/lib/qcourier for keys; and /etc/qcourier for the certificate authority. Backups are stored on the same customer host. Web and mail clients use TLS 1.2/1.3 and server-to-server TLS is opportunistic. Passwords are stored as SSHA512 hashes. S/MIME uses a local CA (RSA 4096). User private keys are generated and held on the server as PKCS#12 material. The application does not provide encryption at rest for mail.

8. Who can access information

Customer administrators manage accounts, passwords, certificates and logs according to role-based permissions. The administrative interface does not include a mailbox viewer, but the host operator with root-level access can technically access stored mail and key material. QuantumRonics, as the product vendor, does not have access to a customer’s deployment unless the customer grants access. Access granted for support or maintenance should be appropriately authorized.

9. Retention

• Mail and attachments: retained until deleted by the user or through account/mailbox removal, subject to the configured mailbox keep period.
• Removed mailboxes: the administrator can configure a keep period of 1–365 days; a global administrator may configure indefinite retention. An hourly job processes eligible mailbox deletion after the keep period.
• Database backups: retained for 90 days. Backups are stored on the same host as the deployment.
• nginx logs: retained according to 14 log rotations.
• System logs: retained for approximately four weeks.
• Administrative log retention is configured for 365 days, but the cleanup job was not scheduled in the reviewed inventory; actual deletion may therefore not occur automatically as configured.

10. Account deletion and data export

Q-Courier accounts are created and managed by an administrator, through the administrative interface, bulk import, or directory synchronization; public self-registration is not available. Account removal is performed by an administrator. Mailbox content may be retained for the configured keep period before deletion, or indefinitely if configured by a global administrator. Users can access or export mail using IMAP/POP3, export contacts in vCard/ZIP formats, export calendars and export PKCS#12 material where supported. There is no single-click export of all account data. For assistance, contact your administrator or submit a ticket at https://support.quantumronics.com/. See the separate account deletion policy at https://quantumronics.com/qcourier/account-deletion.

11. Your requests

For privacy, access, correction, or deletion-related requests, contact your organization’s Q-Courier administrator or submit a ticket through https://support.quantumronics.com/. Because the service is deployed on the customer’s server and administrators control accounts and retention, QuantumRonics may need to coordinate with the customer organization. Requests are subject to applicable law and legitimate retention requirements.

12. Changes and contact

We may update this policy to reflect changes to Q-Courier, its deployment, or legal requirements. The current version will be published at https://quantumronics.com/qcourier/privacy-policy.

QuantumRonics Pvt Ltd.
Office #107, 1st Floor, Evacuee Trust Complex, Agha Khan Road, F-5/1, Islamabad, Pakistan
Central support ticket portal (all QuantumRonics products): https://support.quantumronics.com/
Email: support@quantumronics.com
Q-Courier Privacy Policy: https://quantumronics.com/qcourier/privacy-policy
Q-Courier Terms & Conditions: https://quantumronics.com/qcourier/terms-and-conditions
Q-Courier Account Deletion Policy: https://quantumronics.com/qcourier/account-deletion