Privacy Policy

1. Introduction & Scope

QESaaS ("QESaaS," "we," "us," or "our") is an independent quality engineering practice. We provide professional services — Pre-Launch QA Audits, Expert Witness retainers, FDA 483 / Warning Letter response packages, and ISO 13485 / 9001 audit prep — to consumer product brands, medical device firms, quality directors, and litigation teams.

This Privacy Policy explains how we collect, use, and protect personal information in connection with: (a) visits to qesaas.com, (b) inquiries submitted through our contact form or email, and (c) professional engagements with our clients. By using this site or contacting us, you agree to the practices described below.

2. Information We Collect

2.1 Information You Provide Directly

Inquiry Information. When you contact us through the website form or by email, we collect the information you choose to send: name, email address, company or firm name (where provided), the service you're inquiring about, and the contents of your message.

Engagement Information. If we accept an engagement, we collect information necessary to perform the work — for example, product specifications, supplier documentation, photographs, design files, complaint data, regulatory correspondence (such as FDA 483 observations or Warning Letters), QMS documents, and case materials. The specific information collected depends on the service.

Conflict-Check Information (Expert Witness Inquiries). For litigation engagements, we collect the case caption, parties involved, and the side you represent in order to clear conflicts before any substantive discussion.

Billing Information. Names and addresses needed to issue invoices and process payment. Payment is processed by third-party payment processors (such as Stripe or QuickBooks Payments); QESaaS does not store full payment-card numbers on its own systems.

2.2 Information Collected Automatically

Server Logs. Our website host records standard server log information for each request: IP address, user-agent string, page requested, referrer, and timestamp. This is used for site reliability, diagnostics, and security monitoring.

Cookies & Web Analytics. See Section 6 below.

3. How We Use Information

• Respond to inquiries submitted via the contact form or by email
• Run conflict checks before agreeing to litigation or expert-witness engagements
• Scope, deliver, and bill for accepted engagements
• Communicate with clients about active engagements (status, deliverables, follow-up)
• Issue invoices, collect payment, and maintain records required for tax and accounting
• Comply with legal, regulatory, and professional record-keeping obligations
• Maintain site security, troubleshoot errors, and improve site usability

We do not use engagement materials to train AI models that are accessible to other clients, and we do not publish engagement materials as case studies or marketing content without written consent from the client.

4. Engagement Materials & Confidentiality

Engagement materials — product specs, supplier documents, design files, QMS records, FDA correspondence, case materials, and any other information shared in connection with a paid engagement — are treated as the client's confidential information.

• NDA available. A mutual NDA can be signed before any engagement materials are exchanged. Clients may use our one-page template or supply their own.
• Limited internal use. Engagement materials are accessed only by Mark Mayeux and any subcontractor specifically authorized in writing by the client.
• No reuse across clients. Confidential engagement materials are not reused for other clients, are not published as case studies without consent, and are not shared with third parties except as described in Section 5.
• Litigation conflicts. Once retained for one side in a litigated matter, we will not consult or testify for the opposing side in the same matter.

5. Information Sharing

We share information only as needed to operate the practice and deliver engagements:

We may also disclose information when required to do so by law (court orders, subpoenas, governmental requests), to enforce our engagement terms, to protect against fraud, or in connection with a business transfer (sale, merger, or assignment of the practice).

6. Cookies & Web Analytics

The site uses minimal first-party cookies necessary for navigation. We may use a privacy-respecting web analytics tool to count page visits and understand which pages are most useful — analytics data is aggregated and does not identify individual visitors. We do not use behavioral advertising trackers and we do not sell visitor data.

You may block or delete cookies using your browser settings. Doing so should not affect your ability to read site content or contact us.

7. Data Security

• TLS encryption for the website and for email in transit (where supported by your provider)
• Encrypted storage on workstations used for engagement work (full-disk encryption)
• Access controls limiting engagement materials to Mark Mayeux and authorized subcontractors
• Standard endpoint security (current OS, anti-malware, host firewall) on devices used for engagement work
• Multi-factor authentication on email, accounting, and payment processor accounts
• Reasonable record disposal once retention periods expire (see Section 8)

No system is perfectly secure. While we use reasonable safeguards, we cannot guarantee absolute security against every possible attack.

8. Data Retention

Retention may be extended where required by law, regulation, professional standards, or active or anticipated litigation.

9. Your Privacy Rights

Subject to applicable law, you have the right to:

• Access — request a copy of personal information we hold about you
• Correct — request correction of inaccurate information
• Delete — request deletion of personal information (subject to retention obligations described in Section 8)
• Opt out of marketing — although QESaaS does not run automated marketing campaigns; if you receive an email and want it to stop, simply reply

To exercise these rights, email [email protected]. We aim to respond within 30 days.

10. California Privacy Rights (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including:

• Right to Know — what personal information we collect and how it's used
• Right to Delete — request deletion of your personal information
• Right to Correct — request correction of inaccurate information
• Right to Opt-Out of Sale or Sharing — we do not sell personal information and we do not "share" it for cross-context behavioral advertising
• Right to Non-Discrimination — we will not deny services or charge different prices for exercising your rights

Categories of personal information we may collect: identifiers (name, email, IP address); commercial information (engagement / billing records); professional information (firm/company name, role); internet activity (server logs); and inferences drawn from those categories. QESaaS does not collect biometric, geolocation, or sensitive personal information beyond what is voluntarily included in an inquiry or engagement.

11. Other State Privacy Rights

Residents of states with comprehensive consumer privacy laws — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA), among others — have rights to access, correct, and delete personal information; to obtain a portable copy where applicable; to opt out of targeted advertising (not applicable — we do not engage in targeted advertising); and to opt out of the sale of personal information (not applicable — we do not sell data). To exercise these rights, email [email protected].

12. Children's Privacy

The QESaaS website and our engagements are directed at businesses, professionals, and litigation teams — not children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided personal information through this site, please contact [email protected] and we will delete it.

13. International Visitors

QESaaS is a U.S. practice and our services are intended for U.S. clients and U.S. regulatory matters. If you access this site from outside the United States, please be aware that information you submit will be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction. By contacting us, you consent to that transfer.

14. Third-Party Links

The site may link to external sites — for example, government recall databases (CPSC, FDA, USDA, NHTSA), the RecallSentry™ consumer app site, or referenced reference materials. QESaaS is not responsible for the content or privacy practices of those third-party sites. Please review their own privacy policies before submitting information.

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last Updated" date at the top of this page. For active engagements, material changes affecting how engagement materials are handled will be communicated by email.

16. Contact Us

Mailing Address:
QESaaS
Atlanta, GA · United States

Website: https://qesaas.com