【English】

Trust, Security & Data Governance

Built to minimize what we retain.

QYNE is designed to help professionals think through important business and management issues.

Because those issues may contain commercially sensitive information, our approach to data protection begins with a simple principle:

Do not retain more data than is necessary to provide the service.

QYNE does not operate its own proprietary foundation model, nor is the service designed around building a permanent database of customers' management issues.

Instead, QYNE uses established cloud, workflow and AI platforms for the principal components of the service, while minimizing the amount of information retained directly for normal QYNE operations.

​

​

At a Glance

Primary account identifier
Email address
 

Account environment
Wix

QYNE operational retention of submitted management issues
Up to 24 hours

Routine access by QYNE customer-support staff after 24 hours
No

Technical workflow log retention in the current Dify environment
Up to 30 days

Routine use of Dify technical logs for customer-support history lookup
No
 

Permanent user-linked database of management issues for normal use
No

Research use of submitted issues
Only with explicit opt-in consent in the free trial

Research data directly linked to the user's email address
No
 

Use of submitted management issues to train a proprietary QYNE foundation model
No

Autonomous corporate decision-making by QYNE
No

Human decision responsibility
Yes

​

​

​

How QYNE Handles Submitted Management Issues

QYNE distinguishes between:

1. operational data used to provide the service;

2. technical system logs;

3. research data that a free-trial user has explicitly agreed may be used for research.

These categories are handled differently.

​

1. Normal Service Use

When a user submits a management issue to QYNE, the information is processed for the purpose of generating the relevant question structure and AI-ready output.

QYNE Operational Environment

Submitted management issues available within QYNE's normal operational environment are deleted within 24 hours of submission.

This means that QYNE's regular operating and customer-support staff generally cannot retrieve a user's previous management issue after that period.

QYNE is not designed to provide a long-term history of previously submitted management issues.

Users who wish to retain their own inputs or outputs should keep a copy in their own environment.

​

2. Technical Workflow Logs

QYNE currently uses Dify as part of its AI workflow infrastructure.

In the Dify environment currently used by QYNE, technical execution logs may contain submitted input and are retained for up to 30 days.

Logs older than the applicable 30-day period are deleted under the current Dify environment's log-retention configuration.

These technical logs are not maintained as a QYNE customer-history database and are not intended for routine customer-support lookup.
 

Access to technical logs is restricted to authorized system-administration personnel and is intended for technically necessary purposes such as:

• system maintenance;

• troubleshooting;

• investigation of technical failures;

• security investigation;

• service integrity.

The existence of a technical execution log does not mean that QYNE offers a 30-day user-history or retrieval service.

​

​

If You Contact QYNE About a Previous Input

QYNE's normal customer-support environment is not designed to retain submitted management issues for long-term retrieval.

As a result, once the normal 24-hour operational period has passed, QYNE staff may no longer be able to confirm, reproduce or recover the management issue that you previously submitted.

Technical workflow logs that may temporarily remain in the underlying system are not used as a routine customer-support archive.

For this reason, users should retain their own copy of any input or output that they may need later.

​

​

3. Research Use — Free Trial Only

The QYNE free trial includes an optional research-consent choice.

Users may choose whether to agree to the following:

“I agree that the data (management issue) I submit may be used for QYNE research.”

Research consent is voluntary.

A user can use the core free-trial experience without agreeing to research use.

QYNE stores a submitted management issue as research data only when the user has explicitly opted in to this research use.

If the user does not opt in, QYNE does not intentionally retain that management issue as QYNE research data.

​

​

​

What “Research” Means at QYNE

Research use may include:

Analysis of Management-Issue Trends

Understanding the types of management challenges, uncertainties and decision situations users bring to QYNE.

Improvement of Question-Design Logic

Improving QYNE's ability to identify important perspectives, missing considerations, constraints and strategic trade-offs.

Prompt Quality Evaluation

Evaluating and improving the structure, usefulness, completeness and relevance of prompts generated by QYNE.

Service Improvement

Improving QYNE's functionality, user experience, decision-structuring methodology and overall service quality.

Research use does not mean that QYNE is building a proprietary foundation model from customers' management issues.

​

​

​

Separation of Research Data and Account Information

Where a free-trial user explicitly agrees to research use, the relevant management-issue data is stored separately within the Wix environment for research purposes.

The research record is not directly linked to the user's email address.

QYNE's principle is to avoid attaching user-identifying account information to research data when that information is not required for the stated research purpose.

​

However, users should understand that the text of a submitted management issue may itself contain:

• personal names;

• company names;

• client names;

• unpublished figures;

• transaction details;

• other potentially identifying information.

For this reason, QYNE does not describe research-consent data merely as “anonymous data.”

Where appropriate, users should avoid entering unnecessary identifying or highly confidential information.

​

​

Research Data Is Different From Normal Operational Data

The normal 24-hour operational deletion period and the Dify technical-log retention period apply to normal service processing.

Research data that has been explicitly authorized by a free-trial user is handled separately for the stated research purposes and is not treated as ordinary service-history data.

Research consent is therefore an explicit exception to QYNE's normal non-retention model.

​

​

AI Model Training

QYNE does not operate a proprietary foundation model or large language model.

Submitted management issues are not used to train a proprietary QYNE foundation model.

Where research consent has been provided, the purpose of retaining the relevant issue is limited to activities such as:

• management-issue trend analysis;

• improvement of question-design logic;

• prompt-quality evaluation;

• QYNE service improvement.

QYNE uses external AI infrastructure to perform relevant AI processing.

​

​

OpenAI API Data Use

QYNE uses the OpenAI API as part of its AI-processing architecture.

OpenAI states that, by default, data submitted through its API platform — including inputs and outputs — is not used to train or improve OpenAI's models unless the customer explicitly opts in. OpenAI also states that its API and relevant business services have undergone an independent SOC 2 Type 2 examination and are supported by multiple ISO certifications.

These are OpenAI's controls and certifications and should not be interpreted as QYNE's own certification.

​

​

QYNE Service Architecture

QYNE is designed using established cloud, workflow, AI and payment-service providers rather than a large proprietary customer-data infrastructure.

​

The current service architecture principally uses:

Wix
Web application and account-related functions

Dify
AI workflow and orchestration

Make
Workflow automation and service-to-service processing

OpenAI API
AI inference and model processing

Stripe
Payment processing

The exact flow may vary depending on the function being performed.

​

​

Simplified Data Flow

User

↓

QYNE Web Interface

Wix

↓

Workflow / AI Orchestration

Dify / Make

↓

AI Processing

OpenAI API

↓

QYNE Output

↓

User

Payment-related processing is handled separately through Stripe where applicable.

Third-Party Security and Compliance

QYNE deliberately uses established service providers for major infrastructure components.

Each provider maintains its own security, compliance and data-protection program.

​

Wix

Wix publicly states that its security and compliance program includes SOC 2 Type 2, PCI DSS Level 1 and multiple ISO certifications, including ISO 27001.

QYNE currently uses Wix for its web environment and account-related functions, including management of the user's email address.

​

Dify

Dify announced in March 2026 that it had completed SOC 2 Type II and ISO 27001:2022 audits for the second consecutive year.

QYNE uses Dify as part of its AI workflow and orchestration infrastructure.

The current QYNE Dify environment retains applicable technical execution logs for up to 30 days.

​

Make

Make publicly states that it has completed SOC 2 Type II and SOC 3 audits and operates an information-security program certified to ISO 27001.

QYNE uses Make for workflow automation and service-to-service processing.

Data handled through Make is subject to the applicable QYNE workflow configuration and Make service settings.

​

OpenAI

OpenAI states that its API and relevant business product services have undergone an independent SOC 2 Type 2 examination.

OpenAI also maintains ISO/IEC 27001 and related information-security and privacy certifications for applicable services.

OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in.

​

Stripe

Stripe is used for payment processing.

Stripe states that it maintains SOC 1 and SOC 2 reports and operates its applicable services in accordance with PCI DSS Level 1 requirements.

QYNE does not design its service around independently storing users' payment-card information in a proprietary QYNE payment database.

​

​

Important: These Are Not QYNE Certifications

The certifications, audits and compliance programs described above apply to the relevant third-party providers and to the scope of their respective services.

They do not mean that QYNE itself has obtained:

• SOC 2 Type II certification or examination;

• ISO/IEC 27001 certification;

• PCI DSS Level 1 certification;

unless QYNE separately and explicitly states that it has done so.

QYNE does not present a third party's certification as its own.

​

QYNE's Security Model Is Based on Shared Responsibility

Using independently assessed infrastructure does not remove QYNE's own responsibility.

QYNE remains responsible for the aspects of the service that it controls, including, as applicable:

• service configuration;

• administrator access;

• credential and API-key management;

• data-flow design;

• data-minimization practices;

• retention settings;

• subprocessor selection;

• privacy disclosures;

• incident management;

• appropriate use of customer information.

Third-party certifications provide assurance regarding the relevant provider.

They do not substitute for QYNE's responsibility for how those services are configured and used.

​

​

Why QYNE Uses a Data-Minimization Model

QYNE's core value does not depend on accumulating a historical database of customers' management issues.

The purpose of QYNE is to help a user determine:

What should I be considering before asking AI what I should do?

Once that task has been completed, QYNE generally has no operational need to maintain the user's management issue indefinitely.

For that reason, QYNE's normal design favors limited retention over long-term accumulation.

​

​

Human Decision Responsibility

QYNE is a decision-structuring service.

It is not an autonomous corporate decision-maker.

QYNE may help users identify:

• missing considerations;

• strategic trade-offs;

• assumptions;

• constraints;

• stakeholder perspectives;

• questions that should be answered before a decision is made.

QYNE does not independently authorize:

• investments;

• contracts;

• procurement decisions;

• mergers and acquisitions;

• hiring or dismissal decisions;

• legal actions;

• financial commitments;

• other material corporate decisions.

Final decision authority remains with the user and the user's organization.

​

​

QYNE Does Not Claim That AI Is Always Correct

Generative AI can produce incomplete, inaccurate or misleading information.

QYNE is intended to improve the structure of the issue presented to AI.

It does not guarantee the accuracy of every fact or conclusion produced by downstream AI systems.

Material facts should be independently verified where a decision may have significant:

• financial;

• legal;

• regulatory;

• security;

• organizational;

• strategic

consequences.

​

​

Confidential and Restricted Information

QYNE may be used to structure important management issues.

However, customers should comply with their own organization's:

• information-security policies;

• AI-use policies;

• confidentiality requirements;

• privacy rules;

• contractual restrictions;

• regulatory obligations.

Users should not submit information to QYNE where their organization prohibits that information from being processed by external cloud or AI services.

Where appropriate, users should consider removing or replacing:

• personal names;

• customer names;

• unpublished transaction details;

• highly confidential financial figures;

• M&A code names;

• regulated personal information;

• other unnecessary identifiers.

Enterprise Procurement and Security Review

QYNE does not encourage organizations to bypass their normal:

• procurement process;

• information-security review;

• legal review;

• privacy review;

• AI-governance review;

• internal approval process.

Organizations considering QYNE should evaluate the service against their own requirements.

Relevant review areas may include:

• data flow;

• data retention;

• subprocessors;

• AI providers;

• privacy;

• security;

• confidentiality;

• internal AI governance;

• contractual requirements;

• mandatory certifications.

Data Handling Summary

Account Information

Primary identifier:
Email address

Environment:
Wix

​

Normal Submitted Management Issues

QYNE operational availability:
Up to 24 hours

Availability to normal QYNE customer-support operations after 24 hours:
Generally unavailable

​

Permanent QYNE customer-history database:
No

​

Technical Workflow Logs

Platform:
Dify

​

Maximum retention in the current QYNE environment:
30 days

​

Purpose:
Technical operation, troubleshooting, service integrity and security-related investigation

​

Routine customer-support archive:
No

​

Access:
Restricted to authorized system-administration personnel when technically necessary

​

Research Data

Applicable users:
Free-trial users who explicitly opt in

​

Research consent required:
Yes

​

Default consent:
No

​

Research use without explicit consent:
No

​

Storage environment:
Wix

​

Direct linkage to email address:
No

​

Research purposes:
Management-issue trend analysis, question-design improvement, prompt-quality evaluation and QYNE service improvement

​

AI Training

QYNE proprietary foundation model:
No

Submitted issues used to train a proprietary QYNE foundation model:
No

Frequently Asked Questions

Does QYNE store the management issue I enter?

For normal service use, QYNE does not maintain submitted management issues as a permanent customer-history database.

The issue is available in QYNE's normal operational environment for up to 24 hours.

Technical execution logs may remain in the current Dify environment for up to 30 days.

​

Can QYNE customer support retrieve my input after 24 hours?

Generally, no.

The normal QYNE customer-support environment is not designed to provide historical retrieval after the 24-hour operational period.

Temporary technical logs are not maintained as a routine support archive.

​

If technical logs still exist, can I ask QYNE to retrieve my previous input from them?

Technical logs are reserved for technically necessary system-administration purposes and are not intended to function as a customer-history retrieval service.

Users should retain their own copy of information they may need later.

​

Does QYNE use my management issue to train its own AI model?

No.

QYNE does not operate a proprietary foundation model trained on users' management issues.

​

Does QYNE use submitted issues for research?

Only where a free-trial user has explicitly opted in to research use.

Without explicit consent, submitted issues are not intentionally retained as QYNE research data.

​

What happens if I agree to research use?

The relevant issue may be stored separately in Wix for QYNE research purposes, including:

• management-issue trend analysis;

• question-design improvement;

• prompt-quality evaluation;

• service improvement.

The research record is not directly linked to the user's email address.

​

Is QYNE SOC 2 certified?

QYNE does not currently claim a standalone SOC 2 examination.

Several major third-party platforms used by QYNE maintain their own SOC 2 examinations and other security certifications.

Those certifications belong to the relevant providers and do not constitute QYNE's own certification.

​

Why does QYNE disclose the security certifications of its infrastructure providers?

Because enterprise security is not only a question of which certification logo appears on a vendor's website.

It is also important to understand:

• where information is processed;

• which providers process it;

• how long information is retained;

• which party controls which part of the system;

• which security controls apply at each layer.

QYNE therefore distinguishes between its own responsibilities and the independent assurance maintained by its infrastructure providers.

​

​

Our Approach

QYNE does not believe that the safest statement an AI company can make is:

“Your data is completely safe.”

No responsible cloud or AI service can eliminate every risk.

​

We believe a more useful standard is transparency:

What do we collect?

Where is it processed?

How long is it retained?

Who can access it?

What is it used for?

What do we deliberately not do with it?

QYNE applies the same principle to its own service that it applies to decision-making:

Make the important questions visible before making assumptions.

​

​

The QYNE Principle

QYNE is not designed to ask users to trust AI blindly.

It is designed to help people think more clearly while using AI.

That principle also defines how we approach data.

Retain less.
Explain more.
Keep the human responsible.

Last Updated: September 2026

QYNE's architecture, third-party services and provider certifications may change over time.

Where a third-party provider's security, compliance or data-processing status is relevant to your organization's assessment, please refer to the provider's current official documentation and complete your organization's own vendor review.

For enterprise security, privacy, procurement or data-handling questions regarding QYNE, please contact QYNE.