Security & privacy

Quorello is private by default, built and operated in Switzerland, and financed by subscriptions alone — so we have no reason to sell your data or train models on your prompts, and we don't.

This page explains, in plain terms, where your data goes and what we do and don't do with it. For the binding detail, read the Privacy Policy; for the reasoning behind these choices, see our privacy principles.

Private by default (Zero Data Retention)

Private mode is on by default for supported models. When it's enabled, we instruct our routing layer (OpenRouter) to send your request only to provider endpoints that operate under Zero Data Retention (ZDR): they do not retain your prompt after responding, and they do not use it to train their models.

• Models that don't offer a ZDR endpoint are disabled while Private mode is on — you simply can't route a private question to a non-ZDR model by accident.
• Conversations run in Private mode are not saved to your history on our servers. Once the answer is shown, they leave no trace with us.
• Under ZDR, a request may be served via alternative infrastructure that supports the no-retention terms (for example, Amazon Bedrock or Microsoft Azure).

What we never do

Three things we don't do, ever:

• We don't sell your data. We never sell or rent your personal information. Our only incentive is your subscription — not your data and not your attention.
• We don't train on your prompts. We never use your questions or the AI answers to train any model. In Private mode, requests route only to Zero Data Retention endpoints, so the providers don't train on them either.
• We don't write your uploaded files to disk. Documents you attach are extracted in memory only, never written to our disk, database, or logs, and discarded once your answer is shown.

Where your data goes

To cross-check your question, Quorello routes it to several AI models from independent providers and relies on a small set of infrastructure partners. These are our sub-processors:

Each AI provider must read your prompt in order to answer it, and handles data under its own privacy policy. We share information with these sub-processors only to operate the Service, and otherwise only when required by law.

Data residency & transfers

Quorello is built and operated in Switzerland, and we process personal data under Switzerland's revised Federal Act on Data Protection (FADP), which is aligned with the EU's GDPR. The EU recognises Switzerland as providing an adequate level of data protection.

Because the AI providers and our infrastructure partners operate globally, your prompt may be processed abroad, including outside the EEA and UK. Where required, such transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses. OpenRouter offers EU Standard Contractual Clauses and, for some models, in-region routing.

We don't promise that every request stays inside Switzerland or the EU — that would depend on the models you choose. We do promise to be precise about how it works.

Your controls

You decide what's kept and what's shared:

• Delete conversations anytime. Remove any saved conversation, or clear all of them, from within the app.
• Self-service account deletion. Permanently delete your account and all associated data yourself from the account menu, in line with your right to erasure (GDPR/FADP Art. 17). This also cancels any active subscription.
• Private mode toggle. Turn Private mode off if you want access to the full model panel, or leave it on (the default) to route only to Zero Data Retention endpoints and keep conversations off your history.

Uploaded documents

On paid plans you can attach a PDF, Word, or text file to ground a question. We treat these with extra care:

• The file's text is extracted in memory only — never written to our disk, database, or logs.
• The extracted text is discarded once your answer is shown.
• Document questions always run in Private mode (Zero Data Retention), so they're not saved to your history.

As with any prompt, a document's contents are transmitted to the independent AI providers to answer your question — so only upload material you have the right to share with them.

Honest limits

Trust is worth more than marketing, so here's what Quorello is not:

• Prompt content can't be end-to-end encrypted. An AI provider has to receive your prompt in readable form to answer it. Private mode stops providers from retaining or training on it, but it can't make a question invisible to the model answering it. Don't paste anything you wouldn't be willing to share with an AI provider.
• Private mode narrows the model panel. Requiring Zero Data Retention means some models are unavailable while Private mode is on. That's a deliberate trade-off — privacy over panel size.
• Quorello is a verification layer, not an insurance policy. Cross-checking independent providers helps you catch and reduce errors and blind spots; it doesn't eliminate them, and it isn't uptime, disaster-recovery, or professional-advice insurance. The professional stays responsible and signs off.

Read the detail — or just try it

The full, binding text lives in our Privacy Policy, and the thinking behind it is in our privacy principles. If anything here is unclear, we'd rather answer than leave you guessing.

The best way to judge how we handle data is to see it work: start a question in Private mode and watch several independent providers cross-check the answer — with nothing saved once you've read it.