Privacy Policy

Last updated: July 4, 2026 · QSai LLC ("Custody", "we")

Who we are

QSai LLC operates Custody, a third-party logistics (3PL) and fulfillment service for privacy and security hardware vendors, part of the CISO Marketplace ecosystem. For vendor data submitted through our intake and portal, we act as a controller. For end-customer order data we process on a vendor's behalf (names, shipping addresses, order contents), we act as a processor — the vendor is the controller, and our Data Processing Agreement governs that processing.

What we collect and why

Vendor intake & portal accounts — company details, contact name/email, product and logistics information you submit. Used to scope, quote, and operate fulfillment services. Legal basis: pre-contract steps and contract performance.
End-customer order data — recipient name, shipping address, email, and order contents received from your vendor. Used solely to fulfill, ship, track, and process returns. Legal basis: the vendor's instructions under our DPA.
Returns portal — serial number, order email, and return reason, used to verify ownership and authorize the return. We match these against existing order records and retain the return record with the shipment history.
Cost estimator — the volumes you enter are processed to compute a range and are not stored with any identity.
Technical — IP-based rate limiting (temporary, auto-expiring), Cloudflare Turnstile bot checks on forms, and operational logs. No advertising trackers, no analytics cookies, no third-party ad tech.

Chain-of-custody records

Our service maintains tamper-evident, append-only custody records for every device we handle. Shipment and return events referencing a recipient are part of that evidentiary record and are retained for the duration of our vendor agreement plus the period required for legal, warranty, and audit purposes.

Where data lives and who touches it

Data is processed on Cloudflare's global infrastructure (Workers, D1, R2). Sub-processors: Cloudflare (hosting), EasyPost and downstream carriers (shipping labels and tracking — recipient name/address are necessarily shared to ship), Stripe (vendor billing), and Resend (transactional email via our support system). We do not sell personal data. We share it only with these sub-processors, with your vendor (for end-customer data), or when legally compelled.

Your rights

EU/UK (GDPR), California (CCPA/CPRA), and similar laws give you rights of access, correction, deletion, portability, and objection. End customers: because your vendor is the controller of your order data, direct requests to them — we support vendors in fulfilling them. Vendors and direct contacts: email info@cisomarketplace.com and we will respond within 30 days. You may also lodge a complaint with your supervisory authority.

Retention

Intake submissions that don't convert are deleted after 12 months. Order, shipment, and custody records are retained for the vendor relationship plus statutory retention periods. Rate-limit and bot-check data expires automatically within days.

Changes

We'll post updates here with a new "last updated" date; material changes are notified to vendors directly.

← cisomarketplace fulfillment · Service Terms · DPA