QueryTek Review Privacy Policy

QueryTek Review is a business service that lets authorized users upload documents, track review status, and receive reviewed outputs through a secure workspace. This Privacy Policy explains what personal data Extanto Technology, LLC collects through QueryTek Review, how that data is used, when it is shared, and what rights users and client organizations may have.

QueryTek Review is part of the QueryTek™ product suite. The QueryTek™ names, including QueryTek™, QueryTek Review™, QueryTek Tapestry™, and QueryTek Assessments™, are trademarks owned by Extanto Technology, LLC. Extanto Technology, LLC is located at 1920 Glenmorrie Drive, Lake Oswego, Oregon 97034. Questions about this Privacy Policy may be sent to querytek-support@extanto.com.

Who this policy applies to

This Privacy Policy applies to personal data processed through QueryTek Review, including data connected to client organizations, their authorized users, and Extanto personnel who use the platform to operate the review workflow. QueryTek Review is intended for business users, not personal or household use.

In many cases, Extanto handles data in QueryTek Review on behalf of a client organization. That means the client organization decides why certain submission content is used in its workspace, and Extanto processes that data to provide the service. In other cases, Extanto uses personal data for its own business purposes, such as account administration, support, security, billing records, legal compliance, and service operations.

This policy also applies to visitors who browse the public marketing site at review.querytek.io before signing in, including visitors located in the European Economic Area, the United Kingdom, or Switzerland.

What personal data is collected

Depending on how QueryTek Review is used, Extanto may collect the following types of personal data:

• Account information: name, business email address, organization, role, login identifiers, and account status.
• Workspace and submission information: uploaded documents, document metadata, file names, document IDs, review module selections, status history, and download history.
• Review information: annotations, findings, flagged excerpts, reviewer comments, recommendations, scorecard data, and related review outputs.
• Operational and security records: user IDs, tenant IDs, timestamps, action logs, status changes, audit records, and system-generated security events.
• Payment-related metadata: quoted price, currency, word count, payment status, WooCommerce order ID, and payment timing data.
• Communications: support emails and service notifications such as submission confirmations, quote notices, payment acknowledgments, and completion notifications.
• Security verification data: browser and session information needed to authenticate users and protect the service from abuse.
• Browser storage on the portal: limited first-party keys such as a support reference ID (review_last_request_id in session storage), optional appearance preferences when you opt in on Settings → Appearance, and optional help-topic feedback votes after you submit Yes/No. A full inventory is listed in the Cookie Notice.

Extanto aims to collect only the information needed to run the service, protect it, support users, and meet legal or contractual obligations.

How personal data is collected

Personal data may be collected directly from users and client organizations when accounts are created, users sign in, documents are uploaded, review work is performed, payment is initiated, or support requests are sent. Personal data may also be created automatically as part of normal platform operation, such as audit logs, status updates, system metrics, and payment confirmation events.

Why personal data is used

Extanto uses personal data to:

• Provide and operate QueryTek Review.
• Authenticate users and enforce role-based access controls.
• Keep client workspaces separated and secure.
• Receive, store, review, annotate, and return submitted documents and scorecards.
• Send service-related notices and updates.
• Generate quotes, direct users to payment, confirm payment status, and keep transaction records without handling payment card data directly inside QueryTek Review.
• Maintain logs, audit trails, backups, and security controls.
• Respond to support requests, prevent misuse, enforce agreements, and comply with legal obligations.

Legal bases for UK, EU, and Swiss users

If UK, EU, or Swiss privacy law applies, Extanto relies on one or more legal bases depending on the situation. These may include performing a contract, taking steps requested before entering into a contract, complying with legal obligations, pursuing legitimate interests in operating and securing the service, or consent where consent is required.

Because QueryTek Review is a secure business platform with authenticated access, many processing activities are necessary to provide the service requested by client organizations and their users.

For representative portal browser storage (see also the Cookie Notice):

• Strictly necessary — sign-in and session technologies (Keycloak), security verification (Cloudflare Turnstile), and the last API support reference ID stored for the current browser session so error messages can show a correlation reference. Lawful basis: performance of a contract and/or legitimate interests in secure operation and support.
• Preferences (consent) — remembering appearance on this device, and caching an in-app help Yes/No vote after you submit it. Lawful basis: consent. You can withdraw appearance storage by turning off Remember my appearance on this device in Settings → Appearance or by clearing site data in your browser.

Cookies and similar technologies

QueryTek Review does not use analytics, advertising, or third-party marketing trackers on the portal. First-party browser storage is limited to strictly necessary operations and optional preferences described in the QueryTek Review Cookie Notice, which aligns with our internal storage register and Record of Processing Activities (RoPA).

Third-party authentication (Keycloak) and security verification (Cloudflare Turnstile) may set their own strictly necessary technologies when you sign in or complete a challenge. Blocking them may prevent sign-in or registration.

When personal data is shared

Extanto may share personal data with service providers and other recipients when needed to operate QueryTek Review, including:

• Authentication and identity services, including Keycloak.
• Notification delivery services, including Courier for service emails.
• Storage and infrastructure providers, including the secure document storage backend selected for the platform, such as MinIO or Copyparty as deployed by Extanto, as well as database and hosting components used to run the service.
• Payment systems, including WooCommerce on extanto.com and the associated Visa payment gateway, for payment processing, receipts, tax handling, refunds, and related transaction administration. QueryTek Review itself does not store or process payment card data.
• Security services, including Cloudflare Turnstile for browser-based challenge and abuse prevention.
• Future repository integrations, such as Box and Google Workspace Drive, if those features are enabled in a later product phase.
• Advisers, auditors, insurers, and public authorities when reasonably necessary for legal compliance, security, dispute resolution, or protection of rights.

Extanto does not use third-party analytics or marketing cookies in QueryTek Review at launch, so there is no analytics-based advertising data sharing to disclose.

International transfers

Extanto is based in Oregon in the United States. The QueryTek Review portal at review.querytek.io is hosted in the United States (Upsun). Personal data collected through the portal — including account data, workspace content, logs, and browser storage described above — may be processed in the United States and other countries where Extanto or its service providers operate.

Key subprocessors involved in delivering the public portal and authenticated service include Upsun (application hosting), Cloudflare (Turnstile and edge security), and the operator of the Keycloak identity service used for sign-in. Notification and payment flows may involve additional US-based providers described in the sharing section above.

If UK, EU, or Swiss data protection law applies to a transfer, Extanto uses appropriate safeguards required by law, such as Standard Contractual Clauses and, where applicable, participation in recognized transfer frameworks. Executed transfer instruments and vendor certifications are maintained in Extanto's legal and customer diligence materials (Data Processing Agreement and customer security packet) and are available to enterprise customers on request — they are not published in this public policy.

How long data is kept

Extanto keeps personal data for as long as it is reasonably needed to provide the service, maintain security and audit records, support legal and contractual obligations, resolve disputes, and follow client instructions where Extanto acts on a client's behalf.

The product requirements call for defined retention periods and support for deletion requests, but they also show that the default retention schedule and deletion workflow are still being finalized. That means retention periods may vary depending on the type of data, the client relationship, legal requirements, backup cycles, and operational needs until a final schedule is adopted.

How data is protected

Extanto uses technical and organizational safeguards designed to protect personal data. The product requirements call for HTTPS/TLS, encryption at rest for stored documents, authenticated API access, tenant isolation, secure cookie settings, CSRF protection, secret management, dependency scanning, backups, and audit logging.

No system can be perfectly secure. Users and client organizations are responsible for protecting their credentials, limiting account access to authorized users, and using the service in line with their agreements and internal policies.

Privacy rights

Depending on where a person is located and the role Extanto plays in the relevant processing, that person may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where consent applies. The product requirements also specifically contemplate support for deletion requests for client user accounts and associated documents.

If Extanto is processing data on behalf of a client organization, the best first step may be to contact that client organization, because it often decides how workspace data is used. Extanto will assist client organizations with privacy requests where required by law or contract.

Privacy requests may be sent to querytek-support@extanto.com. Extanto may ask for information needed to verify identity and authority before responding.

U.S. state privacy information

To the extent U.S. state privacy laws apply, Extanto does not sell personal data or share personal data for cross-context behavioral advertising through QueryTek Review as described in this Privacy Policy. Personal data is used to provide a business-facing service, manage accounts, secure the platform, process submissions, support communications, and administer transactions.

Because Extanto does not sell or share personal information for cross-context behavioral advertising through this service, there is no separate automated “opt out of sale” form on QueryTek Review. If you have questions about California or other U.S. state privacy choices, contact querytek-support@extanto.com. Authorized client organizations may also use in-product privacy and data-rights workflows where Extanto provides them for that tenant.

Children

QueryTek Review is intended for business users and is not directed to children.

Changes to this policy

Extanto may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or business practices. If material changes are made, Extanto may post the updated version through the service or provide another appropriate notice.

Contact