QueryTek Review Privacy Policy

QueryTek Review is a business service that lets authorized users upload documents, track review status, and receive reviewed outputs through a secure workspace. This Privacy Policy explains what personal data Extanto Technology, LLC collects through QueryTek Review, how that data is used, when it is shared, and what rights users and client organizations may have.

QueryTek Review is part of the QueryTek™ product suite. The QueryTek™ names, including QueryTek™, QueryTek Review™, QueryTek Tapestry™, and QueryTek Assessments™, are trademarks owned by Extanto Technology, LLC. Extanto Technology, LLC is located at 1920 Glenmorrie Drive, Lake Oswego, Oregon 97034. Questions about this Privacy Policy may be sent to querytek-support@extanto.com.

Who this policy applies to

This Privacy Policy applies to personal data processed through QueryTek Review, including data connected to client organizations, their authorized users, and Extanto personnel who use the platform to operate the review workflow. QueryTek Review is intended for business users, not personal or household use.

In many cases, Extanto handles data in QueryTek Review on behalf of a client organization. That means the client organization decides why certain submission content is used in its workspace, and Extanto processes that data to provide the service. In other cases, Extanto uses personal data for its own business purposes, such as account administration, support, security, billing records, legal compliance, and service operations.

What personal data is collected

Depending on how QueryTek Review is used, Extanto may collect the following types of personal data:

• Account information: name, business email address, organization, role, login identifiers, and account status.
• Workspace and submission information: uploaded documents, document metadata, file names, document IDs, review module selections, status history, and download history.
• Review information: annotations, findings, flagged excerpts, reviewer comments, recommendations, scorecard data, and related review outputs.
• Operational and security records: user IDs, tenant IDs, timestamps, action logs, status changes, audit records, and system-generated security events.
• Payment-related metadata: quoted price, currency, word count, payment status, WooCommerce order ID, and payment timing data.
• Communications: support emails and service notifications such as submission confirmations, quote notices, payment acknowledgments, and completion notifications.
• Security verification data: browser and session information needed to authenticate users and protect the service from abuse.

Extanto aims to collect only the information needed to run the service, protect it, support users, and meet legal or contractual obligations.

How personal data is collected

Personal data may be collected directly from users and client organizations when accounts are created, users sign in, documents are uploaded, review work is performed, payment is initiated, or support requests are sent. Personal data may also be created automatically as part of normal platform operation, such as audit logs, status updates, system metrics, and payment confirmation events.

Why personal data is used

Extanto uses personal data to:

• Provide and operate QueryTek Review.
• Authenticate users and enforce role-based access controls.
• Keep client workspaces separated and secure.
• Receive, store, review, annotate, and return submitted documents and scorecards.
• Send service-related notices and updates.
• Generate quotes, direct users to payment, confirm payment status, and keep transaction records without handling payment card data directly inside QueryTek Review.
• Maintain logs, audit trails, backups, and security controls.
• Respond to support requests, prevent misuse, enforce agreements, and comply with legal obligations.

Legal bases for UK and EU users

If UK or EU privacy law applies, Extanto relies on one or more legal bases depending on the situation. These may include performing a contract, taking steps requested before entering into a contract, complying with legal obligations, pursuing legitimate interests in operating and securing the service, or consent where consent is required.

Because QueryTek Review is a secure business platform with authenticated access, many processing activities are necessary to provide the service requested by client organizations and their users.

Cookies and similar technologies

At launch, QueryTek Review uses only strictly necessary cookies or similar browser storage. These are used for two purposes only:

• Authentication and session management through Keycloak.
• Security and abuse prevention through Cloudflare Turnstile.

QueryTek Review does not use analytics cookies, advertising cookies, marketing cookies, support-widget cookies, or similar nonessential tracking technologies at launch.

Because these technologies are strictly necessary to run and secure the service, they generally do not require opt-in consent under many privacy frameworks. If a user blocks these technologies, some or all of the service may stop working. See also the QueryTek Review Cookie Notice.

When personal data is shared

Extanto may share personal data with service providers and other recipients when needed to operate QueryTek Review, including:

• Authentication and identity services, including Keycloak.
• Notification delivery services, including Courier for service emails.
• Storage and infrastructure providers, including the secure document storage backend selected for the platform, such as MinIO or Copyparty as deployed by Extanto, as well as database and hosting components used to run the service.
• Payment systems, including WooCommerce on extanto.com and the associated Visa payment gateway, for payment processing, receipts, tax handling, refunds, and related transaction administration. QueryTek Review itself does not store or process payment card data.
• Security services, including Cloudflare Turnstile for browser-based challenge and abuse prevention.
• Future repository integrations, such as Box and Google Workspace Drive, if those features are enabled in a later product phase.
• Advisers, auditors, insurers, and public authorities when reasonably necessary for legal compliance, security, dispute resolution, or protection of rights.

Extanto does not use third-party analytics or marketing cookies in QueryTek Review at launch, so there is no analytics-based advertising data sharing to disclose.

International transfers

Extanto is based in Oregon in the United States, and personal data may be processed in the United States or other places where Extanto or its service providers operate. If UK or EU data protection law applies to a transfer, Extanto will use appropriate safeguards required by law for that transfer.

How long data is kept

Extanto keeps personal data for as long as it is reasonably needed to provide the service, maintain security and audit records, support legal and contractual obligations, resolve disputes, and follow client instructions where Extanto acts on a client's behalf.

The product requirements call for defined retention periods and support for deletion requests, but they also show that the default retention schedule and deletion workflow are still being finalized. That means retention periods may vary depending on the type of data, the client relationship, legal requirements, backup cycles, and operational needs until a final schedule is adopted.

How data is protected

Extanto uses technical and organizational safeguards designed to protect personal data. The product requirements call for HTTPS/TLS, encryption at rest for stored documents, authenticated API access, tenant isolation, secure cookie settings, CSRF protection, secret management, dependency scanning, backups, and audit logging.

No system can be perfectly secure. Users and client organizations are responsible for protecting their credentials, limiting account access to authorized users, and using the service in line with their agreements and internal policies.

Privacy rights

Depending on where a person is located and the role Extanto plays in the relevant processing, that person may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where consent applies. The product requirements also specifically contemplate support for deletion requests for client user accounts and associated documents.

If Extanto is processing data on behalf of a client organization, the best first step may be to contact that client organization, because it often decides how workspace data is used. Extanto will assist client organizations with privacy requests where required by law or contract.

Privacy requests may be sent to querytek-support@extanto.com. Extanto may ask for information needed to verify identity and authority before responding.

U.S. state privacy information

To the extent U.S. state privacy laws apply, Extanto does not sell personal data or share personal data for cross-context behavioral advertising through QueryTek Review as described in this Privacy Policy. Personal data is used to provide a business-facing service, manage accounts, secure the platform, process submissions, support communications, and administer transactions.

Children

QueryTek Review is intended for business users and is not directed to children.

Changes to this policy

Extanto may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or business practices. If material changes are made, Extanto may post the updated version through the service or provide another appropriate notice.

Contact