Privacy Policy | netQuery.ai

This Privacy Policy explains how netQuery AI, Inc. (netQuery, we, us, or our) collects, uses, discloses, and retains personal information in connection with netquery.ai, the customer portal, the netQuery.ai desktop application, the netQuery.ai Connect browser extension, licensing and support services, and related features (collectively, the Services).

netQuery AI, Inc. is the business or controller responsible for the account, billing, licensing, website, support, and diagnostic information described here. Customers remain responsible for the NetSuite, repository, prompt, attachment, query, export, and other business content they choose to process through their accounts and selected third-party providers.

1. Scope and important distinction

The desktop product is local-first for NetSuite analysis, but the overall Service is not entirely offline. Much of the customer's working data is stored on the customer's device or transmitted directly to Oracle NetSuite and a provider the customer selects. netQuery cloud services separately handle accounts, organizations, memberships, billing, licensing, device activation, team configuration, diagnostics, and support.

This Policy does not govern a third party's independent processing. Oracle NetSuite, Stripe, an AI provider, GitHub, Tavily, and other services selected by the customer have their own terms and privacy notices.

2. Information we collect

The information collected depends on the Services, plan, configuration, and features used.

2.1 Account, identity, and organization information

We may collect:

email address, display name, authentication and session information;
password-verifier and authentication data handled by our authentication provider, multi-factor authentication state, and recovery-code hashes;
agreement version and acceptance timestamp fields where the product records them;
organization name, legal and contact information, roles, memberships, invitations, and administrator actions; and
communications preferences and selected portal settings.

Do not send us a plaintext password or recovery code through support.

2.2 Billing and transaction information

We and Stripe may process billing name, address, country, phone number, tax identifier, payment-method details, Stripe customer and subscription identifiers, checkout attempts, invoices, prices, subscription state, payment events, and related transaction records. Stripe receives and processes full payment-card details; netQuery generally receives identifiers, status, and transaction information rather than the full card number.

Our systems retain Stripe webhook event payloads and identifiers needed to provision entitlements, reconcile billing state, prevent duplicate processing, and investigate payment or provisioning incidents.

2.3 Licensing, device, security, and diagnostics information

We may collect or generate:

organization, member, plan, license, seat reservation, and bound-device records;
a one-way hashed machine fingerprint, hostname, platform, application version, signed license token, license status, and last-seen or heartbeat timestamps;
IP address read for security and rate limiting, and HMAC-hashed email or IP identifiers used for rate-limit enforcement;
browser, device, request, page, performance, and error information;
security, administrative, license, and audit events and associated metadata; and
diagnostic details supplied in a support or security report.

The launch configuration keeps ordinary error diagnostics but does not enable Sentry session replay. We ask customers not to include secrets or unnecessary customer data in support materials. Error or log context may nonetheless contain user or system information depending on the failing operation.

2.4 Demo, support, and communications information

When someone requests a demo or contacts us, we may collect name, work email, company, message, correspondence, attachments, troubleshooting details, and the history and outcome of the request. We also process delivery information for authentication, lifecycle, billing, and support email.

2.5 Organization-managed integration configuration

Organization administrators may store AI-provider configuration and credentials for authorized team use. Those credentials are encrypted in the portal's managed secret store. We maintain related provider, status, ownership, audit, and lifecycle metadata. Removing a credential deletes the managed secret where implemented, but related non-secret audit or lifecycle metadata may remain.

2.6 Information stored on the desktop device

Depending on the features used, the desktop application may store locally:

a persistent embedded NetSuite browser partition and cookies until sign-out or manual clearing;
encrypted license and installation tokens, personal AI-provider and Tavily credentials, GitHub tokens, and team-key cache;
schema caches, chats, prompts, attachments, memory, saved queries, widgets, schedules, agent history, exports, logs, and managed Git workspaces; and
application preferences and customer-profile cache.

Sensitive values use Electron safeStorage where implemented, relying on operating-system-backed encryption. Local data remains under the security of the device and operating-system account. Uninstalling the desktop application may leave application data in place.

2.7 Information sent to selected third parties

NetSuite queries and results flow between the desktop application and the customer's Oracle NetSuite account. When a customer requests AI assistance, prompts, chat history, selected attachments, schemas, query results, tool outputs, code, repository context, and other instructions may be sent directly to the AI provider or compatible endpoint configured by the customer. Supported configurations are defined by the product's current provider catalog and may include hosted providers and customer-configured compatible or self-hosted endpoints.

Optional GitHub and Tavily features send information needed to perform the user-requested repository or search operation to those services. Some product interfaces request Google Fonts. netQuery does not become the model-inference provider merely by operating the portal and licensing services.

3. How we collect information

We collect information:

directly from users, organization administrators, demo requesters, and support correspondents;
automatically from the website, portal, desktop application, extension, licensing service, authentication system, and security controls;
from Stripe and other providers when they report a transaction, delivery, authentication, or service event; and
from the customer's organization or an invited administrator.

4. How and why we use information

We use information to:

create and secure accounts and organizations;
authenticate users, support MFA, and prevent unauthorized access;
process orders, subscriptions, taxes, invoices, and customer-requested billing changes;
issue and validate licenses, enforce plan/member/device limits, and deliver authorized organization configuration;
provide requested software, portal, support, email, AI, repository, search, and integration functions;
operate, maintain, debug, monitor, and improve reliability and usability;
detect abuse, fraud, security incidents, duplicate processing, and payment or provisioning failures;
communicate about authentication, transactions, service changes, updates, support, and security;
keep financial, audit, and compliance records; and
establish, exercise, or defend legal claims and comply with law.

Where applicable, our legal bases include performance of a contract or steps at the user's request before a contract; our legitimate interests in operating, securing, supporting, and improving the Services; compliance with legal obligations; and consent where law requires it. A person may withdraw consent for future processing where consent is the basis, without affecting earlier lawful processing.

We do not sell personal information, use it for cross-context behavioral advertising, or use Customer Content to train a netQuery foundation model. Customer-selected AI providers process submitted content under their own terms and settings, which may differ.

5. How we disclose information

We disclose information only as reasonably needed for the purposes above:

Service providers. These may include Supabase for authentication, database, Edge Functions, and managed secrets; Stripe for checkout, subscriptions, tax, invoices, and payments; Vercel for website hosting and analytics; Better Stack through Sentry-compatible tooling for diagnostics; Resend for transactional email; Google Cloud KMS for license signing; Google Workspace for business email; GitHub for public release distribution; and infrastructure or alert endpoints configured for operations.
Customer-selected services. Oracle NetSuite, AI providers, GitHub, Tavily, and other integrations receive information when the customer configures or invokes them.
Organization administrators. Owners and authorized administrators may see member, role, invitation, license, device, billing, audit, and configuration information for their organization.
Legal and safety recipients. We may disclose information when reasonably necessary to comply with law or legal process, protect rights and safety, investigate fraud or security issues, or enforce agreements.
Corporate transactions. Information may be transferred as part of a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and legal requirements.
With direction or consent. We disclose information when the customer directs us or a person gives valid consent.

The catalog reflects provider integrations evidenced in the current Services; availability may vary by product version, account configuration, region, and provider terms.

6. International processing

netQuery and its providers may process information in the United States, European Economic Area, and other countries where they or their infrastructure operate. Those countries may have different privacy laws. Where required, we use an approved transfer mechanism or rely on another lawful basis for the transfer. Customers should review the region and transfer terms of providers they select independently.

7. Retention and deletion

We retain information for as long as reasonably needed to provide and secure the Services, maintain an account or subscription, meet contractual and legal obligations, preserve financial and audit records, resolve disputes, enforce agreements, and maintain backup integrity. The period varies by data type, provider, account state, and applicable law.

There is no single automatic purge period for every cloud record. Some records are soft-deleted or remain in backups and logs for a limited operational period. Stripe and other independent providers retain information under their own policies and legal obligations. When an organization-managed secret is removed, the secret is deleted where implemented while related audit or lifecycle metadata may be retained.

Account deletion is currently requested through support@netquery.ai. We will delete or de-identify information when required and reasonably feasible, subject to legal, security, billing, backup, and dispute-retention needs.

Desktop data is managed on the customer's device. Available per-account purge and NetSuite sign-out controls remove certain stores and browser-session data, but may not remove every export, log, workspace, backup, or other file. Uninstalling alone may retain application data. The customer is responsible for backups and secure deletion of local copies under its policies.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, authentication, encryption in transit, managed encryption or secret storage for selected sensitive values, signed license tokens, rate limits, audit events, and monitoring. Local secret protection depends partly on the security of the customer's device and operating-system account.

No safeguard can guarantee absolute security. Customers should use MFA where available, apply updates, use least-privilege NetSuite roles, protect recovery codes and credentials, and report suspected compromise to support@netquery.ai.

9. Cookies, browser storage, and analytics

The website and portal use browser storage and cookies needed for authentication, security, selected-organization state, checkout continuity, language, preferences, and interface state. For example, authentication sessions persist in browser local storage and sidebar state may use a limited-duration cookie.

Vercel Analytics provides aggregate site-usage and performance information. Better Stack/Sentry-compatible diagnostics provide error and performance information. The launch configuration keeps error diagnostics but disables session replay. Browser settings may block or clear storage, but doing so can break authentication or other requested features.

We do not use the Services for third-party cross-context behavioral advertising. If a future non-essential technology requires consent under applicable law, we will provide the required choice before enabling it for that user.

10. Privacy rights and choices

Depending on location and applicable law, a person may have rights to:

request access to or a copy of personal information;
correct inaccurate information;
request deletion;
restrict or object to certain processing;
receive portable information in an applicable format;
withdraw consent for future processing where consent is the basis;
opt out of certain sale, sharing, targeted advertising, or profiling practices if they occur and the law applies; and
complain to a privacy or data-protection authority.

Submit a request to support@netquery.ai. We may need to verify identity and authority before acting. An authorized agent may submit a request where law permits, subject to verification. We will respond within the period required by applicable law and will explain if an exception applies. We will not unlawfully discriminate against a person for exercising a privacy right.

An organization administrator may be the appropriate first contact for information controlled through that organization's NetSuite, provider, or team account. Requests about information processed independently by Oracle, Stripe, an AI provider, GitHub, Tavily, or another third party should also be directed to that provider.

11. Children

The Services are business products for adults and are not directed to children or anyone under 18. We do not knowingly collect personal information from a child through a child-directed service. Contact us if you believe a child has provided personal information contrary to this section.

12. Changes to this Policy

We may update this Policy to reflect changes in the Services, law, or our practices. We will post the new version and effective date. Where required, we will provide additional notice of a material change through the Services or by email. Earlier versions may be retained for reference.

13. Contact

For privacy questions, requests, or complaints:

netQuery AI, Inc.
2810 North Church Street, STE 88326
Wilmington, Delaware 19802
United States
Email: support@netquery.ai

Individuals in the European Economic Area or United Kingdom may also complain to the data-protection authority in their place of residence, work, or the location of an alleged infringement.