nQuest Privacy Policy

Effective Date: October 4th, 2024
‍
nQuest Corporation ("nQuest" or "we," "us," or "our") respects your privacy. This Privacy Policy ("Policy") describes how we collect, use, protect, and disclose your Personal Information when you access or use our website, products, and services or when you otherwise communicate with us. For purposes of this Policy, we refer to our website, products, and services together as the "Platform."

Some of our products and services allow our customers to store Personal Information on the Platform. This Policy does not apply to the Personal Information we collect, store, or otherwise process on behalf of our customers.

We may modify this Policy at any time. We will notify you of material changes by conspicuously posting changes along with an alert on the Platform, sending you an email, or otherwise notifying you by similar and appropriate methods. All changes will be effective immediately upon posting to the Platform.

Please read this Policy carefully.

What is personal information?

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with you. Personal Information does not include information that is available in public records or has been deidentified, aggregated, or both to the extent that it is no longer identifiable.

Personal information we collect

We may collect the following categories of Personal Information:

Personal Identifiers: Contact and identifying information, such as your name, account name, username, email address, phone number, mailing address, billing address, and IP address.
Financial Information: Bank account number, credit card numbers. (This may be collected through our third party providers Stripe and Mercury. We do not retain credit card numbers used for purchases.)
Internet or Other Electronic Network Activity Information: Internet or other electronic network activity information, including, but not limited to, device ID, browser type, operating system, and CPU, and information regarding your interaction with the Platform.
Geolocation Data: Imprecise location information, like the city, state, and ZIP code associated with your IP address.
Employment Data: We may collect additional information from your LinkedIn profile, such as your current job title.

How we collect information

Directly from You: We collect your Personal Information directly from you when you access or use the Platform or otherwise interact with us, such as engaging with customer support.
From You Automatically: We may collect certain information about you automatically when you use the Platform, such as your IP address, mobile carrier, and other device identifiers that are automatically assigned to your computer or device when you access the Internet. For more information, see the "Cookies and Analytics" section below.
From Third Parties: We and our service providers acting on our behalf may collect Personal Information about you from third parties in several ways, including, without limitation:

We may receive Personal Information about you from third parties that provide services to us through or in connection with the performance or operation of the Platform, including our web hosting providers.

We may receive your Personal Information from your university or employer.

Please note, we may combine the Personal Information and other information we receive about you from multiple sources, including, without limitation, Personal Information we collect directly from you and one or more third party sources.

How we use your personal information

We use your Personal Information for our business purposes, including to:

Operate the Platform: We may receive Personal Information about you from third parties that provide services to us through or in connection with the performance or operation of the Platform, including our web hosting providers.
Improve, develop, and analyze the Platform: We may use your Personal Information to conduct statistical analysis and customize your experience with the Platform.
Communicate with you about the Platform: We may use your Personal Information to follow up with you, complete customer service requests, or otherwise communicate with you regarding the Platform.
Comply with legal and regulatory requirements and protect the safety and security of our business: We may use your Personal Information to comply with laws, regulations, or other legal obligations, to assist in an investigation, to protect and defend our rights and property or the rights of third parties, or to enforce our terms and conditions. We may also use Personal Information to prevent suspected fraud, threats to our Platform or network, or other illegal or harmful activities.
Facilitate other business purposes as permitted under applicable law.

Disclosing your personal information

We may share Personal Information for various business purposes consistent with the uses described in this Policy, with third parties when you explicitly direct or consent to such sharing, or as required or permitted by law, including with:

Service Providers: We may share your Personal Information with service providers to help us host and manage the Platform, improve the content and functionality of the Platform, perform data analysis and statistical analysis, troubleshoot problems with the Platform, and improve the Platform's security. We use Stripe and Mercury as our third-party payment processors.

For more information on Stripe's privacy practices, see Stripe's Privacy Policy (stripe.com).

For more information on Mercury's privacy practices, see Mercury's Privacy Policy (mercury.com).
Parties to Business Transactions: In the event of an anticipated or actual merger or acquisition, bankruptcy, or other sale of all or a portion of our assets, we may transfer or allow third parties to use information owned or controlled by us, including Personal Information. We reserve the right, in connection with these types of transactions, to transfer, share, assign, or sell your Personal Information and other information we have collected to third parties or to authorize such third parties to use any Personal Information including for due diligence as part of any of the transactions described in this paragraph. Any Personal Information that is collected after this type of transfer may be subject to a new privacy policy adopted by the successor entity.
Government and Law Enforcement: We may share your Personal Information with third parties as required by law or subpoena, or if we reasonably believe such action is necessary to comply with the law and/or the reasonable requests of regulators, law enforcement, or other public authorities, to protect our property, legal rights, safety, or the safety of others, to prevent harm, investigate fraud, or to protect the security or integrity of the Platform or any equipment used to make the Platform available.
Professional Advisors: We may share your Personal Information with our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to nQuest.

Tools we use and your choices

Cookies and Analytics: We use cookies and collect data on your usage of the Platform to learn whether the Platform is operating optimally. We do not collect Personal Information through cookies and analytics, and we do not use marketing or third-party cookies. We collect data on your interactions with the Platform to provide audit logs, identify and correct errors and other diagnostic purposes, and to collect statistical traffic data to improve the Platform.
Your Choices: You may update or correct certain Personal Information you have provided us by editing your account information on the Platform or by contacting us at support@nquest.io.

The Options/Settings section of most internet browsers will tell you how to manage cookies and other technologies that may be uploaded to your device, including how to disable such technologies. You can disable our cookies, or all cookies, through your browser settings, but please note, disabling cookies may impact some of the features of the Platform and prevent it from operating as intended. You can learn more about cookies, including how to see what cookies have been uploaded to your device and how to manage and delete them, by visiting https://allaboutcookies.org/.
Security of Information: Protecting your Personal Information is important to us. We use commercially reasonable administrative, technical, and physical safeguards to maintain the security and privacy of your Personal Information.
Third Party Links: The Platform may contain links to third-party websites. Such sites may collect your Personal Information, use their own tracking technologies, and have privacy practices that differ from our own. nQuest is not responsible for the privacy practices of the companies to whom such websites pertain, and this Policy does not apply to any third-party websites or to any Personal Information that you may provide to third parties. We encourage you to review the privacy policies and terms of use of any third-party sites you visit.
Children's Privacy: We do not market our services or direct or target any piece of the Platform to children under the age of 18, or knowingly collect any Personal Information from children under the age of 18.

Contact Us

We welcome your questions, comments, and concerns regarding how we collect, use, protect, and share your Personal Information. Please email us at support@nquest.io with any questions or feedback you have pertaining to our privacy practices.

nQuest Vulnerability Disclosure Policy

Effective Date: October 4th, 2024

Introduction

nQuest welcomes feedback from security researchers and the general public to help improve our security. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security issues in any of our assets, we want to hear from you. This policy outlines steps for reporting vulnerabilities to us, what we expect, what you can expect from us.

Systems in Scope

This policy applies to any digital assets owned, operated, or maintained by nQuest.

Out of Scope

Assets or other equipment not owned by parties participating in this policy.

Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.

Our Commitments

When working with us, according to this policy, you can expect us to:

Respond to your report promptly, and work with you to understand and validate your report;
Strive to keep you informed about the progress of a vulnerability as it is processed;
Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
Extend Safe Harbor for your vulnerability research that is related to this policy.

Our Expectations

In participating in our vulnerability disclosure program in good faith, we ask that you:

Play by the rules, including following this policy and any other relevant agreements. If there is any inconsistency between this policy and any other applicable terms, the terms of this policy will prevail;
Report any vulnerability you've discovered promptly;
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
Use only the Official Channels to discuss vulnerability information with us;
Provide us a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information;
You should only interact with test accounts you own or with explicit permission from the account holder; and
Do not engage in extortion.

Official Channels

Please report security issues via support@nquest.io, providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue.

Safe Harbor

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
Exempt from restrictions in our Terms of Use (ToU) and/or License Agreement (LA) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.