Privacy Policy

1. Overview

NTQUANTEK ("we", "us", "our") operates the NTQuantek platform. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. We are committed to protecting your privacy and handling your data responsibly.

2. Data We Collect

Account data:

• Full name, email address, phone number, country
• Organization name
• Hashed password (never stored in plaintext)
• MFA one-time code (stored only as a hash, deleted on use and invalid after 10 minutes)

Usage data:

• Login timestamps and IP addresses
• Actions performed within the platform (audit log)

Customer data (data you upload):

• Security incidents, risks, compliance assessments, vendor records, policies
• This data is yours — we process it only to provide the Service

Prospect / enquiry data:

• Name, email address, company, and the content of the message you submit through our contact form
• Collected only when you choose to contact us; an account is not required
• Used solely to respond to your enquiry. Our lawful basis is legitimate interest in responding to a business enquiry

3. How We Use Your Data

• To provide and operate the Service
• To authenticate you and secure your account
• To send transactional emails (password reset, security alerts)
• To improve the platform and fix issues
• To comply with legal obligations

We do not sell your data. We do not use your data for advertising.

4. Data Storage and Security

Your data is stored in the United States (Hillsboro, Oregon) on Hetzner infrastructure and in Neon PostgreSQL (US East region).

Security measures include:

• AES-256-GCM encryption for sensitive fields at rest
• TLS encryption for all data in transit
• Mandatory multi-factor authentication for all users
• Role-based access control (admin / analyst / viewer)
• Org-scoped data isolation — users can only access their organization's data

5. Data Retention

We retain your account and usage data for as long as your account is active. Upon account termination, data is retained for 30 days before permanent deletion. Audit logs may be retained longer for compliance purposes.

Prospect / enquiry data submitted through our contact form is retained for 24 months from the date of each enquiry, after which that enquiry is automatically deleted by a scheduled purge job. Each enquiry is retained and deleted independently.

6. Third-Party Services

We use the following third-party services:

• Neon — PostgreSQL database hosting (US East)
• Hetzner — Server infrastructure (US West)
• Cloudflare — CDN and DDoS protection
• Resend — Transactional email delivery

Each provider has their own privacy policy and data processing agreements.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data, or — if you have contacted us without registering — of the enquiry data we hold about you
• Data portability — export your data in a machine-readable format
• Object to certain processing activities

To exercise these rights, contact us at [email protected].

8. Cookies

We use a single HTTP-only session cookie for authentication. We do not use tracking cookies or third-party analytics cookies.

9. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If you hold an account, we will notify you of material changes by email or prominent notice within the Service. If you have only contacted us through our contact form, we have no in-Service channel to reach you, so please check this page — the effective date at the top reflects the latest revision, and material changes are noted beneath it.

11. Contact

For privacy-related questions or requests, contact us at [email protected].