Privacy Policy

1. Executive Overview & Research Confidentiality

Inquestra ("we", "our", or "us") respects the confidentiality of your scientific research, intellectual property, and personal information. This Privacy Policy describes our practices regarding the collection, handling, and safeguarding of data when you use our Electronic Research Notebook (ERN) and Data Acquisition (DAQ) systems.

2. Zero Third-Party Session Replay or Surveillance

3. Self-Hosted Infrastructure & Font Privacy

To protect visitor privacy and satisfy stringent European and German data privacy standards (including the 2022 Munich Regional Court ruling on dynamic IP transmission), Inquestra self-hosts its typography directly from our static application delivery infrastructure. When you browse Inquestra, your IP address is not transmitted to third-party CDN font endpoints at runtime.

4. Information We Collect

• Account Credentials & Profiles: When you register, we collect your name, institutional work email address, lab type, hashed passwords, and WebAuthn/FIDO2 passkey credentials.
• Laboratory Data & Telemetry: Experimental notebooks, TipTap documents, FAIR metadata tags, sensor sample streams (e.g., ESP32/Arduino data via Web Serial), inventory lots, and equipment calibration dates.
• Audit Trail & Signature Logs: Under FDA 21 CFR Part 11 requirements, we record timestamped events (user ID, action type, IP address, and cryptographic signatures) to maintain immutable data provenance.

5. Children's Online Privacy Protection Act (COPPA)

Inquestra is exclusively designed and marketed for adult scientists, researchers, and engineers. Our services are strictly prohibited to individuals under eighteen (18) years of age. We do not knowingly collect, solicit, or maintain personal information from children under the age of 13 or minors under 18.

If we become aware that an account has been established by an individual under the age of 18, we will immediately take steps to terminate the account and purge any associated personal data from our operational databases.

6. CAN-SPAM & Email Communications

In accordance with the CAN-SPAM Act:

• We only send transactional emails necessary for platform operation (email confirmation, password resets, lab clearance invitations, and critical security notices).
• Any optional product announcements or research digests include an unambiguous, functioning unsubscribe link.
• Every outbound communication clearly identifies Inquestra and provides our valid contact channels.

7. Data Security & Encryption Standards

All communication between your browser and our servers is secured using modern Transport Layer Security (TLS 1.3). Stored databases and uploaded telemetry binary archives are encrypted at rest using AES-256. Experimental trials sealed under our Part 11 module are cryptographically bound using deterministic SHA-256 checksums to ensure tamper-evident integrity.

8. Your Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you may have rights to access, inspect, download, or request deletion of your personal information. Please note that certain audit log entries and cryptographically sealed research records must be retained pursuant to institutional compliance, NIH FAIR data directives, and FDA GLP regulatory record retention mandates.

To exercise your data privacy rights, email [email protected] or visit our Contact Page.

9. Privacy Inquiries & Data Protection Office