5. Retention, security and international transfers

Retention. We keep account and Customer Content for as long as the customer's subscription is active. After termination, customers may export their data for 30 days; we then delete it from production systems within 90 days, and from backups as they expire on their normal cycle of 35 days. Where customers must meet record-keeping rules such as ISO/IEC 17025 or FDA 21 CFR Part 11, they are responsible for exporting records they need to keep. We keep billing records as tax law requires and marketing data until you opt out or it is no longer needed.

Security. We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access control, multi-factor authentication options, audit trails and regular backups. See our Security page for details. No system is perfectly secure; we will notify affected customers of a personal data breach without undue delay and as required by law.

International transfers. Metquay is based in the United States and serves labs worldwide. Data may be processed in the United States and in the regions where our hosting provider and subprocessors operate. For transfers from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful mechanism and the EU-U.S. Data Privacy Framework. Customers may choose a hosting region, e.g. US, EU or Asia-Pacific.

6. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information; to object to or restrict certain processing; to withdraw consent; and to opt out of marketing. You will not be treated differently for exercising these rights.

• EEA, UK and Switzerland (GDPR / UK GDPR): you may also lodge a complaint with your local data protection authority.

• California (CCPA/CPRA) and other U.S. states: you may request to know, delete and correct personal information, and to limit use of sensitive information. We do not sell or "share" personal information for cross-context behavioral advertising. You may use an authorized agent.

• Singapore (PDPA) and other Asia-Pacific laws: you may request access to and correction of your personal data and withdraw consent.

To make a request, email consulting@metquay.com. We will verify your identity and respond within the time the law requires (generally 30–45 days). If your data is Customer Content held for an organization that uses metquay.ai, we will refer your request to that organization.

7. Children

The Services are for businesses and are not directed to children under 16. We do not knowingly collect their personal information.

8. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, notify customers by email or in the platform before they take effect.