Privacy Policy

Quarry is responsible for the personal data described here (as a "data fiduciary" under India's Digital Personal Data Protection Act, 2023, and a "controller" where the GDPR applies). This policy covers visitors to quarrydata.ai, people who contact us or submit a request, referrers, and people who use a Quarry account.

This policy does not cover licensed datasets. The recordings, studies and reports Quarry licenses are de-identified inside the data owner's environment before they leave it. How that works, and the commitments that apply, are set out in the Trust center and the Data Processing Addendum.

Information you give us:

• contact details: name, work email, company or organisation, role, website;
• what you tell us about your needs or your data: data types, volumes, timelines, rights held, descriptions;
• for referrals: your details and the details of the owner you introduce;
• for document requests and change notices: your name, email, company and what you asked for.

Information collected automatically:

• the page and call-to-action that opened a form, campaign tags (UTM source, medium, campaign), the referring page and the time of submission;
• your IP address and browser details, used for security, rate limiting and bot checks, and in our hosting provider's logs;
• small items in your browser's session storage that keep your form answers if you refresh, and remember a dismissed banner. See the Cookie Policy.

• to reply to you and run the conversation you started (for example, scoping a data request or reviewing a listing);
• to match lab demand with data owners, including telling you about requests or listings relevant to what you told us;
• to operate, secure and improve the Services, including preventing spam and abuse;
• to meet legal obligations and enforce our agreements.

We rely on your consent where you give it (for example, the consent box on our forms), and otherwise on the legitimate uses the law allows, such as responding to a request you made or complying with the law. You can withdraw consent at any time; this does not affect what was done before.

We keep enquiry and lead records for up to 24 months after our last contact with you, unless a deal or account requires longer. Account data is kept while the account is open and for up to 12 months after. Security logs are kept for up to 12 months. Records we must keep by law (for example, tax records) are kept for the period the law requires.

We share personal data only as needed:

• with service providers who process it for us under contract, listed on the subprocessors page;
• between a lab and a data owner, only when both have agreed to take a conversation forward, and only the contact details needed for it;
• with professional advisers, and with authorities where the law requires it;
• with a buyer or successor if Quarry is involved in a merger or acquisition, under this policy.

We do not sell personal data, and we do not share it for third-party advertising.

Some of our service providers process data in the United States and elsewhere. We transfer personal data outside India only as Indian law permits, and use appropriate safeguards (such as standard contractual clauses) where the GDPR or similar laws apply.

We use encryption in transit, access controls based on least privilege, and audit logging, as described on the security page. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

Depending on where you are, you may have the right to:

• get a summary of the personal data we hold about you and how it is used;
• correct, complete or update it;
• have it erased where it is no longer needed or you withdraw consent;
• withdraw consent;
• nominate another person to exercise your rights if you die or become unable to (India);
• object to or restrict processing, and receive a copy in a portable format (where the GDPR applies);
• raise a grievance, and then complain to a regulator.

Email privacy requests to legal@quarrydata.ai. We may ask you to confirm your identity. We respond within the time the applicable law requires.

If you are unhappy with how we handled your personal data, contact our Grievance Officer at grievance@quarrydata.ai. The process and timelines are on the Grievance officer page. If you are in India and not satisfied with our response, you may complain to the Data Protection Board of India.

The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

We will post updates here and, for material changes, email account holders at least 30 days before they take effect. Earlier versions stay available from the versions link on this page.

Quarry, legal@quarrydata.ai. Grievance Officer: grievance@quarrydata.ai.