What we collect, why we collect it, and what you can ask us to do about it. Written to be read, not to be survived.
We do not sell your personal data, and we never have. We do not share it for advertising, and we do not rent, trade or broker it. There is no version of our business that depends on it.
We collect what we need to run AirQuery and to talk to you about it — your contact details, your account, how the product is used, and the questions you ask it. When your company uses AirQuery to analyse its own data, that data belongs to your company: we handle it on their instructions and nothing more.
We do not use your content or your questions to train foundation models. You can ask us what we hold, ask for it back, or ask us to delete it, at privacy@airquery.com.
That summary is written for clarity and is not a substitute for the detail below, which is what governs. Where the two appear to differ, the detailed sections apply.
AirQuery, an Orbit Analytics product (“AirQuery”, “we”, “us”), is a software company based in Alpharetta, Georgia, USA. This statement covers:
It covers data we decide the purposes for — where we are the controller. It does not cover the data your organisation puts into AirQuery to analyse. That is governed by our contract with them, and is explained in section 5.
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, work email, phone, employer, job title, country | You — a form, a demo request, a signup |
| Account | Username, authentication identifiers, role, workspace membership | You, or your organisation’s administrator |
| Billing | Subscription records, invoices, purchase history | You, your organisation, our payment processor |
| Usage | IP address, browser and device, pages viewed, features used, timestamps | Collected automatically — see section 10 |
| Support | Emails, tickets, logs and files you send us when something breaks | You |
| Events | Registrations, attendance, and any dietary or access needs you tell us | You |
| Marketing | What you subscribed to, what you opened, what you downloaded | You, and our email and analytics tools |
| Questions you ask AirQuery | The question, the context used to answer it, the reasoning trace and the answer | You, through the Services — see section 6 |
We do not ask for special category data — health, biometrics, race, religion, political opinions, sexual orientation — and the Services are not designed to collect it. Please do not send it to us.
Some of it is required: we cannot create an account without an email address, or invoice you without billing details. The rest is optional, and declining it will not lock you out.
We do not use your personal data to make automated decisions that have a legal or similarly significant effect on you.
The law there requires us to name a legal basis for each purpose. Ours are:
| Purpose | Legal basis |
|---|---|
| Providing the Services and billing for them | Performing our contract with you |
| Security, fraud prevention, product improvement | Our legitimate interests in running a secure, working service |
| Marketing email | Your consent, which you may withdraw at any time |
| Non-essential cookies | Your consent |
| Keeping records, responding to lawful requests | Complying with a legal obligation |
This is the part most people actually want to know, so it is worth being exact.
When your organisation uses AirQuery to analyse its data, your organisation decides what happens to that data and we do not. In the language of the law they are the controller and we are the processor. We act on their documented instructions, under our customer agreement and Data Processing Addendum. We do not mine that data, sell it, or use it to build features for anyone else.
The Data Gateway is built so that your warehouse and on-premises systems are queried using your credentials, inside your network boundary. Results return to your workspace to answer the question you asked. We hold query metadata — what was asked, which model was used, how long it took — because we need it to operate, bill and debug the service.
If you are an employee of a customer and want your data corrected or removed from that workspace, ask your own organisation first: they control it, and they can act faster than we can. If they ask us for help, we will give it.
Our Data Processing Addendum is available from legal@airquery.com, and forms part of every customer contract where data protection law requires one.
AirQuery uses AI to read your question, work out how to answer it, generate a query, and explain its reasoning. Doing that means processing the question, the context selected to answer it, and the answer produced.
AI can be wrong. AirQuery shows the generated query and the reasoning behind every answer precisely so it can be checked rather than trusted blindly. Decisions taken on an answer remain yours.
We take the ordinary, unglamorous measures that actually matter:
No system is perfectly secure and anyone claiming otherwise is selling something. If a breach affects your personal data, we will tell you and the relevant regulator within the deadlines the law sets, and we will tell you what we know rather than the minimum we can get away with.
To report a vulnerability, write to security@airquery.com. We will not pursue legal action against researchers who act in good faith and give us reasonable time to fix things.
We keep personal data for as long as it is doing a job, then delete it. In practice:
| What | How long |
|---|---|
| Account data | While the account is active, then 90 days after closure |
| Billing and tax records | 7 years, because tax law requires it |
| Support tickets | 3 years from resolution |
| Marketing contacts | Until you unsubscribe, or 2 years of no engagement |
| Web and product analytics | 26 months |
| Security and access logs | 12 months |
| Questions, traces and answers | While the workspace retains them, subject to your organisation’s settings |
Where we must keep something to defend a legal claim, we keep it until the claim is resolved. Customer Data is kept and deleted according to your organisation’s contract with us, not this schedule.
Wherever you live, you can ask us to:
Some of these are legal rights in some places and simply our policy elsewhere. We do not think it is worth arguing about which is which, so we apply them to everyone.
Write to privacy@airquery.com. We will confirm who you are before we act — handing your data to someone impersonating you would be its own privacy failure — and we will respond within 30 days, or tell you why we need longer. It is free. You may use an authorised agent. We will not treat you worse for asking.
We operate from the United States and use suppliers in other countries, so personal data from the EEA, the UK or Switzerland is transferred internationally.
When that happens we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK is involved, plus the technical measures described in section 7. We assess whether those safeguards are sufficient for the destination country, and add further measures where they are not.
AirQuery does not currently claim certification under the EU-U.S. Data Privacy Framework or its UK and Swiss extensions. We rely on the Standard Contractual Clauses instead. If that changes we will say so here rather than leaving you to check a register.
California, and a growing number of other states, give residents specific rights: to know what is collected, to have it deleted, to have it corrected, to obtain a copy, and to opt out of the sale or sharing of personal information or its use for targeted advertising.
We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months — or ever. There is therefore no “Do Not Sell or Share My Personal Information” link on this site, because there is nothing for it to switch off.
We do not collect sensitive personal information for the purposes that would require a “Limit the Use of My Sensitive Personal Information” link. We do not knowingly process the personal information of anyone under 16 for advertising.
What we collect, why, and who receives it are set out in section 2, section 3 and section 4. To exercise a right, use section 9. We will not discriminate against you for it.
AirQuery is a business tool. It is not for children, it is not marketed to them, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.
We link to sites we do not control. Once you leave, their rules apply, not ours.
Community forums, event chats and the like are public. Assume anyone can read what you write there, including people you did not have in mind.
We will update this statement as the product and the law change. The date at the top always reflects the current version.
If a change materially affects your rights, we will tell you before it takes effect — by email, or in the product — rather than quietly editing the page and relying on you to notice.
Tell us first. Write to privacy@airquery.com. We will acknowledge within 5 working days and give you a substantive answer within 30. Most things are a misunderstanding that a real reply resolves.
If we cannot resolve it, you can complain to your data protection authority. In the UK that is the Information Commissioner’s Office. In the EEA it is the authority for where you live, where you work, or where you think the problem happened. In the US, your state Attorney General. You do not have to come to us first — we would simply prefer the chance to fix it.
A person reads that first address. If your question is about your own data, say so in the subject line and it will be routed accordingly.