CertaQ — Privacy Policy

Effective Date: May 21, 2026 — Version: 2.0

This Privacy Policy explains how CertaQ, LLC ("CertaQ") collects, uses, and shares personal information when you use the CertaQ mobile application and related services (the "Service"). The Service is intended for use by adult, professional water and wastewater operators in the United States.

1. Information We Collect

You provide:

• Account info: name, email, password, employer/utility, role, operator certification information (where you choose to provide it).
• Profile and preference data.
• Operator Content: logbook entries, readings, photos, signatures, comments, and AI prompts you submit.
• Billing info: handled by Apple App Store or Google Play — we receive transaction confirmations only, not your full payment details.
• Support communications.

Automatically:

• Device and app data: device type, OS version, app version, language, time zone, crash logs.
• Usage data: feature interactions, session length, error events.
• Approximate location (derived from IP) — not precise GPS unless you opt in.

Third-party providers: We use cloud hosting, analytics, error monitoring, and AI model providers (see Section 4).

2. How We Use Information

• Provide, secure, and maintain the Service.
• Process Subscriptions via Apple/Google IAP.
• Generate AI Output and improve AI features (see Section 5).
• Communicate about the Service, security, and updates.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.
• With your consent, send product communications you can opt out of.

We do not sell your personal information, and we do not share personal information for cross-context behavioral advertising.

3. Legal Bases (where applicable)

Where required by U.S. state privacy law, we rely on: performance of contract, our legitimate interests in operating and improving the Service, your consent (where requested), and compliance with legal obligations.

4. How We Share Information

We share information with:

• Service providers (cloud hosting, analytics, customer support, AI model providers) bound by contract to protect your data and use it only for our purposes. A current list of material sub-processors is available on request to certaq@outlook.com; we will use reasonable efforts to provide advance notice of material sub-processor changes.
• Apple and Google for IAP processing.
• Your employer/utility if you joined through a utility-managed program or signed up identifying a specific utility on whose behalf you are acting.
• Authorities when required by law, valid subpoena, court order, or to protect rights, safety, or the Service. Where the request relates to a Utility User's records (for example, EPA, state environmental, or local public-utility regulator subpoenas concerning operator logs), we will use reasonable efforts to notify the affected User in advance unless legally prohibited.
• Successors in a merger, acquisition, or asset sale, with notice.

5. AI Features and Model Training

When you use AI Expert features, your prompts and selected context may be sent to third-party AI model providers under contracts that restrict their use of the data to providing the response. Do not submit personal information of third parties, protected health information, confidential utility data, or sensitive regulated data into AI prompts beyond what is necessary.

No training on your content. We do not use identifiable Operator Content, AI prompts, or AI outputs to train our own or third-party generative AI models. Where prompts are sent to third-party model providers, our contracts prohibit those providers from using your inputs or outputs to train their models, and require deletion of inputs and outputs on a defined schedule.

We may retain prompts and outputs to operate the feature, debug issues, and conduct abuse/safety review, subject to safeguards. We may use aggregated and de-identified data (data that does not identify you, your facility, or any individual) to evaluate and improve our AI features. You can disable use of AI Expert features in app settings, subject to the impact this has on the Service.

6. Data Retention

We retain Operator Content for the term of your Account and, by default, for at least five (5) years after creation to support typical state and federal wastewater recordkeeping obligations (including the three-year minimum at 40 CFR § 122.41(j)(2) and the five-year sewage-sludge floor). You may request earlier deletion as described in Section 9, subject to records we are required to retain by law or to enforce our Terms. For ninety (90) days following termination of your Account, you may request an export of your Operator Content in an industry-standard format (such as CSV or JSON); thereafter we may permanently delete Operator Content, except as required by law. Backup and archival copies may persist for a limited period before being overwritten.

7. Security and Incident Notification

We use industry-standard administrative, technical, and physical safeguards, including encryption in transit and at rest, access controls, and logging. No system is perfectly secure, and we do not guarantee absolute security.

Incident notification. If we determine that a security incident has resulted in unauthorized access to, acquisition of, or disclosure of your Operator Content or personal information, we will notify affected Users without undue delay, and in any event consistent with applicable law and no later than seventy-two (72) hours after we confirm the incident is reportable. Notification will describe, to the extent then known, the nature of the incident, the categories of data affected, the steps we are taking to investigate and mitigate, and any steps you should take. This commitment is intended to support the incident-notification expectations applicable to vendors serving the U.S. water and wastewater critical-infrastructure sector.

Report suspected incidents to certaq@outlook.com.

8. Children

The Service is not directed to children under 18 and we do not knowingly collect data from anyone under 18. If you believe a minor has used the Service, contact certaq@outlook.com and we will delete the account and related data.

9. Your Choices & Rights

You may:

• Access, correct, or delete your Account data by emailing certaq@outlook.com or using in-app controls (including the in-app account deletion mechanic).
• Opt out of marketing communications.
• Manage Subscriptions in Apple App Store or Google Play.
• Revoke device permissions (notifications, camera, location) in OS settings.

California residents (CCPA/CPRA). You have the right to: (i) know what personal information we collect, use, and disclose; (ii) access and obtain a copy of that information; (iii) correct inaccurate information; (iv) delete personal information, subject to legal exceptions; (v) limit our use of "sensitive personal information"; (vi) opt out of sale or sharing for cross-context behavioral advertising (we do neither); (vii) opt out of certain automated decision-making or profiling, where applicable; and (viii) non-discrimination for exercising these rights. Submit requests to certaq@outlook.com or use in-app controls. You may designate an authorized agent to submit requests on your behalf. We verify requests using information already associated with your Account.

Other U.S. state privacy rights. Residents of the following states with comprehensive privacy statutes currently in effect or coming into force have rights similar to those described above — including access, correction, deletion, portability, and (in most states) the right to appeal an adverse decision: Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Indiana, Tennessee, Kentucky, Rhode Island, and Florida. Several states also provide rights to limit the use of sensitive personal information or opt out of profiling that produces legal or similarly significant effects. To exercise any state-law privacy right, email certaq@outlook.com. We will respond within the time required by applicable law and explain any reason we cannot fulfill a request. To appeal a denial, reply to our response or email certaq@outlook.com with "Privacy Appeal" in the subject line. [VERIFY current state list and effective dates with U.S. counsel before launch — comprehensive privacy laws continue to come into force.]

10. International Users

The Service is intended for U.S. users. If you access it from outside the U.S., your data will be processed in the U.S., which may have different protections than your home jurisdiction.

11. Changes

We may update this Policy. Material changes will be announced in-app or by email at least 30 days before they take effect.

12. Contact

Privacy questions: certaq@outlook.com — CertaQ, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713