Privacy Policy

1. Data Controller

Quantify Intelligence ("we", "us", "our") is the data controller responsible for your personal data. Quantify Intelligence is operated by its founder as a UK-based business.

Contact: support@quantifytrades.com

For data protection matters, you may contact us at the same address and include "Data Protection" in the subject line.

2. Personal Data We Collect

2.1 Account Data

• Email address (required for account creation and login)
• Password (stored as a cryptographic hash — we never store plaintext passwords)
• Account creation date and last login timestamp

2.2 Platform Usage Data

• Tickers and securities you analyse
• Analysis results stored in your account
• Watchlist entries and portfolio positions you log
• Agent configuration (webhook URL, portfolio value, risk settings — not your brokerage credentials)
• Settings and preferences

2.3 Billing Data

• Subscription plan and billing history
• Payment method type and last four digits (stored by our payment processor — we do not store full card details)
• Billing country

2.4 Technical Data

• IP address
• Browser type and version
• Operating system
• Device type
• Pages visited, time on page, and navigation patterns (analytics)
• Error logs

2.5 Communications Data

• Emails and support messages you send us
• Responses to optional surveys

2.6 What We Do NOT Collect

We do not collect brokerage account credentials, trading positions outside the Platform, your brokerage transaction history, national insurance or social security numbers, or government-issued identification documents.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• Service delivery: To operate your account, deliver analysis, run the Agent feature, and provide the Platform functionality;
• Authentication: To verify your identity when you log in;
• Billing: To process subscription payments and manage your billing relationship;
• Communication: To send you service-related notifications (password resets, billing receipts, important service updates);
• Support: To respond to your support enquiries;
• Service improvement: To analyse usage patterns and improve the Platform (using aggregated, anonymised data where possible);
• Security: To detect and prevent fraud, abuse, and unauthorised access;
• Legal compliance: To comply with applicable law and respond to lawful requests from regulatory authorities.

We do not use your personal data for targeted advertising, and we do not sell your data to any third party.

4. Legal Basis for Processing (UK GDPR)

For users in the United Kingdom, we process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Service you have subscribed to, including account management, analysis delivery, and billing;
• Legitimate interests (Article 6(1)(f)): Processing for platform security, fraud prevention, and service improvement, where our interests are not overridden by your rights;
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including tax and anti-money-laundering obligations;
• Consent (Article 6(1)(a)): For any optional communications such as marketing emails, where we will ask for your explicit consent separately.

5. Data Sharing and Third Parties

5.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal data to third parties for their commercial purposes.

5.2 Service Providers

We share personal data with trusted third-party service providers who process data on our behalf under appropriate data processing agreements:

• Google Firebase / Google Cloud Platform: Authentication and database storage (servers in the EU or UK);
• Stripe: Payment processing (PCI-DSS compliant);
• Email service providers: For transactional email delivery.

All service providers are contractually bound to process your data only as instructed by us and to maintain appropriate security measures.

5.3 Legal Disclosure

We may disclose your personal data where required by law, court order, or lawful request from a regulatory authority (such as the FCA, ICO, or SEC). We will notify you of such requests where legally permitted to do so.

5.4 Business Transfer

If Quantify Intelligence is acquired, merged, or undergoes a significant business transfer, your personal data may be transferred to the acquiring entity. We will notify you before any such transfer and provide you with an opportunity to delete your account if you object.

6. Data Retention

We retain your personal data for as long as your account is active. After account closure:

• Account data (email, preferences, analysis history): deleted within 90 days of account closure, or upon your request;
• Billing records: retained for 7 years as required by UK tax law (HMRC);
• Security logs: retained for up to 12 months;
• Anonymised, aggregated usage data: may be retained indefinitely as it no longer constitutes personal data.

7. Data Security

We implement industry-standard technical and organisational security measures, including:

• TLS/SSL encryption for all data in transit;
• Encryption at rest for database storage;
• Firebase Authentication with bcrypt-hashed passwords;
• Access controls limiting staff access to personal data on a need-to-know basis;
• Regular security reviews.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, and we encourage you to use a strong, unique password and enable two-factor authentication where available.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours where required by law, and will notify affected users without undue delay.

8. International Data Transfers

Your data is primarily stored on servers located in the European Economic Area (EEA) or the United Kingdom. Where we transfer data to countries outside the UK/EEA (for example, to US-based service providers), we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the ICO;
• Adequacy decisions issued by the UK government; or
• The recipient's participation in a recognised data transfer framework.

9. Your Rights Under UK GDPR

If you are based in the United Kingdom, you have the following rights in relation to your personal data:

• Right of access: To request a copy of the personal data we hold about you;
• Right to rectification: To request correction of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten"): To request deletion of your personal data, subject to legal retention obligations;
• Right to restriction: To request that we restrict processing of your data in certain circumstances;
• Right to data portability: To receive your personal data in a structured, commonly used, machine-readable format;
• Right to object: To object to processing based on legitimate interests;
• Rights related to automated decision-making: To request human review of any fully automated decisions that significantly affect you.

To exercise any of these rights, contact us at support@quantifytrades.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Your Rights Under US Law (CCPA and State Laws)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to know: To know what categories of personal information we collect and how we use it;
• Right to delete: To request deletion of your personal information;
• Right to correct: To request correction of inaccurate personal information;
• Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioural advertising;
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at support@quantifytrades.com with subject line "Privacy Request — California". We will respond within 45 days as required by the CCPA.

Users in other US states with applicable privacy laws (including Virginia, Colorado, Connecticut, and others) may have similar rights. Please contact us to discuss your specific rights.

11. Cookie Policy

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit our website. We use them to ensure the website functions correctly and to understand how users interact with our platform.

11.2 Cookies We Use

• Strictly necessary cookies: Required for authentication (Firebase session tokens) and basic platform functionality. These cannot be disabled without breaking the Service;
• Analytics cookies: We may use privacy-preserving analytics (such as aggregated page view data) to understand usage patterns. We do not use Google Analytics or other third-party advertising trackers;
• Preference cookies: To remember your settings and preferences.

11.3 Managing Cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in to the Platform. For more information on managing cookies, visit allaboutcookies.org.

12. Children's Privacy

Our Platform is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 18, please contact us immediately and we will delete the data.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically.

14. Contact and Data Protection Queries

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern:

Quantify Intelligence
Data Protection Queries:
Email: support@quantifytrades.com
Subject line: "Privacy / Data Protection"

We aim to respond to all data protection queries within 5 business days and to all formal rights requests within one calendar month (UK GDPR) or 45 days (CCPA).

If you are dissatisfied with our response to a data protection concern, you have the right to lodge a complaint with:

• UK users: Information Commissioner's Office (ICO) — ico.org.uk/concerns
• California users: California Privacy Protection Agency (CPPA) — cppa.ca.gov