Legal · Privacy Policy
What we collect, why we collect it, and how long we keep it — the full picture.
The data controller within the meaning of applicable data protection legislation is Quanthree, the operator of the Platform described in the Terms of Service. All enquiries concerning the processing of personal data may be directed to hello@quanthree.com.
This Privacy Policy forms an integral part of the Terms of Service and is to be read in conjunction with them. Terms not defined herein carry the meaning assigned to them in the Terms of Service.
This Policy applies to all personal data processed by Quanthree in connection with the User's access to and use of the Platform, including the creation of a user profile, the connection of a broker account, the execution of Sessions, and any communications addressed to Quanthree.
This Policy does not apply to data processed by the intermediary broker on its own platform and under its own terms. Quanthree is not responsible for the data practices of the intermediary broker.
When the User registers or authenticates, Quanthree may collect: an email address, a hashed credential, and a timestamp of the first and most recent authentication event. Quanthree does not collect government-issued identity documents or payment card data.
When the User connects a broker account, Quanthree stores a broker-issued API token and the account identifier assigned by the broker. Quanthree does not store or have access to the broker account password.
During the execution of a Session, Quanthree processes operational telemetry — including the sequence and outcome of contracts, notional amounts, phase transitions and timestamps — solely for the purpose of displaying a real-time and post-session narrative to the User. This telemetry constitutes a trade secret in its aggregated and calibrated form and is not shared with third parties.
Quanthree may also collect technical data automatically generated by the User's device and browser: IP address, user-agent string, session identifier, and, where enabled, browser-level performance diagnostics. This data is used exclusively for platform stability and fraud prevention.
The primary legal basis for processing the data described in Article 03 is the performance of a contract (Art. 6(1)(b) GDPR or equivalent provision in the applicable jurisdiction): without processing the email address, broker token and Session telemetry, Quanthree cannot provide the service.
Technical and diagnostic data is processed on the basis of Quanthree's legitimate interest (Art. 6(1)(f)) in maintaining the security, integrity and stability of the Platform. This interest is not overridden by the User's fundamental rights, given the minimal intrusiveness of the data and the absence of profiling.
Where Quanthree requires the User's consent for a specific processing activity (for example, the sending of product communications), that consent will be sought separately, will be freely given and withdrawable at any time, and will be documented.
Quanthree uses collected data for the following purposes: (a) authenticating the User and maintaining the security of their account; (b) connecting to the broker's execution channel via the User's API token; (c) generating and displaying Session narratives and outcome summaries; (d) detecting and preventing abuse, fraud and technical failures; and (e) complying with legal obligations where required.
Quanthree does not use personal data to train machine-learning models, build advertising profiles, or sell, licence or otherwise transfer data to data brokers or marketing platforms.
Session telemetry is used to improve the operational calibration of the Agent in aggregate and anonymised form only. Individual Session records are never attributed to a named User in any internal analysis accessible to Quanthree staff beyond what is strictly necessary for support purposes.
Quanthree shares data with third parties only to the extent strictly necessary to provide the service. The only category of third party that receives identifiable data is the intermediary broker, which receives the API requests generated by the Agent on behalf of the User. The User's identity as a Quanthree customer is not disclosed to the broker as part of these requests.
Quanthree may engage technical sub-processors — such as hosting infrastructure providers and monitoring services — that process data exclusively on Quanthree's instructions and are bound by data processing agreements consistent with applicable law.
Quanthree will not transfer personal data to any jurisdiction outside the European Economic Area unless an adequate level of protection is ensured by a European Commission adequacy decision or by standard contractual clauses approved by the competent supervisory authority.
The Platform uses strictly necessary cookies and browser local storage to maintain the User's authenticated session. These are not used for tracking, advertising or cross-site identification purposes and do not require consent under the applicable ePrivacy framework.
If Quanthree introduces any non-essential cookies or tracking technologies in the future, a cookie notice will be displayed and the User's freely given consent will be obtained before any such data is processed.
Authentication data (email address, hashed credential) is retained for as long as the User maintains an active account with Quanthree, and for a period of 90 days following account closure, after which it is deleted or irreversibly anonymised.
Broker API tokens are retained only for the duration of the active connection and are deleted immediately upon disconnection or upon the User's request.
Session telemetry is retained in identifiable form for 90 days following the Session date, solely for the purpose of resolving support requests. After that period it is aggregated and anonymised. Anonymised aggregate statistics may be retained indefinitely.
Technical and diagnostic logs are retained for a maximum of 30 days and then automatically purged.
Subject to applicable law, the User has the following rights in respect of their personal data: (a) the right of access — to obtain confirmation of whether their data is being processed and a copy thereof; (b) the right to rectification — to have inaccurate data corrected; (c) the right to erasure — to request deletion of their data where no overriding legal basis for retention exists; (d) the right to restriction — to limit processing in certain circumstances; (e) the right to data portability — to receive their data in a structured, machine-readable format; and (f) the right to object — to processing carried out on the basis of legitimate interest.
To exercise any of these rights, the User should submit a written request to hello@quanthree.com. Quanthree will respond within the timeframe prescribed by applicable law (generally 30 days) and will not charge a fee for reasonable requests.
The User also has the right to lodge a complaint with the competent data protection supervisory authority in the member state of their habitual residence or place of work.
Quanthree implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These measures include encrypted transmission (TLS), hashed credential storage, access controls limited to personnel with a need to know, and regular review of security practices.
No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of Users, Quanthree will notify the affected Users and the competent supervisory authority in accordance with applicable law.
Quanthree may update this Policy to reflect changes in the Platform, applicable law or its data processing practices. Material changes will be notified to registered Users by email or by a prominent notice on the Platform at least 14 days before they take effect. Continued use of the Platform after the effective date of a change constitutes acceptance of the updated Policy.
All data protection enquiries, requests to exercise rights, and complaints should be directed to hello@quanthree.com. Quanthree will endeavour to respond promptly and in any event within the period prescribed by applicable law.
