Privacy Policy
Product: QuantCode Controller: QuantCode Contact: support@getquantcode.com Effective date: 5 November 2026
1. Who is responsible
QuantCode is the controller of the personal data described here — we decide what is collected and why.
Our payment provider acts as an independent controller for the payment data it collects to process your subscription and meet its own tax and anti-fraud obligations.
2. What we collect
| Category | What it is | Why |
|---|---|---|
| Account data | Email address, password (stored only as a salted PBKDF2-SHA256 hash), plan, trial status, created and last-login timestamps | To create your account, sign you in, and know which plan applies |
| Usage counters | How many backtests, parameter scans, out-of-sample checks and code generations you have run, and when | To enforce the trial and plan limits |
| Content you submit | Strategy code you write or generate, strategy descriptions, saved presets and settings | To run your backtest and show you the result |
| Technical data | IP address and request metadata in short-lived server logs; session cookies | To keep the Service up, prevent abuse and debug failures |
| Support correspondence | Emails you send us | To answer you and keep a record of what was agreed |
We do not collect your card number, CVV, bank details, billing address, government ID, or any special-category data. Payment details are entered on the payment provider's checkout and never reach our servers.
We do not sell your data, do not share it with advertisers, and do not use your strategies to train models or to build another product.
3. Why we are allowed to process it
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, delivering the Service you paid for | Performance of a contract |
| Enforcing usage limits and preventing abuse | Legitimate interests (keeping the Service available for everyone) |
| Security logging and fraud prevention | Legitimate interests and, where required, legal obligation |
| Answering support requests | Performance of a contract or legitimate interests |
| Sending service notices (price change, downtime, terms update) | Performance of a contract or legal obligation |
| Optional product email | Consent, withdrawable at any time |
We do not use automated decision-making that produces legal or similarly significant effects about you. The subscription gate is a simple expiry check, not profiling.
4. Cookies and local storage
We use only what the Service needs to work:
- a session cookie that keeps you signed in;
- the framework's own session state, held in server memory;
- no advertising, analytics or cross-site tracking cookies.
Because these are strictly necessary, they do not require a consent banner under the ePrivacy Directive. If analytics are ever added, this policy and a consent mechanism will be updated first.
5. Who else sees your data
| Recipient | Role | What they get |
|---|---|---|
| Payment provider (Paddle) | Merchant of record, independent controller | Your email, plan, and the payment data you enter on its checkout |
| Hosting provider | Processor | Encrypted disks holding the database and application |
| Model API provider | Processor | The strategy description you submit, when you use the code-writing feature |
| Email delivery | Processor | Your address, for transactional mail only |
We do not share data with anyone else unless required by law, and we do not transfer it as part of a sale of the business without telling you.
6. International transfers
The Service runs on servers outside your country, and the operator may access it from the People's Republic of China. Where personal data protected by the GDPR is transferred out of the EEA or the UK, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with the technical measures described in section 9.
7. How long we keep it
| Data | Retention |
|---|---|
| Account record | While the account exists, then 30 days |
| Usage counters | Rolling windows only; individual events are pruned within days |
| Submitted strategies and presets | Until you delete them, or 30 days after account deletion |
| Server logs | 14 days |
| Support email | 24 months |
| Invoices and tax records | As long as tax law requires (typically 6–10 years), held by the payment provider |
When a retention period ends, the data is deleted or irreversibly anonymised.
8. Your rights
Subject to the law where you live, you may ask us to:
- access the personal data we hold about you;
- correct anything inaccurate;
- delete it (the "right to be forgotten");
- export it in a machine-readable format;
- restrict or object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing already done.
Write to support@getquantcode.com and we will respond within 30 days. We may ask you to verify control of the account email first, so that nobody else can exercise rights over your data.
If you are in the EEA or UK you may also complain to your local supervisory authority. If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share personal information as those terms are defined by the CCPA/CPRA.
9. How we protect it
- Passwords are stored as PBKDF2-HMAC-SHA256 hashes with a per-user random salt and 240,000 iterations. The plaintext password is never stored, never logged and never sent anywhere.
- Passwords are compared in constant time, and repeated failed sign-ins are rate-limited.
- Every customer's saved data is stored in a separate namespaced directory keyed by an irreversible hash, so one account cannot read another's files.
- Code submitted to the Service is never executed inside the application process on the hosted deployment; it runs in a separate process with a timeout and a memory cap.
- Traffic is served over HTTPS. Payment data never touches our infrastructure.
- Access to the production database is limited to the operator and protected by a credential held outside the codebase.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority without undue delay where the law requires it.
10. Children
The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to support@getquantcode.com and we will delete it.
11. Changes
If we change how we handle personal data, we update this page and, for material changes, tell you by email or in the app before the change takes effect. The effective date at the top always reflects the current version.
12. Contact
support@getquantcode.com
_Last updated: 5 November 2026_