Privacy Policy

The controller of your personal data is Simon Bartos (business ID 3658308-4). Privacy questions and requests can be sent to support@quantwright.com.

Beta applications — when you apply for the private beta: your email address, your name if you give it, and your answers (what you tell us about yourself, the markets you trade, how you build strategies, whether you are in a prop-firm evaluation, a strategy you would test first, and how you heard about us).

Account information — your email address and basic profile details, recorded by our identity provider when you create an account, and the version and time of the Terms you accepted.

Subscription information — your Stripe customer id, subscription status and renewal date, and invoices. Stripe handles your card details; we never see or store them.

Content you create — strategies, generated code, backtests, chat messages and files you upload.

Bug reports — if you send one from the app: your description, the technical details the form shows you before you send it (page, browser, window size, theme and time) and, only if you tick the box, access to that chat so we can investigate; we keep a report until the issue is resolved and then for at most 12 months.

Waitlist — if you joined our waitlist: your email address, kept on a mailing list so we can tell you when access opens. Every email has an unsubscribe link.

Usage and technical data — server logs, request identifiers, IP address, browser and device details, error reports, and how much AI work your account has used (for the fair-use limits).

To consider your application and contact you about the beta — steps you ask us to take before a contract (GDPR Art. 6(1)(b)).

To provide the Service you subscribe to — running your backtests and analyses, storing your content, taking payment, support: performance of our contract with you (Art. 6(1)(b)).

To keep the Service secure and working — logs, abuse prevention, fair-use limits, debugging: our legitimate interest in a secure, reliable service (Art. 6(1)(f)).

To tell waitlist members when access opens — your consent, given when you join (Art. 6(1)(a)); withdraw it at any time with the unsubscribe link.

To keep accounting records — invoices and payment records: our legal obligation under accounting law (Art. 6(1)(c)).

We do not sell your personal data, do not use it for advertising, do not use your content to train AI models, and make no automated decisions about you that have legal or similarly significant effects.

These providers process personal data on our behalf, only to provide their service to us:

• Clerk — sign-in and account management (your email address and login details)
• Supabase — our database, hosted in the United States (your account’s content, applications, subscription status)
• Vercel — hosting of the website and application (request logs, IP address)
• Fly.io — the servers that run backtests (strategy code, parameters and market data)
• OpenAI — AI generation (the prompts, strategy descriptions and code you submit)
• Stripe — payments (your payment details, handled by Stripe; we receive a customer id, the subscription status and invoices)
• Resend — sending email, and the mailing list for people who joined our waitlist (your email address and the message)

Prompts and strategy code you submit for AI generation are sent to OpenAI to produce a response. Do not paste secrets or sensitive personal data into prompts.

Stripe also processes payment data as an independent controller for its own legal obligations (for example fraud prevention and financial regulation), under its own privacy policy.

Our market-data providers (named on the Legal & Disclaimers page) receive only what a data request needs — a symbol, a timeframe, a date range — and no personal data about you.

Our database and several of these providers are in the United States or process data there. Where they do, the transfer relies on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data processing agreement.

Applications — while we consider them and for up to 12 months after we decide, then deleted. An approved application is kept while the account it led to exists, because it is what lets that account subscribe.

Account and content — while your account exists. When you ask us to delete your account, we delete it and its content within 30 days.

Payment and invoice records — for as long as accounting law requires (in Finland, up to 10 years), even after your account is deleted.

Waitlist — until you unsubscribe, or until the waitlist is no longer needed.

Logs and error reports — for a limited period needed for security and debugging, normally no longer than 90 days.

We carry out these deletions ourselves; they are not all automated yet, which is why the periods above are maximums rather than exact dates.

You can ask us for access to your personal data, and to correct it, delete it, restrict or object to its processing, or receive it in a portable form. You can export your strategies and backtests, and request deletion of your account and its content, through the contact address in the first section. We answer within one month.

You can also complain to a data protection authority — in Finland, the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto), or the authority where you live or work.

We use only the cookies needed to sign you in and keep your session. We do not run analytics or advertising trackers.

We use encrypted transport, per-user data scoping, and encryption at rest for stored credentials. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children.

We may update this policy. Material changes are announced in the product and reflected by an updated “Last updated” date.