Privacy policy

1. Introduction

This policy explains how your personal data is processed when you visit the QUANTYX Terminal website or use the QUANTYX Terminal service (the “Service”). It is issued in accordance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the GDPR as retained in UK law (the “UK GDPR”) and the Data Protection Act 2018, and, where applicable, the French Data Protection Act No. 78-17 of 6 January 1978 (loi « Informatique et Libertés »).

The terms “personal data”, “processing”, “controller” and “processor” have the meaning given to them in the GDPR.

2. Controller

The controller is AMBER AND JASMINE LTD, a private limited company registered in England and Wales under company number 15098970, whose registered office is at 20 Wenlock Road, London, England, N1 7GU, United Kingdom.

• Contact for any question about your data: [TO BE COMPLETED: dedicated e-mail address, e.g. privacy@…]
• Representative in the European Union (Article 27 GDPR): [TO BE COMPLETED: name and address of the designated EU representative]
• ICO registration: [TO BE COMPLETED: ICO registration number]

On the Team plan, the Customer (the subscribing organisation) decides which members are invited and which rights they are granted. [TO BE COMPLETED / TO BE CONFIRMED: whether the Publisher acts as controller or processor in respect of Team members' data, and a data processing agreement (DPA) where applicable.]

3. Data we process

• Identification and account data: name, e-mail address, organisation (Team plan), role and rights within a Team, preferred language.
• Authentication and security data: password (stored only as an irreversible cryptographic hash), two-factor authentication secret, Google or Microsoft account identifier when signing in via OAuth (we do not receive your Google or Microsoft password), sign-in history, IP address, browser and device type.
• Subscription and billing data: plan subscribed, payment history, invoices, billing address, country of residence (for VAT purposes), VAT number of Business Customers. Full payment card details are collected and processed directly by our payment provider; we do not have access to them.
• Service usage data: watchlists, alerts and their settings, portfolios and positions that you enter or import, scenarios, display preferences, technical logs.
• Brokerage account data (optional): if you connect a brokerage account on a read-only basis, the positions, balances and account information that the broker makes available through that connection.
• AI assistant data: the questions you ask, the answers generated and, only if you enable this option, your portfolio positions sent for analysis.
• Telegram data (optional): if you enable Telegram alerts, the Telegram chat identifier needed to send the alerts.
• Correspondence: the content of your exchanges with our customer service.

We do not seek to process special categories of data (health data, political opinions, etc.). Please do not enter them into the Service, in particular into the AI assistants.

4. Purposes and legal bases

• Creating and managing your account, providing the Service, its features and its alerts: performance of the contract (Article 6(1)(b) GDPR).
• Authenticating Users, securing the Service, preventing fraud and abuse, detecting incidents: legitimate interest in ensuring the security of the Service (Article 6(1)(f)) and performance of the contract.
• Managing subscriptions, payments, invoicing and accounting: performance of the contract and compliance with our legal obligations, in particular tax and accounting obligations (Article 6(1)(c)).
• Producing AI Analyses at your request: performance of the contract; for sending your portfolio positions to the model provider, your explicit activation of this option, which you may disable at any time.
• Connecting a brokerage account on a read-only basis: performance of the contract, at your request.
• Sending transactional messages (sign-in link, security, invoices, subscription information): performance of the contract and legal obligations.
• Responding to your requests and complaints: performance of the contract or legitimate interest.
• Improving and developing the Service on the basis of aggregated technical statistics: legitimate interest.
• Establishing, exercising or defending our legal claims: legitimate interest.
• Sending you marketing communications: your consent where required by law, or our legitimate interest for services similar to those you have subscribed to, with the possibility of objecting at any time. [TO BE COMPLETED: delete if no marketing is planned.]

We do not take any decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

5. Processing relating to artificial intelligence

AI Analyses are produced using large language models supplied by third parties: DeepSeek and Anthropic (Claude). When you use an AI assistant, we send the relevant provider:

• the market data needed for the analysis;
• the question you asked;
• only if you have enabled it, your portfolio positions.

We do not knowingly send your name or e-mail address to model providers. However, any information you include in your question is sent to them; please avoid including personal data in it.

We do not use your data to train artificial intelligence models. Data sent to model providers is processed under the contractual terms applicable to our use of their application programming interfaces (APIs) [TO BE COMPLETED / TO BE VERIFIED: confirm, for each provider, that data sent via the API is not used to train its models, and state their retention period].

Processing by DeepSeek may involve a transfer of data outside the European Economic Area and the United Kingdom (see section 7).

6. Recipients and processors

Your data is accessible only to authorised staff of the Publisher, to the extent required by their duties. It is also processed by the following providers, acting on our behalf or, where applicable, as separate controllers:

• OVHcloud (OVH Hosting Inc.) — hosting of the Service on a server located in Canada (Beauharnois, Quebec).
• Resend (United States) — sending of transactional e-mails.
• Microsoft (OneDrive) — storage of backups, encrypted before upload; Microsoft does not hold the decryption key.
• DeepSeek and Anthropic — generation of AI Analyses (see section 5).
• [TO BE COMPLETED: payment provider, e.g. Stripe] — payment processing; this provider may act as a separate controller for its own obligations (fraud prevention and anti-money laundering).
• Google and Microsoft — only if you choose to sign in with your Google or Microsoft account; these companies then act under their own privacy policies.
• Telegram — only if you enable Telegram alerts; Telegram processes the content of the alerts sent to you, under its own privacy policy.
• Your broker — only if you connect a brokerage account; the data is then received from your broker.

Market data providers do not receive your personal data, except [TO BE COMPLETED / TO BE VERIFIED: any user-reporting obligations imposed by the data licence].

We may disclose data to administrative or judicial authorities where required by law. We do not sell your personal data.

7. International transfers

As the Publisher is established in the United Kingdom, your data is processed in the United Kingdom, which benefits from an adequacy decision of the European Commission. It is also transferred to the following countries, with the safeguards indicated:

• Canada (OVHcloud hosting): Canada benefits from an adequacy decision of the European Commission for organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), which is also recognised by the United Kingdom.
• United States (Resend, Anthropic, Microsoft, Google, payment provider): transfers governed by the EU–US Data Privacy Framework and its UK Extension where the recipient is certified, or otherwise by the European Commission's standard contractual clauses and the UK International Data Transfer Addendum. [TO BE COMPLETED: specify the mechanism used for each provider.]
• [TO BE COMPLETED: country where DeepSeek processes data, likely the People's Republic of China]: this country does not benefit from an adequacy decision. [TO BE COMPLETED / TO BE CONFIRMED: appropriate safeguards (standard contractual clauses, transfer impact assessment) or use of a model hosted in an adequate country.]
• Telegram: [TO BE COMPLETED: location and safeguards], transfer made at your request when you enable this option.
• OneDrive (Microsoft): [TO BE COMPLETED: storage region]. Backups are encrypted before being uploaded.

You may obtain a copy of the applicable safeguards by contacting us at the address given in section 2.

8. Retention periods

• Account data and data entered into the Service: for the full duration of the subscription, then deleted within 90 days after the end of the contract, unless retention is necessary to handle a dispute.
• Inactive accounts without a subscription: deleted after 24 months of inactivity, after prior notice to the User.
• History of exchanges with the AI assistants: retained while the account is active; the User may delete it at any time [TO BE COMPLETED / TO BE CONFIRMED: or a maximum period, e.g. 12 months].
• Sign-in data and security logs: 12 months.
• Invoices and accounting records: 6 years from the end of the financial year concerned (UK accounting obligations), or any longer period required by applicable law.
• Evidence of the contract (acceptance of the Terms, request for immediate performance, withdrawal): duration of the contract plus the applicable limitation period (6 years under English law).
• Correspondence with customer service: 3 years after the last exchange.
• Backups: deleted data disappears from the encrypted backups at the end of their rotation cycle, i.e. [TO BE COMPLETED: backup retention period, e.g. 90 days].

9. Your rights

Under the conditions laid down by the GDPR and the UK GDPR, you have the following rights:

• right of access to your data and to obtain a copy of it;
• right to rectification of inaccurate or incomplete data;
• right to erasure;
• right to restriction of processing;
• right to portability of the data you have provided to us, where processing is based on the contract or on consent;
• right to object to processing based on our legitimate interest, and right to object at any time to direct marketing;
• right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• for residents of France, the right to give instructions regarding the handling of your data after your death.

To exercise these rights, write to us at [TO BE COMPLETED: dedicated e-mail address] from the address associated with your account. We may ask you to prove your identity if we have reasonable doubts. We respond within one month, which may be extended by two further months for complex requests; you will be informed if so.

You may also change certain data and disable certain options (sending portfolio data to the AI assistants, Telegram alerts, brokerage account connection) directly from your account settings.

10. Complaints to a supervisory authority

If you consider that the processing of your data does not comply with the law, you may lodge a complaint with a supervisory authority, in particular:

• in the United Kingdom: the Information Commissioner's Office (ICO) — ico.org.uk;
• in France: the Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr;
• or the supervisory authority of the EU Member State of your habitual residence or place of work.

We invite you to contact us first so that we can try to address your concern.

11. Security

We implement technical and organisational measures appropriate to the risk, including:

• encryption of communications between your browser and the Service (HTTPS);
• storage of passwords as irreversible hashes;
• mandatory change of the temporary password at the first sign-in;
• two-factor authentication available (TOTP app, or via Google or Microsoft accounts);
• brokerage account connections limited to read-only access;
• encrypted backups (restic tool) kept on the server and on OneDrive;
• access rights management, including by the Account holder on the Team plan;
• logging of access and security events.

As no system is completely secure, we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority and, where required by law, the individuals concerned.

12. Minors

The Service is reserved for adults. We do not knowingly collect data relating to minors.

13. Cookies

The Service uses only strictly necessary cookies. For more information, please see our Cookie policy.

14. Changes

We may amend this policy, in particular when adding a provider or a new feature. The date of the last update appears at the top of the page. In the event of a material change, we will inform you by e-mail or within the Service before it takes effect.