Privacy Policy

1. About this policy

This policy explains how KuantTrade ("we", "us") handles personal data when you visit https://kuanttrade.com, use the KuantTrade application at https://app.kuanttrade.com, use our mobile app, or contact us. It forms part of the Terms of Service.

For the purposes of the EU and UK General Data Protection Regulation, KuantTrade is the controller of the personal data described here. Contact details, including for privacy requests, are in Section 19.

Where you connect a broker, that broker is an independent controller of the data it holds about you, and its own privacy policy governs what it does. The same is true of any third-party client you authorise to reach your account. Section 7 explains the distinction and why it matters.

2. What we collect

2.1 Account data

Your username, email address, and optionally a display name. Your password is never stored: we keep only a salted, adaptive one-way hash of it, from which the password cannot be recovered. Where a deployment verifies passwords through the platform’s own identity service rather than against that hash, the credential is held by that service and we hold no hash for the account at all. Where you sign in through an identity provider instead, we receive the identifiers and email address that provider releases to us, and no password exists.

2.2 Session and device data

When you sign in we create a server-side session and set a single cookie holding its identifier, which page scripts cannot read. With it we record the IP address and browser user-agent of the device that signed in, so that you and we can recognise an unfamiliar session. On the mobile app, if you enable notifications, we store the push token your device issues.

2.3 Brokerage connection data

When you connect a brokerage account we store the credentials needed to keep that connection working (a delegated-access token issued by the broker, or a key and secret, depending on the broker) encrypted at rest under keys held in a separate secret store. Where a broker supports delegated sign-in, we never see or store your broker password. We also store the account identifiers and account metadata the broker returns.

2.4 Trading and portfolio data

Positions, orders, fills, balances, cash and buying power read from your connected accounts; the strategies you create and their configuration; webhook and signal configuration; backtest and simulation runs and their results; and the performance figures we compute from all of the above.

2.5 AI interaction data

When you use an AI feature we store the request you made, the account context assembled to answer it, the model’s response, any draft configuration or draft order parameters produced, and your decision on each. We retain a record proportionate to explaining what happened in your account, investigating incidents and resolving disputes. Where the full request or the full account context is not necessary for those purposes, we reduce or redact what is kept.

2.6 Machine access records

Where you issue API credentials or authorise a third-party client, we record which client connected, when, under what scope, and what it asked for. This record is available to you and is how you can tell what an authorised client actually did.

2.7 Operational logs

Server logs recording requests to our systems, including IP address, timestamp, endpoint, response status and error detail; and audit records of security-relevant events such as sign-in, credential change, broker connection and permission change.

2.8 Support and correspondence

What you send us when you contact support, and our replies.

2.9 Payment data

Where paid subscriptions are offered, payment is handled by a payment processor. We receive a customer and subscription identifier, the plan, its status, and the last four digits and brand of the card. We do not receive or store your full card number, and we never see your card security code.

2.10 What we do not collect

As at the version date of this policy, this website runs no analytics, no advertising, no tracking pixels, no session recording and no third-party scripts of any kind, and the Cookie Policy lists everything stored on your device. If that changes, both documents are updated before the change ships. We do not build advertising profiles, we do not buy personal data from data brokers, and we do not collect special-category data (health, biometrics, political opinions and the like) or government identification documents; your broker may require the latter, but we do not receive it.

3. Where it comes from

• From you, when you register, configure the product, write a strategy, or contact us.
• From your device, automatically, when you use the Service: IP address, user-agent, and the requests you make.
• From your brokers, when you connect an account and thereafter as your positions and orders change.
• From your identity provider, where you sign in through one.
• From our payment processor, for the subscription facts listed above.

4. Why we use it, and on what legal basis

Where the EU or UK GDPR applies to you, the table below states the legal basis on which we rely. Where it does not, the purposes are the same.

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights, and you may object at any time under Section 12.

5. What happens when you use an AI feature

This section exists on its own because it is the part of the product that sends the most sensitive data outside our systems, and a reader is entitled to know exactly what leaves and when.

AI features are not always on. Nothing is sent to a model provider unless you use one: by asking the Agent something, by asking for a proposal, or by running a feature that says it uses a model. Ordinary use of the platform, including running your strategies, does not involve a model provider.

When you do use one, what leaves our systems is your request together with the account context needed to answer it: this may include your positions, balances, orders, strategy configurations and recent activity, depending on the question. It is sent to a model provider in the category identified in Section 7 over an encrypted connection, and it is sent under a commercial API agreement rather than as a consumer product.

We do not consent to your data being used to train a provider’s models, and we use API tiers on which such training does not occur. A provider may retain a request briefly for abuse monitoring under its own terms; we do not control that period and it is described in that provider’s documentation.

If you would rather no account data reach a model provider, do not use the AI features. The rest of the Service works without them.

6. Automated decisions and profiling

We do not use automated processing to make decisions about you that produce legal effects or similarly significantly affect you; no credit scoring, no eligibility scoring, no automated account decisions.

The Service does execute automated actions in your brokerage account: that is what it is for. Those actions follow rules you wrote and settings you chose, they are decisions you made in advance rather than decisions we made about you, and you can stop them at any time by disabling a strategy or using the controls the product provides. Where an automated tool drafts a set of order parameters, the decision to act on that draft is yours, unless you have adopted an automation setting under which it is transmitted without individual confirmation. Nothing the Service produces is a recommendation; Section 10 of the Terms of Service states that operatively.

7. Who else sees your data

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not disclose it to anyone except as described here.

7.1 Processors acting on our instructions

These categories of provider process personal data on our behalf, under contract, for the purposes stated. One qualification is worth stating plainly: a provider may also act as an independent controller of the same data where it processes that data to meet its own legal, regulatory, security, fraud-prevention or billing obligations, and where it does, its own privacy terms govern that processing rather than ours. That is most commonly the case with a payment processor. Rows marked "conditional" apply only where a deployment or a feature is configured to engage that category. We identify categories rather than companies because that is what the applicable rules ask for and because a supplier change should not require a new version of a contract; the current list of the actual providers behind each category is available on request at the address in Section 19. Two categories a reader may expect are absent because they do not exist here: we use no third-party error-tracking, crash-reporting or product-analytics provider, and we use no third-party key-management service.

7.2 Recipients you choose, acting for themselves

These are not our processors. They receive your data because you decided to involve them, and what they do with it is governed by your agreement with them rather than by this policy.

7.3 Other disclosures

• Professional advisers (lawyers, accountants, auditors) under a duty of confidence, where needed.
• Law enforcement, regulators or courts, where we are legally required to disclose or where disclosure is necessary to establish, exercise or defend a legal claim. We assess each request, we require it to be lawful and specific, and we will tell you unless we are prohibited from doing so.
• An acquirer, in connection with a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply to the data transferred, and with notice to you before any change of controller takes effect.

8. International transfers

Our servers are in the European Economic Area. Some of the providers listed in Section 7 are in the United States, and any broker you connect may be anywhere. Personal data therefore crosses borders, including out of the EEA and the United Kingdom.

Where we transfer personal data out of the EEA or the UK to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, and we assess whether additional technical measures are needed. You may request a copy of the relevant safeguards at the address in Section 19.

9. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

10. How we protect it: our Security Commitments

The seven measures numbered below are our Security Commitments. That term is used deliberately and it is used nowhere else: Sections 7.6 and 24.5 of the Terms of Service lift a limitation of liability where the Company fails to meet them, so a reader is entitled to know exactly which sentences those Sections point at. They are these seven, and nothing else in this Policy is one. Anything else here describes what we do rather than promising it, and Section 1.2b of the Terms of Service says so.

We do not hold a SOC 2 or ISO 27001 certification and we do not claim one; if that changes, this section will say so. A Commitment states an outcome rather than a product: where the means of meeting one improves, we will change the means and the Commitment stands.

1. Traffic is encrypted in transit using current industry-standard transport security, and data at rest is encrypted at the storage layer.
2. Broker credentials are encrypted with keys held in a separate secret-management system. That system is one we run ourselves, on the hosting identified in Section 7, and it is not a third-party key-management service: the keys do not leave that infrastructure. Credentials are never written to environment variables, configuration files or logs.
3. Where we store a password credential ourselves, it is stored only as a salted one-way hash (currently a salted, adaptive one-way hash using a current industry-standard algorithm and work factor) from which the password cannot be recovered. Where authentication is delegated to an identity provider or to the platform’s own identity service, we do not store the password at all.
4. Session tokens are held server-side; the browser receives a cookie carrying only a session identifier, which page scripts cannot read and which is sent only over an encrypted connection.
5. Access to production systems is restricted, individually attributed and logged.
6. Services are network-segmented so that a component can reach only what it needs.
7. Security-relevant events are recorded in an audit log that ordinary application code cannot amend.

That list is closed. A measure not numbered above is not a Security Commitment, however sensible it may be, and the Company may change it without amending this Policy.

No system is perfectly secure, and we cannot guarantee that yours will not be compromised, most often through a password reused elsewhere, or a device that is not yours alone. Use a unique password and enable every security control we offer. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority where the law requires it, without undue delay.

If you believe you have found a vulnerability, please report it to security@kuanttrade.com rather than testing it against another user’s account. We will not pursue a researcher who reports in good faith and does not access data that is not theirs.

11. Your rights

Wherever you live, you may ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, subject to what we must keep for legal reasons;
• give you your data in a portable, machine-readable form;
• restrict how we use it, or stop using it, while a dispute about it is resolved;
• stop relying on legitimate interests for a particular purpose, where you object; and
• withdraw a consent you gave, without affecting what was done before you withdrew it.

Write to privacy@kuanttrade.com. We will respond within one month, and will tell you if we need longer because the request is complex. We do not charge for this, and we will not treat you differently for asking. We may ask you to verify your identity: an account holder can usually do so simply by writing from the address on the account.

One limit is worth stating plainly: deleting your data with us does not delete anything held by your broker, and does not undo a trade. Your broker’s record of your account is its own, and is subject to its own retention obligations.

12. If you are in the EEA, the UK or Switzerland

The rights in Section 11 are your rights under Articles 15 to 22 of the GDPR, and this policy is our Article 13 and 14 notice. In addition:

• You have the right to lodge a complaint with your national supervisory authority. We would rather you came to us first, but you are not required to.
• You have the right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and an absolute right to object to direct marketing.
• Providing the data described in Sections 2.1 to 2.4 is necessary in order to enter into and perform the contract; without it we cannot provide the Service.
• Where we transfer data outside the EEA or the UK, Section 8 describes the safeguards.

13. If you are in California

Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to limit the use of sensitive personal information. Section 2 lists the categories we collect, Section 4 the purposes, Section 7 the recipients and Section 9 our retention periods.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months, and we do not do so now. We do not have actual knowledge of selling or sharing the personal information of anyone under 16; the Service is not available to anyone under 18.

Financial account information is sensitive personal information under the CCPA. We use it only to provide the Service you asked for and for the purposes permitted by section 7027(m) of the CCPA regulations, which is to say we do not use it to infer characteristics about you.

To exercise a right, write to privacy@kuanttrade.com. You may use an authorised agent, in which case we will ask for proof of their authority. We will not discriminate against you for exercising any right.

14. If you are somewhere else

We apply the substance of this policy to every user, wherever they live. Many countries (including Türkiye under the KVKK, Brazil under the LGPD, Canada under PIPEDA, and a growing number of US states) give you rights similar to those in Section 11, and sometimes additional ones. Where your local law gives you a right this policy does not mention, that right still applies, and you may exercise it at the address in Section 19.

15. Cookies

Our marketing website sets no cookies of its own beyond one that remembers the language you chose, and it carries no analytics or advertising technology. The application sets a single session cookie, which is strictly necessary to keep you signed in. The Cookie Policy names each one, what it is for and how long it lasts.

16. Children

The Service is for adults. We do not knowingly collect personal data from anyone under 18, and an account held by someone under 18 will be closed. If you believe a child has given us personal data, write to privacy@kuanttrade.com and we will delete it.

17. Changes to this policy

We will update this policy when what we do changes. Every version carries a version number and an effective date. Where a change is material (a new category of data, a new purpose, a new recipient) we will tell you by email before it takes effect, and where the law requires your consent we will ask for it rather than assume it.

18. Complaints

If you are unhappy with how we have handled your data or your request, tell us at privacy@kuanttrade.com and say so plainly; we will look at it again and reply. If you are still unhappy, you may complain to your data protection authority, and if you are in the EEA or the UK you may do so without coming to us first.

19. How to contact us

Privacy requests and questions about this policy go to the privacy address below; vulnerability reports go to the security address, which reaches an engineer rather than a controller. Both are monitored.