Template for review by qualified legal counsel. Not legal advice. Last updated: 2026 (placeholder — set on solicitor sign-off.)
This Privacy Policy explains how QuantCoreX (“QuantCoreX”, “we”, “us”, or “our”) processes personal data when you access our educational pre-trade decision-support software and related websites, applications, and services (together, the “Service”). QuantCoreX is educational software. It is not a broker, investment adviser, financial adviser, signal provider, or fund, and it does not execute trades, hold client money, or provide personal recommendations.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, QuantCoreX is the controller of the personal data described in this policy, except where we act as a processor on your behalf for content you submit. If you have questions about this policy, please use the contact route published on our website.
What we collect
We collect the following categories of personal data, depending on how you use the Service:
- Authentication and profile data. Account identifiers such as your email address, a hashed password or federated sign-in identifier, display name, and profile preferences. Authentication is handled through our identity provider (see Subprocessors).
- Billing data. Subscription status, plan tier, and transaction metadata. Card and payment details are collected and processed directly by our payment processor (Stripe); QuantCoreX does not store full card numbers.
- Uploaded screenshots and images. Where the image upload feature is enabled, any charts, screenshots, or other images you choose to submit for analysis, together with technical metadata associated with those files.
- Trade-review inputs. The parameters, notes, instrument references, and hypothetical scenario details you enter so that the Service can produce an educational pre-trade review.
- Account and risk settings. Configuration values such as your stated risk preferences, position-sizing inputs, and other settings you provide to tailor the educational output. These are inputs you supply and are not investment advice from us.
- Analytics and cookies. Usage data such as pages viewed, features used, device and browser information, IP address, and approximate location, collected through cookies and similar technologies. See our separate cookie information where provided.
How we use it
We use personal data for the following purposes and legal bases:
- To provide the Service. Creating and maintaining your account, processing your trade-review inputs, and returning educational output. Legal basis: performance of a contract.
- To process payments. Managing subscriptions, renewals, and refunds through our payment processor. Legal basis: performance of a contract.
- To secure and maintain the Service. Detecting, preventing, and investigating fraud, abuse, and security incidents. Legal basis: legitimate interests and legal obligation.
- To improve the Service. Understanding usage patterns and diagnosing errors through aggregated and analytics data. Legal basis: legitimate interests, and consent where required for non-essential cookies.
- To communicate with you. Sending service, security, and administrative messages, and, where permitted, information about the Service. Legal basis: legitimate interests or consent.
- To comply with law. Meeting our legal, regulatory, and record-keeping obligations. Legal basis: legal obligation.
We do not use your personal data to provide personalised investment advice, and we do not sell your personal data.
Subprocessors
We rely on a small number of third-party providers to operate the Service. Each processes personal data only on our instructions and under appropriate contractual terms. Our current subprocessors are:
- Supabase — authentication, database, and storage infrastructure for account and application data.
- Stripe — payment processing and subscription management.
- Vercel — application hosting, delivery, and associated logging.
- An AI provider (if and when connected) — used to generate educational analysis of your trade-review inputs and, where applicable, uploaded images. This subprocessor is engaged only if and when the relevant feature is enabled, and it is subject to the contractual protections described under International transfers.
We will update this list as our providers change. A current list may be made available on request.
AI and OCR processing risks
Where enabled, the Service may use automated analysis, including AI models and optical character recognition (OCR), to interpret your trade-review inputs and uploaded images and to produce educational output. You should be aware of the following:
- Automated output is generated for educational purposes only, may be inaccurate or incomplete, and is not a recommendation, signal, or instruction to buy, sell, or hold any instrument.
- OCR and image analysis may extract text and figures from your images, including any financial details visible in them, in order to perform the requested analysis.
- Automated systems can misread images, misinterpret context, or produce plausible-sounding but incorrect results. You remain solely responsible for any decisions you make.
- You should not submit information you are not comfortable having processed by automated systems and our subprocessors.
Uploaded images
Uploaded screenshots may unintentionally contain account balances, broker identifiers, trade history, or other personal/financial information. Users should review images before uploading. QuantCoreX will process such images only for the purpose of providing the requested analysis, subject to the limitations described in this policy.
Data retention
We retain personal data only for as long as necessary for the purposes described in this policy, to comply with our legal and regulatory obligations, and to resolve disputes and enforce our agreements. Where data is no longer required, we take steps to delete or anonymise it.
- Account and profile data — retained for the life of your account and for a defined period afterwards. [PLACEHOLDER — set retention period on sign-off.]
- Billing records — retained for the period required by applicable tax and accounting law. [PLACEHOLDER — set retention period on sign-off.]
- Uploaded images and trade-review inputs — retained for a defined period to provide and improve the Service, then deleted or anonymised. [PLACEHOLDER — set retention period on sign-off.]
- Analytics and log data — retained for a defined period for security and diagnostics. [PLACEHOLDER — set retention period on sign-off.]
Your rights under UK GDPR
Subject to the conditions and exemptions in applicable law, you have the following rights in relation to your personal data:
- Access — to obtain confirmation that we process your data and a copy of it.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to request deletion of your data in certain circumstances.
- Restriction — to request that we limit how we process your data.
- Portability — to receive certain data in a structured, commonly used, machine-readable format.
- Objection — to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Withdrawal of consent — where we rely on consent, to withdraw it at any time without affecting prior processing.
- Complaint— to lodge a complaint with the UK Information Commissioner's Office (ICO). We would appreciate the chance to address your concerns before you approach the ICO.
Deletion requests
You may request deletion of your account and associated personal data using the contact route published on our website, or through any in-product controls we provide. We will verify your identity before acting on a request. On deletion, we will remove or anonymise your personal data, except where we are required or permitted by law to retain certain records (for example, billing and tax records). Where we act as a processor for content you submitted, we will also instruct our subprocessors to delete the relevant data in accordance with our agreements with them.
International transfers, DPA, and zero-data-retention
Some of our subprocessors may process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or transfers to jurisdictions covered by UK adequacy regulations.
We put in place a data processing agreement (DPA) with each subprocessor that governs how they may handle personal data on our behalf. For any AI provider we may connect in the future, we intend to require, where available, contractual terms providing for zero data retention and no use of your inputs or outputs to train the provider's models. Until such terms are in place for a given provider, that provider will not be engaged to process your personal data through the Service. We will update this policy to reflect the providers actually in use.