Privacy Policy

UAB Asympto (operating QuantLine), Vilnius, Lithuania (controller). Privacy contact: hello@quantline.ai. You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) or your local supervisory authority.

We process account data to provide the service (contract, GDPR Art. 6(1)(b)); consent records and invoices to meet legal obligations (Art. 6(1)(c)); and security logs in our legitimate interest of keeping the platform safe (Art. 6(1)(f)). We do not build an advertising profile of you ourselves, and we do not sell personal data. If you allow advertising measurement, we send Meta the events and, for your first payment after the trial, the details described in section 4, so Meta can match the payment to an account, tell us whether our ads led to it and use it to choose who is shown our ads.

When you request beta access, we process your submission as a pre-contractual step you initiated (Art. 6(1)(b)) and send a single confirmation email on that same basis, regardless of whether you also opt in to marketing updates. If you tick the optional marketing checkbox, we process that separately on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting your beta request.

If you register through a campaign or referral link, we also store the referral and campaign parameters present at that moment (such as source, medium, campaign and campaign content) against your account, in our legitimate interest of understanding how customers discover QuantLine and measuring acquisition and service performance (Art. 6(1)(f)). This is separate from the optional analytics cookies described below: it is recorded once, as part of your account record, regardless of whether you accept analytics cookies, and we do not use it to build an advertising profile or share it with advertising networks.

When a retention period ends we delete or irreversibly anonymise the data in the normal course of operations.

We set strictly necessary cookies without asking: Supabase authentication session cookies, and (for administrators) an internal view-switch cookie.

We also use Google Analytics 4 on our public pages to understand how visitors find QuantLine — page and button interactions, and the marketing source (UTM parameters) behind the visit. It never receives your name, email, or anything you type into a form. Analytics cookies are only set if you accept them, via the cookie banner or the “Cookie preferences” control shown in the footer of every page, on the basis of your consent (Art. 6(1)(a)) — you can withdraw that consent at any time through the same control, which stops future analytics collection. Google Analytics data is processed by Google under the EU–US Data Privacy Framework; retention follows our Google Analytics account configuration (see the retention schedule above).

Separately, and only if you accept advertising cookies, we use the Meta Pixel on our public marketing and legal pages to measure the effect of our ads on Facebook and Instagram. Each time you open or return to one of those pages it sends Meta a page view: the page address (including any campaign labels, Meta click id or in-page section name it carries), the address of the page you came from when that is another public page of ours or only the name of another site, your IP address and browser details, and the technical data Meta’s code adds, such as screen size, time zone, page load timing and a short label for the last outside site that sent you to us. We also send a short event, with the same page details as a page view, when the pricing, how-it-works or track-record section of our home page scrolls into view (once for each section per page view) and when you click a sign-up button on our home page or campaign pages (an event named SignupClick and, for most buttons on the home page, one naming the button you clicked, such as the menu or pricing button). These events carry a fixed name and nothing you type. Meta also sets its own cookies (_fbp, _fbc) and keeps three entries in your browser’s local storage (multiFbc, lastExternalReferrer, lastExternalReferrerTime); multiFbc can hold the click id from an ad link. We do not send your name, email or account details. We send nothing from the sign-in, sign-up, checkout, account or product pages: if the script has already loaded in your open tab it stays there until you reload or leave the site, but we do not call it on those pages, and if you arrived from one of them (for example by opening a sign-up link in a new tab) or from an outside page that passed on its full address, we send no page views for that page (the next full page load is assessed again). Nothing is requested from Meta until you accept. You can withdraw consent at any time through the “Cookie preferences” control in the footer: it stops further collection in your open tabs of this browser and removes those cookies and local-storage entries from it; it does not delete data Meta has already received. Meta Platforms Ireland Limited receives this data; transfers outside the EEA rest on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Subscription measurement. Separately from those page views, and only on the basis of your consent to advertising measurement (Art. 6(1)(a)), our server tells Meta about your subscription through Meta’s Conversions API: when your first free trial starts (StartTrial), your first payment after the trial (Purchase, including when a plan change ends the trial early), each later renewal payment (SubscriptionRenewal) and when your subscription ends (SubscriptionCancel). Nothing is sent for the first payment of a subscription that had no free trial, for later plan-change or other one-off charges, for zero-value invoices or for failed payments, and a refund does not withdraw an event already sent. Each event carries its name, time and an event code (a scrambled form of our internal reference for your account, subscription or payment), the amount and currency for payments, and Meta’s _fbp and _fbc values; StartTrial also carries your browser’s user agent and the address of our checkout page. Under this version of the notice, the Purchase event can also carry, where we have them: the email address of your QuantLine account once you have confirmed it; your QuantLine account ID; the phone number (with its country code), first name, last name and date of birth you add under Ad matching details in your Account settings; the city, region, postcode and country of the billing address recorded with the payment that settled that invoice, with a part it lacks taken from the address you add there only when both name the same country, and that address alone when the payment names no country; and the IP address and user agent of the browser our site sent to the Stripe checkout page that subscription came from. No other event carries them. Our server turns each of them except the IP address and user agent into a SHA-256 hash before sending it; Meta requires those two unhashed. Hashing is not anonymity: Meta compares the hashes with the details it holds for Facebook and Instagram accounts, so Meta can match the payment to an account, tell us whether our ads led to it and use it to choose who is shown our ads. We use the email your account has and your Ad matching details as they are when the event is sent, and the billing details of that payment itself, never those of a later card. We never guess or complete a detail: we do not split a full name, work out a date of birth or add a country code to a phone number. We use the IP address and user agent only when we can tie them to the checkout page that created that subscription: when we send you to Stripe, and only if the choice your browser carried then is recorded under this version of the notice, we keep that browser's IP address with a scrambled form of that checkout's reference; if our site sent more than one browser to that checkout page, or sent you there before this version, they are not sent. If the link to Stripe's checkout page is copied and opened on another device, we cannot tell, and the IP address and user agent of the browser our site sent there are used. These details are added only if the choice in force when that subscription was created at checkout, and every choice you have made since, allowed advertising measurement under this version of the notice; a permission given under an earlier notice never covers them, even if you allow it again later. When some are not covered or not available, the Purchase is sent with the ones that are. When every choice was made under this version, the Purchase can be sent without Meta's _fbp and _fbc values if it still carries your email, your phone number, or the IP address and user agent together, and it is not sent otherwise. A decline or withdrawal never leads to a smaller event: it stops the event, and it deletes your Ad matching details and any checkout IP address we keep. Our server never sends Meta your card details or payment IDs, and sends none of these details with any other event (the Meta Pixel above is separate: it runs in your browser, so Meta sees your IP address and browser details on those page views). To do this we record your choice against your account when you go to checkout or change it while signed in, and a decline or withdrawal not yet recorded also when you open the upgrade page signed in, together with the version of this notice, the time, a scrambled random identifier for your browser, and (only if you allowed it) those Meta values, user agent and page address. An event is sent only if you allowed advertising measurement before it happened and still allow it when we send it, which is within 7 days. If you decline or withdraw, events from before that are never sent, even if you allow it again later, and only a new choice you make while signed in turns these events back on: permission still stored on another device does not. You can withdraw at any time in “Cookie preferences”, at the foot of our public pages, signed in or not: withdrawing while signed in stops these events for your account on every device; withdrawing in a signed-out browser stops them for the first 20 accounts that recorded a choice from that browser. If that browser cannot reach us, it tries again the next time it opens our public pages, the sign-up page or the upgrade page; a browser that never returns to them cannot send it, so withdraw while signed in to be certain. Withdrawing does not delete events Meta has already received. Meta Platforms Ireland Limited receives this data; transfers outside the EEA rest on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Sign-up and checkout measurement. On the same basis, our server also tells Meta, through the Conversions API, when you finish creating a QuantLine account (CompleteRegistration) and when we send you to Stripe's checkout page (InitiateCheckout, once for each checkout page we open for you). CompleteRegistration is sent only if you had already allowed advertising measurement in the same browser before your account existed: when you open our sign-up page with advertising measurement allowed and Meta's _fbp or _fbc value in your browser, our server records that permission, the time our server received it, those Meta values, your browser's user agent and the address of our sign-up page, without any account, and sets a single-use cookie (ql_reg_intent, readable only by our server, for up to 24 hours). The event is dated to the moment your account is created (when you confirm your email address, or when you first sign up with Google), and it is sent only if, on the first page you open afterwards in that browser, your choice is still exactly the same; we then copy that permission to your account's consent record, keeping both the time our server first received it on the sign-up page and the time it was linked to your account; for that check we set two more single-use cookies for up to 30 minutes (ql_reg_claim, readable only by our server, and ql_reg_pending). If you declined, withdrew or changed your choice in between, or if your account already holds a decline or withdrawal, nothing is sent. Only the first sign-in we observe after your account is created can count, never a later one. InitiateCheckout is sent only if the choice your browser carried when you went to checkout was recorded then, and it is dated to the moment we send you to Stripe's checkout page. Each of these events carries its name, time and an event code (a scrambled form of our internal reference for your account or for that checkout), Meta's _fbp and _fbc values, your browser's user agent and the address of our sign-up or checkout page, and no amount. With these two events our server never sends Meta your name, email, phone number or IP address, or your account or checkout IDs themselves. While this measurement is switched on we also keep, for every new account, a short technical record of when it was created and whether a sign-up permission was linked to it, so that an account can count only once.

We use Supabase (database & auth, hosted in the EU — eu-central-1), Vercel (web hosting/CDN), Stripe (payments), Resend (transactional email delivery), Railway (model-pipeline compute), and — only for visitors who accept analytics cookies — Google (Google Analytics 4, anonymous acquisition analytics) and, only for visitors who accept advertising cookies, Meta (Meta Pixel and Conversions API, advertising measurement). Where a processor transfers data outside the EEA, transfers rest on the EU–US Data Privacy Framework or Standard Contractual Clauses.

You have the rights of access, rectification, erasure, restriction, portability, and objection (GDPR Arts. 15–21). Email hello@quantline.ai from your account address; we respond within 30 days. Deleting your account removes profile and position data on the schedule above — invoice metadata is retained for the statutory accounting period.

We version this policy. Material changes are announced in-app before they take effect; the version and effective date are shown at the top of this page.