Legal
Privacy Policy
What we collect, why, for how long, and the rights you can exercise. We run on EU infrastructure and set no advertising cookies; analytics cookies are optional and off until you accept them.
Version 2026-06-10 · Effective 2026-06-10
1Controller and contact
UAB Asympto (operating QuantLine), Vilnius, Lithuania (controller). Privacy contact: hello@quantline.ai. You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) or your local supervisory authority.
2What we process and why
We process account data to provide the service (contract, GDPR Art. 6(1)(b)); consent records and invoices to meet legal obligations (Art. 6(1)(c)); and security logs in our legitimate interest of keeping the platform safe (Art. 6(1)(f)). We do not profile you for advertising, and we do not sell personal data.
When you request beta access, we process your submission as a pre-contractual step you initiated (Art. 6(1)(b)) and send a single confirmation email on that same basis, regardless of whether you also opt in to marketing updates. If you tick the optional marketing checkbox, we process that separately on the basis of your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting your beta request.
3Retention schedule
| Data category | Examples | Retention |
|---|---|---|
| Account & profile | Email, password hash (managed by Supabase Auth), tier, bankroll figure, display preferences | Life of the account + 30 days after deletion request |
| Consent records | Terms version accepted, acceptance timestamp | 5 years after account closure (proof of compliance) |
| Authentication cookies | Supabase session/refresh cookies (strictly necessary; no advertising or analytics cookies are set) | Session-scoped; refresh token lifetime per auth settings |
| Usage & positions history | Positions you record against signals, settlement outcomes | Life of the account + 30 days, or anonymised for aggregate statistics |
| Payment ledger metadata | Stripe customer id, subscription status, invoice references (card numbers never touch our systems — they stay with Stripe) | 10 years (Lithuanian accounting-document requirements) |
| Security & infrastructure logs | Request logs at our hosting providers, webhook audit rows | Up to 12 months |
| Support correspondence | Emails to hello@quantline.ai | 2 years after the thread closes |
| Beta / waitlist requests | Email, name (optional), UTM/referrer attribution, your marketing-consent choice, and confirmation-email delivery status, for people who requested beta access and do not yet have an account | 24 months from the request, or immediately on request to hello@quantline.ai. Superseded by the Account & profile row above once a request becomes an account. |
| Anonymous analytics (Google Analytics 4) | Page and button interaction events, UTM attribution — never your name, email, or account identifier. Only collected if you accept analytics cookies. | Governed by our Google Analytics account configuration (Google's platform maximum for event-level data is 14 months) |
When a retention period ends we delete or irreversibly anonymise the data in the normal course of operations.
4Cookies and analytics
We set strictly necessary cookies without asking: Supabase authentication session cookies, and (for administrators) an internal view-switch cookie.
We also use Google Analytics 4 on our public pages to understand how visitors find QuantLine — page and button interactions, and the marketing source (UTM parameters) behind the visit. It never receives your name, email, or anything you type into a form. Analytics cookies are only set if you accept them, via the cookie banner or the “Cookie preferences” control shown in the footer of every page, on the basis of your consent (Art. 6(1)(a)) — you can withdraw that consent at any time through the same control, which stops future analytics collection. Google Analytics data is processed by Google under the EU–US Data Privacy Framework; retention follows our Google Analytics account configuration (see the retention schedule above).
We set no advertising or personalisation cookies, on Google Analytics or anywhere else.
5Processors and transfers
We use Supabase (database & auth, hosted in the EU — eu-central-1), Vercel (web hosting/CDN), Stripe (payments), Resend (transactional email delivery), Railway (model-pipeline compute), and — only for visitors who accept analytics cookies — Google (Google Analytics 4, anonymous acquisition analytics). Where a processor transfers data outside the EEA, transfers rest on the EU–US Data Privacy Framework or Standard Contractual Clauses.
6Your rights
You have the rights of access, rectification, erasure, restriction, portability, and objection (GDPR Arts. 15–21). Email hello@quantline.ai from your account address; we respond within 30 days. Deleting your account removes profile and position data on the schedule above — invoice metadata is retained for the statutory accounting period.
7Changes
We version this policy. Material changes are announced in-app before they take effect; the version and effective date are shown at the top of this page.