Privacy Policy

Last updated: February 2026

This Privacy Policy explains how QuanterLab ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our platform at quanterlab.com. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Data Controller

Serhat Girgin
QuanterLab
Germany
Email: privacy@quanterlab.com

2. Data We Collect

2.1 Account Data

When you register for an account, we collect:

• Email address
• Password (stored as a bcrypt hash; we never store or have access to your plaintext password)
• Account creation date
• Email verification status

2.2 Payment Data

If you subscribe to a paid plan, our payment processor (Stripe) collects:

• Name and billing address
• Payment card details (processed and stored exclusively by Stripe; we never see or store your full card number)
• Transaction history and subscription status

2.3 Platform Usage Data

As you use QuanterLab, we store:

• Strategy configurations and backtest parameters
• Paper trading instances and trade logs
• Portfolio compositions and settings
• Saved reports and analysis results

This data is stored exclusively to provide the service and is associated with your account.

2.4 Technical Data

Our servers automatically collect:

• IP address
• Browser type and version
• Pages visited and timestamps
• Referring URL

This data is collected via server access logs and is used solely for security monitoring and debugging.

3. Legal Basis for Processing

Data Category	Legal Basis (GDPR)	Purpose
Account data	Art. 6(1)(b) — Contract performance	Required to provide the service
Payment data	Art. 6(1)(b) — Contract performance	Processing subscription payments
Platform usage data	Art. 6(1)(b) — Contract performance	Storing your strategies, portfolios, and trades
Technical data	Art. 6(1)(f) — Legitimate interest	Security, fraud prevention, and debugging
Email communications	Art. 6(1)(b) — Contract performance	Transactional emails (verification, password reset)

4. Third-Party Processors

We share personal data only with the following processors, each bound by data processing agreements:

Processor	Purpose	Data Shared	Location
Railway (Hosting)	Application hosting and database	All platform data	US / EU
Stripe	Payment processing	Name, email, billing info	US (EU SCCs)
Email provider (SendGrid/Mailgun)	Transactional emails	Email address	US (EU SCCs)
Financial Modeling Prep (FMP)	Market data API	None (API key only, no user data)	US

Where data is transferred outside the EU/EEA, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

5. Data Retention

• Account data: Retained for the duration of your account. Upon account deletion, personal data is removed within 30 days.
• Payment records: Retained for 10 years after the last transaction, as required by German tax law (Section 147 AO, Section 257 HGB).
• Platform usage data: Deleted within 30 days of account closure.
• Server logs: Automatically purged after 90 days.

6. Your Rights

Under the GDPR, you have the right to:

• Access — Request a copy of all personal data we hold about you (Art. 15)
• Rectification — Correct inaccurate personal data (Art. 16)
• Erasure — Request deletion of your personal data ("right to be forgotten") (Art. 17)
• Restriction — Restrict processing of your data (Art. 18)
• Data portability — Receive your data in a structured, machine-readable format (Art. 20)
• Objection — Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, email us at privacy@quanterlab.com. We will respond within 30 days.

7. Cookies

We use only essential cookies required for the platform to function. We do not use advertising, tracking, or analytics cookies. For details, see our Cookie Policy.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data is transmitted over HTTPS/TLS encryption
• Passwords are hashed with bcrypt (never stored in plaintext)
• Database access is restricted and encrypted
• Regular security updates and monitoring

9. Children's Privacy

QuanterLab is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page reflects the most recent revision.

11. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our location is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de