This Privacy Policy explains how QuanterLab ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our platform at quanterlab.com. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).
Paid plans are sold through Stripe's Managed Payments service: Stripe, through its checkout Link, is the seller of record for your purchase and processes your payment details. We never receive or store your card details. See sections 2.1 and 4a.
QuanterLab UG (haftungsbeschränkt)
Jurastraße 27/1
72072 Tübingen
Germany
Registergericht: Amtsgericht Stuttgart, HRB 807236
Represented by the managing director (Geschäftsführer): Serhat Girgin
Email: contact@quanterlab.com
The company replaced the founder as data controller upon its entry in the commercial register; nothing about what data is collected, stored or shared changed with that transition. See the Impressum for the full registration details.
Because of the limited scale and nature of the processing carried out, no Data Protection Officer is required under Art. 37 GDPR / §38 BDSG. All data-protection inquiries are handled directly by the controller at the email address above.
When you register for an account, we collect:
As you use QuanterLab, we store:
This data is stored exclusively to provide the service and is associated with your account.
Our servers automatically collect:
This data is collected via server access logs and is used for security monitoring, abuse prevention and debugging, and for readership statistics: how many distinct clients read a page, from which referring site, from which country and from what kind of network (a home or office line, a corporate proxy, a cloud host), derived from the address and the referrer in aggregate. For the last seven days we also look at the path of single visits: the pages and features one browser used on one day, in order, with the referring site, the country, the kind of network (a company's or university's own network by its registered name) and the device type. These visit paths carry no IP address or browser string, are not linked to any account or to other days, are seen only by us, and are deleted with the logs. No cookie is set for any of this. You can object at any time (Art. 21 GDPR) by writing to us.
| Data Category | Legal Basis (GDPR) | Purpose |
|---|---|---|
| Account data | Art. 6(1)(b) — Contract performance | Required to provide the service |
| Platform usage data | Art. 6(1)(b) — Contract performance | Storing your strategies, portfolios, and trades |
| Technical data | Art. 6(1)(f) — Legitimate interest | Security, abuse prevention, debugging, and readership statistics (Section 2.3) |
| Transactional email | Art. 6(1)(b) — Contract performance | Verification, password reset, service notifications |
| Research newsletter | Art. 6(1)(a), consent | Emailing new research and occasional platform news to subscribers who confirmed their sign-up |
| Sign in with Google | Art. 6(1)(b), contract performance | Providing the account you ask for, by the method you chose |
| Paid plans | Art. 6(1)(b), contract performance; Art. 6(1)(c), legal obligation | Performing the subscription contract, and keeping the records tax and commercial law require |
| Trial marks | Art. 6(1)(f), legitimate interest | Giving each person one free trial |
| Months of use | Art. 6(1)(f), legitimate interest | Counting the users the data licence is priced by |
We share personal data only with the following processors, each bound by a data processing agreement (Auftragsverarbeitungsvertrag) pursuant to Art. 28 GDPR:
| Processor | Purpose | Data Shared | Location / Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting and database | All platform data | Germany (Nuremberg) — EU/EEA, no third-country transfer |
| Anthropic PBC | AI assistant (“Quantin”) and the optional Claude connector (MCP) | The chat messages you send and the on-screen research context you submit — which may include your saved backtests, strategy configurations, portfolio holdings, tickers and profit/loss figures. Only sent when you use the assistant. On the public pages (“Ask about this paper” on a study, “Ask Quantin” on the front page), also without an account: the question you type and the text of the study on that page, only when you ask. We keep neither, and nothing that identifies you is sent with them. For the optional Claude connector: only when you connect Claude to your account, and only what the tools you ask it to run return: the published research papers, your own saved work (backtest lists, project names, summary metrics) and the summarised results of runs you ask it to start. No market data and no other user's data. | United States — transfer covered by EU Standard Contractual Clauses (SCCs) |
| OpenAI (OpenAI OpCo, LLC) | The optional ChatGPT plugin (MCP) | Only when you connect ChatGPT to your account, and only what the tools you ask it to run return: the published research papers, your own saved work (backtest lists, project names, summary metrics) and the summarised results of runs you ask it to start. No market data and no other user's data. | United States, transfer covered by EU Standard Contractual Clauses (SCCs) |
| Resend (Resend, Inc.) | Transactional email delivery (verification, password reset, trade and daily-digest emails) and the research newsletter | Email address and email content — including, for trade and portfolio digest emails, tickers, positions, prices and profit/loss figures | United States — transfer covered by EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework |
Where data is transferred outside the EU/EEA, we ensure adequate safeguards through EU Standard Contractual Clauses (SCCs) or, where applicable, the EU-US Data Privacy Framework. You may request a copy of the relevant safeguards by emailing us at contact@quanterlab.com.
Two services you may choose act as independent controllers of the data they handle, not as our processors:
| Service | When | What passes between us | Location / Safeguards |
|---|---|---|---|
| Google Ireland Limited (Sign in with Google) | Only if you choose to sign in with Google | Google confirms your e-mail address and an account identifier to us; Google learns that you signed in to QuanterLab | Ireland (EU); Google LLC in the United States under the EU-US Data Privacy Framework and SCCs |
| Stripe (Stripe Technology Europe, Limited / Stripe Payments Company) and its checkout Link | Only if you buy a paid plan | You give your payment details to Stripe directly; Stripe tells us your customer and subscription identifiers, your plan, its status and renewal date, and the e-mail you paid with | Ireland (EU) / United States under the EU-US Data Privacy Framework and SCCs |
Their own privacy policies apply to what they do with your data: policies.google.com/privacy and stripe.com/privacy (and link.com/privacy for Link).
Under the GDPR, you have the right to:
You can exercise the most common rights yourself, at any time, from Settings: Download my data gives you a complete, machine-readable copy of your personal data (Access and Portability), and Delete account erases it — your account is locked immediately and all data is permanently removed within 30 days.
You can manage or cancel a paid plan at any time from "Your plan" on QuanterLab, or at link.com with the e-mail you paid with.
To exercise any other right, email us at contact@quanterlab.com. We respond within 30 days as required by Art. 12(3) GDPR. Identification is verified through the email address associated with your account.
We use only strictly necessary cookies required for the platform to function (session, cookie consent acknowledgement). We do not use advertising, tracking, or analytics cookies. For details, see our Cookie Policy.
If you subscribe to our research newsletter, we email you when we publish new research, with occasional news about the platform. We add you only after you confirm: when you sign up we send you an email with a confirmation link, and nothing else is sent until you confirm (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR).
For the newsletter we store your email address, the time and IP address of your sign-up and of your confirmation, the wording and version of the consent you gave, and the site or link that brought you to the sign-up form, if any. Resend delivers the emails for us (see section 4).
Accounts created from 2 October 2026 can also join from the account: with the box “Email me new studies” when signing up, with one question we show once inside the platform a day later if the box was left empty, or with the switch in Settings. We send no separate confirmation email for these, because the address is already confirmed: a box ticked at sign-up takes effect when you click the verification link we send to your address, a sign-up with Google uses the address Google has confirmed, and a yes from a signed-in account takes effect at once. We keep the same consent record as above, plus where your yes came from (sign-up, the question inside the platform, or Settings). The Settings switch turns the newsletter off at any time, like the link in every issue, and does not affect your account. Accounts created before 2 October 2026 are not asked.
Links in the newsletter carry the label ref=newsletter, the same for every reader. It lets us count the visits that come from the newsletter; it does not tell us who clicked. We do not track whether you open our emails or which links you click.
You can unsubscribe at any time with the link at the end of every newsletter (one click is enough), or by writing to contact@quanterlab.com. Withdrawing your consent does not affect the lawfulness of the emails sent before.
A sign-up that is never confirmed is deleted after 14 days. When you unsubscribe, we keep your email address, marked as unsubscribed, together with the record of your consent, so that we can show the consent you gave and make sure no newsletter reaches you again.
Emails about your account (verification, password reset, your plan, and the trade and digest emails of your paper trades and portfolios) are part of the service, not marketing; see section 3.
We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR. The quantitative tools available on the platform operate on the market data and configurations you choose; they do not produce personal scores or rankings about you.
We implement appropriate technical and organizational measures to protect your data:
QuanterLab is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for our location is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de
You may also contact the supervisory authority of your habitual residence or place of work in the EU/EEA.