Privacy Policy

Last updated: June 21, 2026

1. Introduction

Welcome to Quantum Market Analyzer ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy describes how we collect, use, store, and share your information when you use our stock screening platform ("Service"). If you have any questions or concerns about this policy or our practices, please contact us.

2. Information We Collect

2.1 Personal Information

When you register for an account, we may collect:

Name
Email address
Password hash (we hash passwords, never store them in plain text)
Account preferences

2.2 Usage Data

We automatically collect information about your use of the Service:

IP address
Browser type and version
Pages viewed and features used
Time and date of visits
Device information

2.3 Financial Information

If you subscribe to a paid plan, payments and any applicable transaction taxes are processed by the Merchant of Record identified at checkout and on your transaction documentation. We do not store your credit card information on our servers.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Process your transactions and manage your subscription
Send you updates, security alerts, and support messages
Respond to your inquiries and provide customer support
Improve and optimize our Service
Detect and prevent fraud and abuse
Comply with legal obligations

3.1 Data Controller & Legal Basis (GDPR Art. 6)

Data controller: Jaroslav Vojtášek, a Czech sole trader (OSVČ), IČO 48783447 — the operator of Quantum Market Analyzer (the "Provozovatel" identified in Section 12 of our Terms of Service). Contact: [email protected].

EU establishment & DPO. The controller is established in the European Union (Czech Republic), so no EU Article 27 representative is required. We have not appointed a Data Protection Officer, as our processing does not meet the mandatory thresholds in GDPR Article 37 (we are not a public authority and do not carry out large-scale monitoring or large-scale processing of special-category data). For any privacy request or question, the controller can be reached directly at [email protected].

Where the GDPR (Regulation (EU) 2016/679) applies, we process personal data on these legal bases:

Performance of a contract (Art. 6(1)(b)) — to create your account, provide the Service, and process your subscription.
Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, service improvement, and direct communications, balanced against your rights.
Consent (Art. 6(1)(a)) — for optional cookies/analytics and marketing emails; you may withdraw consent at any time.
Legal obligation (Art. 6(1)(c)) — accounting, tax, and responding to lawful requests.

4. Information Sharing and Sub-Processors

4.1 Named Sub-Processors (GDPR Article 28)

We engage the following processors to operate the Service. Each is bound by a Data Processing Agreement and processes personal data only on our documented instructions:

Neon Database (Neon, Inc.) — PostgreSQL hosting, EU region (Frankfurt). Stores account data, portfolios, watchlists, journal entries.
Railway (Railway Corp., US) — Application hosting and serverless runtime.
Merchant of Record — Payments, subscriptions, invoicing and VAT/sales-tax collection for paid plans are handled by the Merchant of Record (the seller of record) identified at checkout and on your transaction documentation. The Merchant of Record handles checkout, payment and invoicing under PCI-DSS and provides invoices and a customer portal directly to you. We do not store card data. The specific Merchant of Record and its jurisdiction are disclosed at the point of purchase.
Anthropic (Anthropic, PBC, US) — Claude AI model for analytical commentary (deep analysis, portfolio risk analysis, earnings summaries). Anonymized prompt context only; we do not transmit identifying personal data.
OpenAI (OpenAI, LLC, US) — Backup AI provider. Same anonymization policy as Anthropic.
Resend (Resend, Inc., US) — Transactional email delivery (account verification, alerts, payment receipts).
Third-party market-data providers — professional market-data providers that supply prices, fundamentals and related market data. No personal data shared; only public stock symbols are requested.
Google (Google LLC, US) — OAuth sign-in (optional). Only when the user explicitly chooses "Sign in with Google".

4.2 International Data Transfers (Schrems II)

Some of our sub-processors (Anthropic, OpenAI, Resend, Railway, Google, and — depending on jurisdiction — the Merchant of Record identified at checkout) are based in the United States. Transfers of personal data to these processors are protected by:

EU-U.S. Data Privacy Framework (DPF) certification where available, OR
Standard Contractual Clauses (SCCs) as adopted by the European Commission (Commission Implementing Decision 2021/914), with additional supplementary measures as required by Schrems II (Case C-311/18).

Primary application data (accounts, portfolios) is stored exclusively in the EU (Frankfurt) with Neon Database. US-based processors only receive transient task-specific data (e.g., an anonymized prompt for AI commentary, an email address for delivery).

4.3 Other Disclosures

Legal Compliance: When required by law (court order, regulatory request) or to protect our rights and the safety of others.
Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

We DO NOT sell your personal information to third parties. We do not use your data to train our own AI models, and we use AI processors under terms that do not train their models on our inputs.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of data in transit and at rest
Secure password hashing
Periodic security reviews and automated dependency monitoring
Access controls and authentication

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Personal-data breach notification. If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (in the Czech Republic, the Office for Personal Data Protection / ÚOOÚ) without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with GDPR Articles 33 and 34. Where the breach is likely to result in a high risk to you, we will also inform you without undue delay.

6. Data Retention

We keep personal data only as long as needed for the purpose it was collected. The table below sets out our retention periods by category:

Account data (name, email, preferences, portfolios, watchlists, journal) — kept while your account is active; deleted within 30 days of account deletion (except items below).
Billing & tax records (invoices, transaction records) — retained by us and/or the Merchant of Record for up to 10 years as required by accounting and tax law (Czech Act on Accounting / VAT rules).
Support communication (emails, tickets) — kept for up to 24 months after the issue is resolved.
Security & access logs (IP address, device, event logs) — kept for up to 12 months for fraud prevention and security, then deleted or anonymized.
Backups — deleted-account data may persist in encrypted, off-site backups for up to 90 days before being overwritten on the normal backup rotation.
Analytics events (consent-based product analytics) — retained in aggregated/pseudonymized form for up to 14 months.

You may request deletion of your account at any time by contacting us. We may retain the minimum information necessary to comply with legal obligations, resolve disputes, or enforce our agreements, even after you close your account.

7. Your Rights (GDPR / UK GDPR / California)

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR):

Right to Access: Request a copy of your personal data
Right to Rectification: Request correction of inaccurate data
Right to Erasure: Request deletion of your data ("right to be forgotten")
Right to Restrict Processing: Request limitation of how we use your data
Right to Data Portability: Request transfer of your data to another service
Right to Object: Object to processing of your data
Right to Withdraw Consent: Withdraw consent for data processing

To exercise these rights, please contact us using the information provided below.

Right to lodge a complaint. You have the right to complain to a data-protection supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. EEA users may also contact the authority in their country of residence.

UK users (UK GDPR): the same rights apply and you may complain to the UK Information Commissioner's Office (ICO, ico.org.uk). California residents (CCPA/CPRA): you have the right to know, delete, and correct personal information and to opt out of "sale"/"sharing" — note that we do not sell or share your personal information, and we do not discriminate against you for exercising your rights.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to:

Remember your login session
Understand how you use our Service
Improve user experience

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

9. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies.

10. Children's Privacy

Our Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Your continued use of the Service after any changes indicates your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Ready to get started?

⚠️ Important Notice: QMA is an analytical and educational tool, not investment advice. Scores, detections and ratings are descriptive, not buy/sell instructions. QMA is not a registered investment advisor (SEC / FINRA / MiFID II / ČNB). Consult a licensed financial advisor before any investment. Past performance does not guarantee future results; all investments carry the risk of capital loss.

Operator: Jaroslav Vojtášek · IČO: 48783447 · Place of business: U Jízdárny 577, 747 64 Velká Polom, Czech Republic · Register: Sole trader registered in the Czech Trade Licensing Register · E-mail: [email protected]