This document sets out what personal data we process about you, why, on what legal basis, how long we keep it, whom we share it with, and what rights you have. It is written to be understandable without legal training.

1. Who the data controller is

The controller of personal data is the sole trader operating the Quantum Market Analyzer service:

• Jaroslav Vojtášek — Czech sole trader (OSVČ)
• IČO: 48783447
• Place of business: U Jízdárny 577, 747 64 Velká Polom, Czech Republic
• Register: Sole trader registered in the Czech Trade Licensing Register
• Data-protection contact: [email protected]

You can exercise any of your rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) by e-mailing the address above. We respond within one month of receiving the request; in complex cases we may extend this by a further two months and will tell you if we do. There is no charge for handling an ordinary request.

The controller is established in the European Union (Czech Republic), so no Article 27 representative is required. We have not appointed a Data Protection Officer — we do not meet the mandatory thresholds in Article 37 GDPR (we are not a public authority and do not carry out large-scale systematic monitoring or large-scale processing of special-category data). Requests are therefore handled by the controller directly.

2. What data we process

2.1 Registration data

• name (optional) and e-mail address
• password hash — we never store a password in readable form
• account preferences, language, subscription and its status
• content you create yourself: watchlists, portfolios, trading journal, notes

2.2 Usage data

• IP address, browser type and version, device information
• pages viewed, features used, date and time
• security and error logs (where a sign-in came from, what failed in the app)
• the number of AI queries and analyses you run and our estimate of their cost — so we can keep the running budget under control and set plan limits fairly

2.3 Payment data

The seller is the operator; the payment is processed on our behalf by Stripe as our payment service provider, as stated at checkout and on your transaction documentation. Card details never reach us and we do not store them — from the seller we receive only the fact that payment succeeded, which plan it covers and until when.

3. Why we process data and on what legal basis

• Performance of a contract (Art. 6(1)(b) GDPR) — running your account, providing the Service, managing your subscription, customer support.
• Legitimate interests (Art. 6(1)(f) GDPR) — security, fraud and abuse prevention, technical diagnostics and service improvement, operational messages. Always balanced against your rights; you may object to this processing.
• Consent (Art. 6(1)(a) GDPR) — analytics cookies and marketing e-mails. Consent is voluntary and can be withdrawn at any time; withdrawal does not affect the lawfulness of processing before it.
• Legal obligation (Art. 6(1)(c) GDPR) — accounting, tax, responding to lawful requests.

We do not use automated decision-making or profiling producing legal effects concerning you. Our stock scores evaluate securities, not you.

4. Whom we share data with — named processors

Below we name every processor that receives personal data. Each one’s processing is governed by a Data Processing Agreement published by the provider and incorporated into the terms of the services we use; it may process only on our documented instructions.

4.1 Infrastructure, hosting and security

• Neon, Inc. — managed PostgreSQL database, EU region (Frankfurt). This is where the main application data lives: accounts, portfolios, watchlists, trading journal.
• Railway Corp. (USA) — application hosting and runtime (processes requests and operational logs).
• Cloudflare, Inc. (USA) — the network in front of the application: DNS, attack and bot protection, caching. It sees the IP address and request metadata of every visitor, including visitors who are not signed in. We name it explicitly for that reason, even though you never interact with it directly.

4.2 Payments

• Stripe (payment service provider) — payments, subscriptions, invoicing and VAT/sales-tax collection for paid plans. It runs checkout and payment under PCI-DSS, issues your invoice and provides a customer portal. The specific seller and its jurisdiction are disclosed at checkout and on your invoice.

4.3 Communication and sign-in

• Resend, Inc. (USA) — transactional e-mail delivery (account verification, alerts, payment confirmations, newsletter). It receives your e-mail address and the message content.
• Google LLC (USA) — Google sign-in (optional). It applies only if you choose "Sign in with Google"; we then receive your e-mail address, name and confirmation that the e-mail is verified.

4.4 Analytics

• PostHog (European region, provider PostHog, Inc., USA) — product analytics: which pages are read, where users drop off, what failed. It runs ONLY after you consent to analytics cookies — without consent the script is not even loaded. An anonymous visitor has no person profile; one is created only after sign-up. Data is stored in the EU.

Details of individual cookies are in the Cookie Policy.

4.5 AI model providers

We use AI for two distinct things and the data flows differently. The difference matters, so we describe them separately.

• Anthropic, PBC (USA), OpenAI, LLC (USA), Google LLC (USA — Gemini models) — on-demand analytical commentary (stock analysis, earnings-call summaries, portfolio risk analysis). We send only the content to be evaluated: the stock symbol, figures and scores, and — if you request a portfolio analysis — its composition. We do not send your name, e-mail or account identifier. We use these processors under terms under which our inputs are not used to train their models.
• OpenRouter, Inc. (USA — routing to DeepSeek models) — writing PUBLIC editorial content (magazine articles). This processor receives public editorial context only — a topic brief and text intended for publication. NO user data is sent to it: no e-mails, portfolios, watchlists, journals or identifiers. That is its only permitted use; if that scope were ever to widen, this document changes first.

Content produced by AI is labelled as AI-generated on the site.

4.6 Market-data providers

Prices, fundamentals and related market data come from data providers. Nothing personal is sent to them — only the public security symbol (for example "AAPL"). They are therefore not processors of personal data and are not named in this list. Data from public registries (SEC EDGAR, FINRA, 13F filings, FRED) is taken from publicly accessible sources.

4.7 Other disclosures

• Legal compliance — under a court order or a lawful authority request, or to protect our rights and the safety of others.
• Business transfer — in a merger, sale or transfer of the business, with prior notice to affected users.

We DO NOT sell your personal data and do not provide it to third parties for their own marketing. We do not train our own AI models on your data.

5. Transfers outside the EU/EEA

Some processors are established outside the European Economic Area, mostly in the United States: Railway, Cloudflare, Resend, Google, Anthropic, OpenAI, OpenRouter, the analytics provider PostHog and — for card payments — Stripe identified at checkout.

Every such transfer is safeguarded by at least one of the following:

• certification under the EU–U.S. Data Privacy Framework, where the processor holds one, or
• the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented by additional measures required by Schrems II (Case C-311/18) — in particular encryption in transit and at rest, and limiting transferred data to the necessary minimum.

What actually leaves the EU: the main application data (accounts, portfolios, watchlists, journal) is stored exclusively in the EU (Frankfurt, Neon) and analytics data in PostHog’s European region. Non-EU processors receive only the specific data needed for a given task — an e-mail address to deliver a message, an IP address to protect the traffic, the content to be evaluated for an AI commentary. No personal data is transferred to OpenRouter, only public editorial text.

On request we will provide a copy of the Standard Contractual Clauses used, or information about the specific safeguard applied to an individual processor, at [email protected].

6. Security

• encryption in transit and at rest
• secure password hashing (passwords are never stored readable)
• periodic security reviews and automated monitoring of vulnerabilities in the libraries we use
• access controls and authentication

No transmission over the Internet and no electronic storage is 100 % secure. We do what we can, but absolute security cannot be guaranteed.

Personal-data breach: if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority (in the Czech Republic the Office for Personal Data Protection) without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33 GDPR). Where the risk is high, we will also inform you without undue delay (Art. 34 GDPR).

7. How long we keep data

• Account data (name, e-mail, preferences, portfolios, watchlists, journal) — for as long as the account exists; deleted within 30 days of account closure (subject to the exceptions below).
• Accounting and tax records — kept by us for up to 10 years as required by accounting and VAT rules.
• Support communication — up to 24 months after the case is resolved.
• Security and access logs (IP address, device, events) — up to 12 months, then deleted or anonymised.
• Backups — data from a closed account may persist in encrypted backups for up to 90 days until overwritten by normal rotation.
• Analytics events (consent-based) — in aggregated or pseudonymised form for up to 14 months.

You may request deletion of your account at any time. We may retain only the minimum data necessary to meet a legal obligation, or to establish or defend legal claims.

8. Your rights

• Right of access — obtain a copy of the data we process about you.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability — receive your data in a machine-readable format.
• Right to object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — at any time, without affecting the lawfulness of earlier processing.

You exercise these rights by e-mailing [email protected]. Marketing e-mails can additionally be unsubscribed with one click directly in every message.

Right to lodge a complaint: you may contact a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. Users in other EEA states may contact the authority in their own country.

Users in the United Kingdom (UK GDPR) have the same rights and may contact the Information Commissioner’s Office (ico.org.uk). California residents (CCPA/CPRA) have the right to know, delete and correct, and to opt out of "sale"/"sharing" — we do not sell or share personal data, and we do not discriminate against anyone for exercising their rights.

9. Cookies

We use cookies and similar browser storage for sign-in, security and — only with your consent — analytics. The full overview including names, purpose and storage duration is in the Cookie Policy.

10. Third-party links

The Service may link to third-party websites. We are not responsible for their privacy practices — we recommend reading their own policies.

11. Children

The Service is not intended for persons under 18 and we do not knowingly collect their personal data. If you believe a child has provided us with data, please contact [email protected] immediately and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The new version will be published on this page together with the update date shown in the document header. We will notify you in advance of material changes — in particular a new processor or a new processing purpose — usually by e-mail.

13. Contact

For any data-protection question, contact the controller: [email protected].