Privacy Policy

1. Introduction

Quantly Technologies, Inc. ("Quantly," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (the "Service"). Please read this policy carefully.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Username and profile preferences
• Account preferences and settings
• Authentication credentials (your password is stored only as a salted one-way hash and is never stored in plain text)

Brokerage Data and Credentials

When you connect a brokerage account, we access and store:

• Brokerage account identifiers and connection metadata
• Encrypted brokerage API credentials or OAuth tokens required to execute your configured strategies
• Account balances, portfolio positions, trade history, and order data needed to operate the Service
• Market data used for strategy execution and display

We use brokerage credentials solely to provide the Service at your direction. We do not custody funds or securities. You can disconnect your brokerage account through the Service, which stops future access using stored credentials subject to our retention practices below.

Strategy Data

We store the trading strategies you create, including:

• Strategy logic and configuration parameters
• Backtest results and performance metrics
• Strategy deployment settings
• Imported or AI-generated strategy content you choose to save

Public and Community Information

If you make strategies public or enable track record sharing, information such as your username, strategy name, strategy logic, and performance metrics may be visible to other users through Explore, public profile pages, strategy pages, and related features.

Payment Information

Subscription payments are processed by Stripe. We receive billing identifiers, subscription status, and limited payment metadata from Stripe. We do not store full payment card numbers on our servers.

If you enroll in the Creator Partner Program and complete Stripe Connect onboarding, Stripe collects and processes information needed to pay bounties (such as identity, tax, and bank account details). We receive Connect account identifiers, onboarding status, payout status, and limited metadata from Stripe. We do not store full bank account numbers on our servers.

Referral and Partner Program Information

When you use referral links or codes, participate in our consumer referral discount program, or enroll in the invitation-only Creator Partner Program, we may collect and store:

• Referral codes and link parameters (for example, codes entered at signup or passed in a URL)
• The relationship between referrer and referred accounts, referral status, and qualification timestamps
• Creator program enrollment, invite acceptance records, and partner status
• Commission and bounty amounts, hold periods, void reasons, and payout batch status

We use this information to apply referral discounts, attribute signups, calculate and pay creator bounties, prevent abuse, and comply with tax and payout obligations.

Notifications and Integrations

If you configure notifications, we store your notification preferences and, at your direction, may transmit alerts to email addresses or third-party webhook URLs you provide (such as Discord webhooks).

AI Feature Data

If you use AI strategy generation, we process the prompts you submit and the generated output needed to provide the feature. Prompts are transmitted to OpenRouter, which routes them to a third-party AI model provider to generate the response.

AI Agent (MCP) Usage

If you connect an AI assistant or agent to Quantly through our MCP server, we record each tool call it makes to understand how the integration is used and to find and fix errors. This includes the tool name, the arguments sent (with credentials removed), whether the call succeeded, error messages, response time, the client application and AI model the agent reports, and the reason the agent gives for the call. These events are linked to your account and sent to PostHog. We do not send the data tools return, such as holdings, balances, or trade history.

Usage Information

• Log data (IP address, browser type, operating system)
• Pages visited, features used, and interactions with the Service
• Device information and unique device identifiers
• Product analytics events and client-side error reports

Automatically Collected Information

We may automatically collect certain information about your device and usage patterns, including:

• IP address and browser type
• Domain names and access times
• Referring website addresses
• Performance metrics related to your usage of the Service

When you view market data without signing in, we use Cloudflare Turnstile to distinguish human users from bots. Turnstile may process client-side signals such as IP address, browser user-agent, and TLS fingerprint. Cloudflare does not use this data to identify individuals.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Execute and manage your trading strategies
• Process trades through your connected brokerage account
• Authenticate your identity and secure your account
• Process subscriptions and billing
• Operate referral and creator partner programs, including attributing signups, applying discounts, calculating bounties, and processing payouts
• Send transactional emails and user-configured notifications
• Communicate with you about your account, updates, and support
• Improve and optimize the Service, including analytics and error monitoring
• Detect, prevent, and address technical issues, abuse, referral fraud, and security threats
• Comply with legal obligations

4. Information Sharing and Service Providers

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.

We may share information with service providers that help us operate the Service, including:

• Google Analytics — Website usage analytics
• Supported brokerage partners — Trade execution and related market data
• Tiingo — Market data such as prices, corporate actions, and company information. We request data by ticker symbol and do not send your personal information to Tiingo
• Stripe — Subscription billing and payment processing
• Stripe Connect — Creator partner identity verification, bank payout details, and bounty transfers (processed by Stripe)
• PostHog — Product analytics, client-side error reporting, and usage analytics for AI agent (MCP) tool calls
• Sentry — Server-side error monitoring and diagnostics
• Resend — Email delivery, delivery and bounce status, and link click measurement for waitlist invitations
• OpenRouter — AI strategy generation from user prompts, routed to third-party AI model providers
• Cloudflare Turnstile — Bot detection and abuse prevention
• Infrastructure providers — Hosting, database, caching, and related operations

Each provider processes information according to its own privacy policy and our instructions where applicable. We share only the information reasonably necessary for the relevant service.

Legal Requirements

We may disclose your information if required to do so by law, or in response to valid requests by public authorities (e.g., a court or government agency).

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the receiving entity honoring this Privacy Policy or providing equivalent protections.

5. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), encryption at rest for sensitive credentials, access controls, and regular security reviews.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may retain certain information as required by law or for legitimate business purposes, such as fraud prevention, billing records, security logs, and dispute resolution.

When you delete your account, we will delete or de-identify personal data within 30 days, except where retention is required by law, billing/tax obligations, or legitimate business purposes such as backup retention for a limited period.

Public content copied by other users, aggregated analytics, and information already disclosed publicly may persist in forms not reasonably linked to you after deletion.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Request deletion of your personal information
• Object to or restrict the processing of your personal information
• Data portability — receive a copy of your data in a structured format
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at [email protected].

8. Right to Deletion

Subject to certain exceptions, upon receiving a verifiable request from you, we will delete your personal information from our records and direct our service providers to do the same where applicable.

We may decline a deletion request when retention is necessary to:

• Complete the transaction for which the information was collected or perform a contract with you
• Detect, prevent, or investigate security incidents, fraud, or illegal activity
• Comply with a legal obligation or regulatory requirement
• Enable solely internal uses reasonably aligned with your expectations
• Exercise free speech or other rights provided by law

To request deletion, contact us at [email protected].

10. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. California Privacy Rights

If you are a California resident, California law may provide you with additional rights regarding our use of your personal information, including the right to request disclosure of the categories and specific pieces of personal information we have collected about you, and the right to request deletion of your personal information as described in Section 8.

Do Not Sell or Share. We do not sell personal information. We do not share personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended by the CPRA.

Under California's "Shine the Light" law (Civil Code Section 1798.83), California residents who provide personal information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us, once a year, information about the personal information we shared, if any, with other businesses for their own direct marketing uses. To make such a request, please contact us at [email protected].

12. GDPR and UK GDPR

If you are located in the European Economic Area, Switzerland, or the United Kingdom, the following additional information applies.

Legal bases. We process personal data where:

• necessary to perform our contract with you (providing the Service, billing, brokerage integration, referral discounts, creator partner payouts where applicable, and support);
• necessary for our legitimate interests (security, analytics, product improvement, fraud prevention) where not overridden by your rights;
• based on your consent where required (for example, optional marketing or non-essential cookies where applicable); or
• necessary to comply with legal obligations.

International transfers. We may transfer personal data to the United States and other countries where our service providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

Your rights. In addition to the rights in Section 7, you may have the right to lodge a complaint with your local supervisory authority. To exercise GDPR or UK GDPR rights, contact us at [email protected].

13. International Data Transfers

Your information may be processed in countries other than your own, including the United States. By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate, subject to applicable legal safeguards.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the new policy.

15. Contact

If you have questions about this Privacy Policy, please contact us at [email protected].