Privacy Policy

1. Who We Are

QuantML acts as the Data Controller for the personal data described in this Policy.

QuantML Limited is not currently required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. Data protection queries should be directed to us at the contact details above.

2. What Personal Data We Collect

We collect only the personal data necessary to operate and improve the Services.

3. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the Services
• Authenticate users and manage accounts
• Deliver analytics, dashboards, signals, and reports
• Process subscriptions and payments
• Improve performance, reliability, and security
• Comply with legal and regulatory obligations
• Communicate service updates, security notices, or support responses
• Personalise user experience and deliver relevant content

We do not sell your personal data to third parties.

4. Legal Bases for Processing (GDPR)

We process personal data under the following lawful bases:

• Contractual necessity – to provide the Services you have signed up for
• Consent – where you have explicitly agreed (e.g. marketing communications, certain cookies)
• Legitimate interests – improving and securing our platform, preventing fraud, and understanding user behaviour
• Legal obligations – compliance with applicable laws and regulations

Where we rely on legitimate interests, we have conducted and documented an internal Legitimate Interests Assessment (LIA) to balance those interests against your rights and freedoms. You may object to processing based on legitimate interests by contacting us.

5. Marketing Communications

Where you have provided consent, QuantML may send product updates, platform announcements, newsletters, and marketing communications.

You may unsubscribe at any time using the unsubscribe link contained within such communications or by contacting quantml@quantml.ai.

We do not send marketing communications without an appropriate lawful basis.

6. Cookies and Tracking Technologies

QuantML uses cookies and similar technologies to provide functionality, improve user experience, and understand how the Services are used.

Analytics and marketing cookies are used only where you have provided consent through our cookie management tools.

You may manage cookie preferences through our cookie banner or your browser settings. Disabling certain cookies may affect platform functionality.

For more information, please see our Cookie Policy.

7. Third-Party Services

We may use trusted third-party providers for:

• Hosting and infrastructure (e.g. cloud hosting providers)
• Payments and subscriptions (Stripe — we have a Data Processing Agreement in place with Stripe, Inc.)
• Email communications (Resend — we have a Data Processing Agreement in place with Resend)
• Product analytics (PostHog — analytics are consent-gated; PostHog is initialised and may set cookies/local storage only after you grant analytics consent, and captures pageviews plus selected product events for platform improvement)
• Brokerage or market-data integrations (e.g. Alpaca, where enabled by you)
• Customer support and communications

These providers process data under contractual confidentiality and data-protection obligations, including Data Processing Agreements where required by GDPR, and are prohibited from using your personal data for any other purpose.

QuantML is not responsible for the privacy practices of third-party platforms you choose to connect. We encourage you to review their privacy policies.

Data shared with third parties is limited to what is necessary for the specific service or integration.

8. Data Retention

We retain personal data only for as long as necessary to:

• Provide the Services and maintain your account
• Meet legal, accounting, tax, or regulatory requirements
• Resolve disputes, enforce agreements, or protect our legal rights

The following table sets out our standard retention periods by data type:

You may request deletion of your account and associated data at any time by contacting us. We will retain and use your data as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

9. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorised access, alteration, disclosure, or destruction, including:

• Secure hosting environments with TLS/SSL encryption
• Role-based access controls and multi-factor authentication
• Encrypted connections (HTTPS) for all data transmissions
• Encrypted storage of sensitive credentials and API keys
• Regular security assessments and monitoring
• Staff training on data protection and confidentiality

However, no internet-based system is completely secure. While we strive to protect your data, we cannot guarantee absolute security. You use the Services at your own risk.

For more details, see our Cybersecurity Policy.

10. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of access – request a copy of your personal data
• Right to rectification – request correction of inaccurate or incomplete data
• Right to erasure – request deletion of your data ("right to be forgotten")
• Right to restrict processing – request limitation of how we use your data
• Right to data portability – receive your data in a structured, machine-readable format
• Right to object – object to certain types of processing (e.g. direct marketing)
• Right to withdraw consent – withdraw consent at any time where processing is based on consent

To exercise your rights, contact us at quantml@quantml.ai. We will respond within one month, subject to applicable extensions.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.

11. International Data Transfers

Your data may be transferred to, stored, or processed in countries outside the European Economic Area (EEA), including the United States.

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other legally authorised transfer mechanisms

Contact us at quantml@quantml.ai for more information about specific transfers and safeguards.

12. Children's Privacy

QuantML is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

If we become aware that we have collected personal data from a minor without parental consent, we will take steps to delete that information.

13. Automated Processing and Machine Learning

QuantML uses proprietary machine learning and statistical models to generate investment signals, portfolio analytics, rankings, confidence scores, and related research outputs.

These outputs are provided as informational and analytical tools only. QuantML does not make automated decisions on the basis of personal data that produce legal effects or similarly significant effects on users within the meaning of Article 22 of the General Data Protection Regulation (GDPR).

Users remain solely responsible for evaluating information provided by the Services and for making their own investment decisions and trade execution choices.

QuantML does not use personal data to make automated decisions relating to eligibility, creditworthiness, employment, insurance, or other matters that may significantly affect individuals.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make changes, we will update the "Last Updated" date at the top of this Policy. If we make material changes, we may notify you through the Services or by email.

Continued use of the Services after the effective date of the updated Policy constitutes acceptance of the changes. For material changes, we will seek fresh consent where required by applicable law.

15. Contact Us

For privacy-related questions, requests, or concerns, or to exercise your data protection rights, please contact us:

We will respond to your request within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie.