Privacy Policy

1. Account and research information

We store your email address, optional name, account identifier, verification and access dates, plan and credit balance. Passwords are stored as salted cryptographic hashes. We do not store the password itself.

We store uploaded files and dataset metadata, job inputs and progress, generated strategies, metrics, favourites and saved results. Reproducibility records can include the dataset version, fingerprint and engine revision. Only upload data you are entitled to use; avoid unnecessary personal information.

2. Why information is used

Account and research records are used to provide the service you request: authenticate you, process jobs, preserve results and administer your plan. Security logs and request limits help prevent abuse and investigate errors. These activities rely on performance of our agreement with you or legitimate interests in protecting the service, as appropriate.

Billing records are used to administer subscriptions and meet applicable accounting obligations. We use your email for verification, password recovery and support. We do not sell personal information or use research datasets for behavioural advertising.

3. Providers and information they receive

OpenAI Sites provides the hosting platform. Cloudflare provides application execution, the database, file storage, queues and real-time delivery. These services process the account and research information required to run QSL. Queue messages carry job identifiers and execution metadata rather than the uploaded dataset contents.

Resend delivers account verification and password recovery emails and receives the recipient address and message content. Support correspondence is handled through the support mailbox hosted by Porkbun; information you email is also processed by that email provider.

When online subscriptions are enabled, Stripe processes checkout and subscription information. QSL receives customer and subscription identifiers, status, billing periods and plan information. Full payment-card details are entered with the payment provider, not stored in the QSL application database.

4. Cookies, preferences and live updates

The necessary qsl_session cookie is HttpOnly, Secure and SameSite=Lax, with a seven-day lifetime. It is cleared on sign-out. The browser stores language, table-column and sidebar preferences locally. Plan selection is carried through registration and the email verification link so it can be shown in billing.

Live progress uses a short-lived signed connection ticket and an account-specific channel. Notifications signal that research state has changed; they do not broadcast your raw dataset to other accounts. Operational records may contain IP address, request counts, timestamps and audit actions.

5. Retention and deletion

Account and research records are retained so your saved work remains available. Datasets, jobs, results and favourites are not deleted automatically; eligible jobs and unlinked uploaded datasets can be deleted manually in the application. Routine diagnostic audit records may be deleted after 90 days, while registration, administrator, consent, billing and necessary security records may be retained longer. Account closure and deletion requests are handled through support; tell us whether you want a copy of your information before deletion.

Session validity is seven days. Verification links expire after 24 hours and recovery links after 30 minutes under the current configuration. A completed password reset invalidates earlier sessions. Token expiry does not itself delete account records. Necessary billing, dispute or security records may be retained separately where an applicable obligation or justified need requires it.

6. Processing locations and security

QSL is operated from Ireland, but the infrastructure and email providers use distributed services. Processing is not restricted by this application to Ireland or the European Economic Area. Contact support for information about applicable provider locations and international-transfer arrangements.

Application controls include account-based access restrictions, encrypted HTTPS connections, password hashing, signed session tokens, request limits and file validation. Access to private research is restricted to the relevant account and authorised operational access. No service can guarantee absolute security.

7. Your choices and rights

You can request access, correction, deletion or a copy of your personal information; object to processing based on legitimate interests; or request restriction where applicable. We may need to verify your identity. Send requests to support@quantstrategylab.app without including passwords or recovery links.

You can also complain to the Irish Data Protection Commission at dataprotection.ie or the appropriate supervisory authority. QSL is intended for adults aged 18 or over. We will update this notice when our handling of information changes.

8. Product measurement, feedback and your controls

We measure registrations, verification, research attempts and outcomes, credit blocks, exports, subscriptions and returns to the product to identify friction and improve QSL. Minimal server activity uses the account identifier, event time, plan, environment and technical outcome under our legitimate interest in understanding and improving the service. We exclude administrator accounts from adoption metrics. This measurement does not determine prices, access or trading decisions. You can object using Privacy choices or by contacting support.

Optional browser analytics runs only after your consent. It records allowed page names and interactions, language, broad device category, campaign tags and referring domain. It does not capture session recordings, typed forms, full URLs or query strings, passwords, email addresses, uploaded data or strategy contents. The qsl_analytics cookie is Secure, HttpOnly and SameSite=Lax and lasts up to 180 days. When declined, it remembers that choice without an analytics identifier. You may accept, reject or withdraw at any time through Privacy choices. Refusal does not prevent service, feedback or eligible rewards. We use our existing hosting database, with no added advertising pixels or external analytics provider.

Consented visits can be linked to your account after sign-in. Campaign attribution uses the first contact in the 30 days before registration and a separate last non-direct contact; your declared discovery source remains separate. We use these measurements to compare content and campaigns, not to build advertising audiences. Signing out rotates the browser identifier. The browser also stores whether a voluntary feedback invitation has appeared in the current session to avoid repeated prompts.

Private survey answers and comments are linked to your account, survey version, plan, time, any displayed price and reward. We process your requested submission and reward under the agreement for that optional programme, and analyse feedback under our legitimate interest in improving the service. Authorised administrators can review, categorise and export this information. An optional permission to follow up concerns that comment only; it is not marketing consent or permission to publish it. Do not include sensitive personal, financial-account or research data in free text.

Automatic maintenance removes raw analytics after 90 days, survey answers, comments and individual milestones after 12 months, and anonymous daily aggregates after 24 months. Deletion runs in bounded batches. Expired consent identifiers are removed within 90 days after expiry; related attribution is removed with them. Minimal offer-redemption and credit records remain for the life of the account to enforce one-time rewards and explain the balance; necessary accounting, dispute or security records may be retained separately. Deleting a survey answer does not make its reward claimable again.

In Privacy choices, signed-in users can stop measurement and erase linked analytics and attribution. This does not erase research, feedback, the credit ledger or anonymous aggregates. Contact support to request access, correction, objection, restriction, a copy or deletion of other personal data; necessary records and aggregate statistics are handled separately as explained above. Withdrawal does not affect earlier lawful processing. Public-review links do not send your email or feedback to Trustpilot; opening an external link makes a request to that provider, governed by its own privacy notice. No external review is opened by the staging demonstration.

Welcome bonus

We keep the account, welcome day, amount and claim time in the credit ledger to provide the requested bonus, prevent duplicate claims and explain the balance. Claiming does not require analytics or marketing consent.

9. Optional promotional emails

If you separately opt in, Quant Strategy Lab may use your verified account email to send its own promotions, discounts and special offers. The basis is your consent. The signup checkbox is optional and unchecked by default. Your choice takes effect only after email verification. Signing in does not change it. Login, research, analytics choices and feedback rewards do not depend on subscribing.

You can withdraw consent at any time in Privacy choices or by contacting support@quantstrategylab.app. Every promotional email must also provide an opt-out. Withdrawal stops promotional emails; necessary account, security and billing messages are handled separately. We record the account, verified email, choice, time, language, source, consent version and displayed wording to demonstrate consent and honour withdrawals. These limited records are retained for the lifetime of the account and deleted when the account is deleted, unless a specific legal retention obligation applies. We do not give other businesses permission to market to you through this choice.