Privacy Policy

1. Who is responsible

RawQuant is the data controller for the personal data described here. For anything in this policy, email support@rawquant.com; it reaches the person responsible.

2. What we collect, and why

Each purpose below names its legal basis under the GDPR.

• Your account. Your email address and a password (stored only as a bcrypt hash), or your Google identity if you sign in that way. Needed to have an account at all. Basis: performance of a contract.
• Billing. Your Stripe customer ID, subscription status, and billing period dates. Stripe also gives us an anonymous card fingerprint, which we use for one thing only: making sure the $19 first month is used once per person. We never see or store card numbers, expiry dates, or bank details. Basis: performance of a contract, and a legal obligation for bookkeeping records.
• Your dashboard data. Your preferences (including the capital amount you type in) and, if you use the portfolio mirror, everything you enter there: positions, share counts, cash set aside, and your order receipts. This is synced to your account so your book follows you across devices. Basis: performance of a contract.
• Email alerts. RawQuant does not currently send signal alert emails. If we offer them, they will be opt-in, the setting will live in Settings, and the basis will be consent, which you can withdraw at any time.
• Security. Standard server logs (such as IP addresses) kept by our hosting providers to keep the service safe and prevent abuse. Basis: legitimate interest in running a secure service.

3. What we never collect

We never ask for and never store your brokerage credentials, and nothing on RawQuant connects to your brokerage account. The positions in your dashboard are numbers you typed in yourself. We will never sell, trade, or share your personal information with third parties for marketing purposes.

4. Where your data lives

Your data is stored in Supabase (a PostgreSQL database hosted in the EU, in Ireland). Data is encrypted in transit and at rest, passwords are hashed and never stored in plain text, and row level security ensures each user can only ever read their own rows.

5. Services we use

These providers process data on our behalf or receive requests directly from your browser:

• Stripe: payment processing on Stripe's own hosted pages (privacy policy)
• Supabase: authentication and database (privacy policy)
• Vercel: hosting, and anonymous, cookieless visit counting (no cookies, no cross-site identifiers, no individual profiles) (privacy policy)
• Cloudflare: the bot check on the sign-in and sign-up forms (Turnstile) runs in your browser and sends Cloudflare the usual request data, such as your IP address and browser characteristics (privacy policy)
• Resend: delivers the account emails we send you, such as the sign-up confirmation and password reset; each message is addressed to you alone, and Resend receives your email address and the message (privacy policy)
• TradingView: the price charts in the dashboard load from TradingView's servers, so your browser sends them the usual web request data, such as your IP address and the ticker being charted (privacy policy)
• GitHub: ticker logo images load from GitHub (privacy policy)

6. Transfers outside the EU

Some of these providers are US companies. Stripe, Vercel, Cloudflare, and Resend are certified under the EU-US Data Privacy Framework. Supabase keeps your data in Ireland and relies on the EU Standard Contractual Clauses in its data processing agreement for any access from outside the EU. Where a transfer is not covered by the framework, it relies on the Standard Contractual Clauses included in the provider's data processing agreement.

7. How long we keep it

• Account, preferences, and mirror data: until you ask us to delete your account, after which it is removed.
• Billing records: seven years, as bookkeeping law requires.

8. Your rights

Under the GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Have your data deleted, including your whole account
• Export your data in a portable format
• Restrict or object to processing
• Withdraw any consent at any time, without affecting processing that happened before

To exercise any of these, email support@rawquant.com from the address on your account; there is no button for it yet, so a short email is the way. You also have the right to lodge a complaint with your data protection authority.

9. Cookies and local storage

RawQuant sets no cookies of its own. Your sign-in token and your dashboard settings are kept in your browser's local storage, which stays on your device. Third parties may set their own cookies when your browser talks to them: TradingView when a chart loads, Cloudflare for bot protection, and Stripe or Google on their own pages during checkout or sign-in.

10. No automated decisions about you

The machine learning model picks stocks; it makes no decisions about you. We do no profiling and make no automated decisions that have legal or similarly significant effects on users.

11. Age

RawQuant is for adults. The service is not directed at anyone under 18, and we do not knowingly collect data from children.

12. Changes and contact

If this policy changes materially, we will note it here and update the date at the top. Questions? Email support@rawquant.com.