Privacy Policy
QuantX AI LLC
Last updated: July 17, 2026
Effective date: July 21, 2026
1. Overview
QuantX AI LLC ("QuantX," "we," "us") operates a behavioral analytics platform for traders. This policy explains what we collect, why, who we share it with, and what control you have.
Contact: enzo@quantx.digital
Address: 1230 NE 81 Terrace, Miami, Florida 33138
Scope. This policy covers quantx.digital, app.quantx.digital, and the QuantX Service.
Who this is for. The Service is offered to users in the United States and is not directed to residents of the European Economic Area or United Kingdom. It is not directed to anyone under 18.
Read this part. QuantX is unusual: the Service works by collecting detailed information about how you think and behave — your reflections, your emotional states, your patterns under pressure. This is more personal than most software collects. We've tried to describe it plainly rather than bury it.
2. What We Collect
2.1 You give us
Account information
- Email address
- Password (stored as a cryptographic hash — we never see it)
- Name, if you provide one
Payment information
- Handled entirely by Stripe. We never receive, process, or store your card number.
- We store a Stripe customer identifier, your subscription status and tier, and your billing history as reported by Stripe.
Consent records
- When you agree to a paid subscription with a free trial, we record the exact text you agreed to, the date and time, the plan and price, your IP address, and your browser's user agent. This is a legal record of your consent and is retained as described in Section 6.
Trading data
- Trades you import or enter: instruments, entries, exits, sizes, timestamps, outcomes, and related fields.
Connected account credentials
Where you connect an exchange or wearable account, we store the credentials needed to read from it:
- Exchanges: OKX, Kraken, Coinbase, Binance, and Bybit. Credentials are read-only. They cannot place trades, move funds, or initiate withdrawals. We receive your trade history and account balances. We do not receive personal account information such as your name, address, or identity documents held by the exchange.
- Wearables: WHOOP and Oura, for recovery and sleep data you choose to connect.
Exchange and wearable credentials are encrypted at rest under separate encryption keys, and are used solely to retrieve the data that powers the Service.
Journal and reflective content
- Structured session journals: intentions, emotional states, rule adherence, reflections.
- Free-form entries and annotations you write.
- Uploads you provide to TradeSeer AI, such as screenshots or documents.
Communications
- Emails you send us.
2.2 Generated automatically
Behavioral metrics and derived data
- Scores, indices, archetype classifications, reports, and other analysis computed from the data you provide.
Usage data
- Pages visited, features used, session timestamps, actions taken.
Technical data
- IP address, browser type and version, device type, operating system, referring URL.
Cookies and similar technologies
- See Section 8.
2.3 We do not collect
- Your card number, CVV, or full payment credentials. Stripe holds these.
- Your funds. We never hold, transmit, or have access to money or assets. Our exchange connections are read-only and cannot execute trades or initiate withdrawals.
- Government identifiers, biometrics, or precise geolocation.
3. Why We Collect It
| Purpose | Data used |
|---|---|
| Create and maintain your account | Account info |
| Provide the Service — metrics, archetypes, reports, AI features | Trading data, journal content, derived data |
| Retrieve your trades, balances, and recovery data from connected accounts | Connected account credentials (read-only exchange and wearable) |
| Process payments and manage subscriptions | Payment info via Stripe |
| Prove consent in a payment dispute | Consent records |
| Send transactional email (trial reminders, receipts, security notices) | Account info |
| Respond to support requests | Communications |
| Detect fraud, abuse, and duplicate trials | Technical data, payment identifiers |
| Debug, secure, and improve the Service | Usage and technical data |
| Comply with law | As required |
We do not sell your personal information. We do not share it for cross-context behavioral advertising.
4. Who We Share It With
We share personal information only with service providers who need it to operate the Service, and only for that purpose.
Our service providers
Stripe, Inc. — payment processing
Receives: your email, payment details you enter directly with them, transaction records.
Governed by Stripe's own privacy policy.
Supabase — database and authentication
Stores: essentially all Service data, including trading data and journal content, encrypted at rest.
Vercel — hosting and delivery
Processes: technical data, request logs.
Anthropic, PBC — AI processing
Receives: the content necessary to generate AI features, which may include your trading data and journal content. Governed by Anthropic's commercial terms and privacy policy.
Resend — transactional email
Receives: your email address and message content for transactional email (trial reminders, receipts, security notices).
Exchanges — OKX, Kraken, Coinbase, Binance, Bybit — trading data source
Where you connect an exchange, we use your read-only credentials to retrieve your trade history and account balances. These credentials cannot place trades, move funds, or initiate withdrawals.
Wearables — WHOOP, Oura — recovery and sleep data source
Where you connect a wearable, we use your credentials to retrieve the recovery and sleep data you choose to connect.
Other disclosures
Legal. We may disclose information if required by law, subpoena, or court order, or where we believe in good faith it is necessary to protect our rights, your safety, or the safety of others.
Business transfer. If QuantX is acquired, merged, or sells substantially all assets, your information may transfer to the acquirer, subject to this policy or a successor policy with materially equivalent protections.
Aggregated or de-identified data. We may share data that cannot reasonably identify you.
We do not share your information with advertisers, data brokers, or marketing partners.
5. Where It's Stored and How It's Protected
Location. Data is stored on infrastructure operated by Supabase and Vercel, primarily in the United States.
Security measures include:
- Encryption in transit (TLS) and at rest
- Connected account credentials (exchange and wearable) encrypted at rest under separate encryption keys
- Row-level security restricting every record to its owner
- Password hashing
- Access controls and audit logging
- Regular security review
No card data. We never store card numbers. Stripe is PCI-DSS Level 1 certified.
No fund access. Exchange connections are read-only. We cannot execute trades, move funds, or initiate withdrawals.
The limit of any security claim. No system is perfectly secure. We work to protect your information but cannot guarantee absolute security. You are responsible for your password and for notifying us of suspected unauthorized access.
Breach notification. If a breach affecting your personal information occurs, we will notify you as required by applicable law, including Florida Statutes § 501.171.
6. How Long We Keep It
| Data | Retention |
|---|---|
| Account and Service data | Until you delete your account |
| After account deletion | Purged within 30 days |
| Backups | Purged on the backup rotation cycle, up to 90 days |
| Payment records | As required by tax and financial regulation, typically 7 years (held by Stripe and by us) |
| Consent records | 7 years — retained as dispute and regulatory evidence, and retained even after account deletion |
| Support communications | 3 years |
Why consent records survive deletion. A consent record proves what you agreed to and when. Deleting it would destroy the evidence that protects both of us in a payment dispute. It contains only your consent event — not your trading data or journal content.
7. Your Choices and Rights
Access and export. Export your data from your account settings at any time.
Correction. Edit your account information in settings. Note that some content is intentionally immutable by design — journal entries and annotations cannot be edited after they are closed, because their value depends on being an unrevised record of what you wrote. You can delete them.
Deletion. Delete your account from your settings. This is self-serve — you do not need to email us.
On deletion:
- Your trading data, journal entries, annotations, archetypes, reports, and derived data are permanently deleted within 30 days
- Deleting an entry also deletes data derived from it
- Backups purge on their rotation cycle (up to 90 days)
- Payment records and consent records are retained as described in Section 6
Marketing email. We currently send only transactional email. If we introduce marketing email, it will include an unsubscribe link.
Cookies. See Section 8.
California residents
Under the CCPA/CPRA you have the right to know what we collect, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit use of sensitive personal information, and to be free from discrimination for exercising these rights.
Exercise these rights through your account settings or by emailing enzo@quantx.digital. We will verify your identity through your account credentials. We respond within 45 days, extendable by 45 more with notice.
Sensitive personal information. Some of what you write in QuantX — reflections on your emotional state, for instance — may qualify as sensitive personal information under California law. We use it only to provide the Service you asked for, and for no secondary purpose.
Other states
Several US states have comprehensive privacy laws granting similar rights. We honor equivalent requests from residents of any US state regardless of applicability thresholds.
8. Cookies
We use:
Strictly necessary cookies — authentication and session management. The Service cannot function without them.
Preference cookies — remembering your settings.
Most browsers let you block cookies. Blocking strictly necessary cookies will prevent you from logging in.
Do Not Track. We do not currently respond to DNT signals, as no common standard exists.
9. Children
The Service is not directed to anyone under 18 and we do not knowingly collect information from minors. If we learn we have, we will delete it. If you believe a minor has provided us information, contact enzo@quantx.digital.
10. International Users
The Service is intended for United States users and our infrastructure is located in the United States. We do not target the EEA or UK.
If you access the Service from outside the United States, you do so on your own initiative and consent to the transfer and processing of your information in the United States, which may have different data protection laws than your country.
11. Changes
We may update this policy. Material changes will be notified by email to your registered address and by notice in the Service at least 30 days before taking effect. The "last updated" date always reflects the current version.
12. Contact
QuantX AI LLC
1230 NE 81 Terrace
Miami, Florida 33138
enzo@quantx.digital