Privacy Policy

We use the information we collect for various purposes, including:

• Service Provision: To provide, maintain, operate, and improve our Service.
• Financial Analysis: To perform financial calculations, generate models, and conduct analysis.
• Communication: To communicate with you about your account, transactions, and service updates.
• Security and Fraud Prevention: To detect, prevent, and investigate security threats and fraud.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Product Improvement: To understand how users interact with our platform and improve features and user experience.

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following limited circumstances:

• Service Providers: With trusted third-party vendors who assist us in operating the platform (e.g., cloud hosting, payment processors). These parties are bound by strict confidentiality agreements.
• Legal Requirements: When required by law, court order, or governmental authority, or to protect the rights, property, or safety of QuantRidge, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, with appropriate notice to users.
• With Your Consent: In any other case, only with your explicit prior consent.

A subprocessor is a third-party company that processes personal data on our behalf so that we can run the Service. The table below lists them as of the date above. We review and update it periodically, and whenever our providers change; you can also request written confirmation of the current list at any time.

The full subprocessor list adds the categories of data each provider receives, links to its own privacy policy and terms, and explains the 30-day notice we give before adding a new one.

International transfers. QuantRidge is operated from the United States and the providers above process data in the United States. If you use the Service from outside the U.S., your information will be transferred to and processed there, where privacy laws may differ from those in your country. Where required for transfers from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) together with the transfer terms in each provider's DPA.

Compliance posture, stated plainly. QuantRidge does not currently hold its own SOC 2 or ISO 27001 certification, and we do not claim otherwise. Our infrastructure providers maintain their own certifications and publish their own compliance materials; those are theirs, not ours.

California: Notice for California residents (CCPA/CPRA). B2B DPA: Data Processing Agreement.

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit (TLS). At-rest protection is provided by our hosting and database providers per their security programs.
• Access Controls: Role-based access control and multi-factor authentication protect your account and our internal systems.
• Vulnerability management: Secure development practices, dependency and vulnerability monitoring, and a published route for good-faith security reports. We do not claim a third-party penetration test or audit we have not had.
• Incident Response: We maintain a documented incident response plan and will notify you promptly of any breach affecting your data.

If your account uses QuantRidge AI features, we may log agent activity (timestamp, feature type, and hashed identifiers) for security, abuse prevention, and legal compliance. See our AI Acceptable Use Policy. Logs are retained per our data retention schedule and access is restricted to authorized personnel.

We use cookies and similar tracking technologies to enhance your experience on our platform. Here is what you should know:

• Essential Cookies: Required for core platform functionality such as authentication and session management. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with the platform so we can improve it. All analytics data is aggregated and anonymized.
• Preference Cookies: Remember your settings and preferences (e.g., theme, language) for a personalized experience.
• Managing Cookies: You can control cookies through your browser settings. Disabling essential cookies may impact platform functionality.

Depending on your location, you may have the following rights regarding your personal data under GDPR, CCPA, and other applicable regulations:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure: Request deletion of your personal data, subject to certain legal obligations.
• Right to Portability: Receive your personal data in a structured, machine-readable format.
• Right to Opt-Out: California residents may opt out of the sale of personal information (we do not sell data).
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

California-specific disclosures: California privacy notice. Business customers may need our DPA.

To exercise any of these rights, contact us at support@quantridge.net. We will respond within 30 days.

QuantRidge offers AI-assisted features, including the public Ask QuantRidge assistant and in-product assistants. Because AI raises specific questions, here is exactly what happens:

• We do not train models on your data: Your inputs, documents, portfolio data, and assistant conversations are not used to train, fine-tune, or otherwise improve any machine-learning model, ours or a third party's.
• The public assistant sees no account data: Ask QuantRidge, the assistant on our marketing site, is grounded in published product documentation only. No account records, customer data, or source code is placed in its model context — just your message and the recent turns of that conversation.
• In-product agents do see your data — that is their job: The AI agents inside the application answer questions about your own portfolio, so the context sent to the model provider can include your holdings, transactions and tax-lot data. It is your data only: an agent never has access to another customer’s records. The providers are named on our subprocessors page, and none of them use API data to train models.
• Screening happens before and after: Messages are screened on our servers before they reach the model provider, and replies are screened before they are returned. Messages that are refused are never transmitted to the provider at all.
• Logging: We log assistant activity — timestamps, feature type, and identifiers — for security, abuse prevention, rate limiting, and legal compliance, retained per the schedule below.
• No automated decisions with legal effect: QuantRidge does not use automated processing or profiling to make decisions that produce legal or similarly significant effects about you. AI output is informational; every decision remains yours.
• Accuracy: AI output can be incomplete or wrong. It is not investment, tax, or legal advice. See the AI Acceptable Use Policy and Legal Disclosure.

Full terms of use for these features are in the AI Acceptable Use Policy. Please do not paste account numbers, passwords, or government identifiers into an assistant.

We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires. In practice:

Deleting your account triggers deletion across our production systems. Because backups are encrypted snapshots taken on a rolling schedule, deleted data can persist in a backup until that snapshot expires; it is not restored to production and is not used for any purpose in the meantime. Where we are subject to a legal hold or an open dispute, we retain what the hold requires and nothing more.

If you are in the EEA, UK, or Switzerland, we process personal data on these legal bases under the GDPR:

• Contract: To provide the Service you signed up for, bill you, and support you.
• Legitimate interests: To secure the platform, prevent fraud and abuse, understand how the product is used, and improve it — balanced against your rights.
• Legal obligation: To meet tax, accounting, and other statutory duties.
• Consent: For non-essential cookies and marketing communications, where consent is required. You may withdraw consent at any time.

Children. The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly — contact support@quantridge.net if you believe a minor has provided us information.

Changes to this policy. We will post any change on this page and move the "last updated" date. For changes that materially reduce your rights or materially expand how we use your information, we will give notice by email or in-product at least 30 days before the change takes effect, so you have time to object or close your account. We do not apply material changes retroactively.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: