Privacy Policy
Last updated: 09/07/2026
1. Who we are
QuantRotation ("we," "us," "our") operates quantrotation.com. This policy explains what personal data we collect, why, and your rights over it. We are the data controller for the personal data described below.
The data controller is Monsieur Romain Henry, an individual entrepreneur (entrepreneur individuel) established in France, registered under SIREN 978 517 076 and SIRET 978 517 076 00011.
Business address: 30 Boucle Saint-Exupéry, 57310 Guénange, France.
2. What we collect
| Data | Why | Source |
|---|---|---|
| Email address | Account creation, login, transactional emails (password reset) | You, at signup |
| Name (optional) | Personalization | You, at signup |
| Password | Authentication (stored as a bcrypt hash - we never see or store your plaintext password) | You, at signup |
| Subscription tier & Stripe customer/subscription IDs | Billing, access control | Stripe, after checkout |
| Session data | Keeping you logged in | Generated by our authentication system, stored in an encrypted, httpOnly cookie |
We do not collect payment card details directly - those are handled entirely by Stripe, our payment processor, under their own privacy policy.
We do not currently use analytics or advertising trackers.
3. How we use your data
- To provide and maintain your account and access to the Service
- To process payments and manage subscriptions (via Stripe)
- To send transactional emails: password resets (via OVHcloud)
- To respond to support requests you send us
4. AI-generated summaries
Pro accounts receive daily AI-generated summaries of market signal data. These summaries are generated from computed scores and market data - your personal account data is never sent to our AI provider (Anthropic); only sector-level market signal data is processed for this feature.
5. Third parties we share data with
We share the minimum data necessary with these processors to operate the Service:
- OVHcloud (application hosting, database, and email delivery) - stores your account data and processes your email address for transactional emails on infrastructure located in France
- Stripe (payment processing) - receives your email and billing information
- Anthropic - receives market signal data only (see section 4), not personal account data
We do not sell your personal data to anyone.
6. Data retention
We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we're required to retain records for legal or tax purposes (e.g., billing records).
7. Your rights
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with a data protection supervisory authority. In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL). You may also lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement.
To exercise these rights, contact us at contact@quantrotation.com.
8. Cookies
We use one essential cookie to keep you logged in (session authentication). This cookie is required for the Service to function and isn't used for tracking or advertising. We don't currently use any non-essential/marketing cookies - if that changes, we'll update this policy and request consent where required.
9. Security
Passwords are hashed with bcrypt and never stored or transmitted in plaintext. Password reset tokens are single-use, time-limited, and stored as cryptographic hashes. Despite these measures, no system is 100% secure - we can't guarantee absolute security of your data.
10. International data transfers
Our website and core account data are hosted in France and processed within the European Economic Area (“EEA”). However, some of our service providers may process limited personal data outside the EEA, including in the United States, in particular:
- Stripe, for payment processing and subscription management;
Where a transfer of personal data outside the EEA occurs, we rely on a valid transfer mechanism under Chapter V of the GDPR. Stripe participate in the EU–U.S. Data Privacy Framework. We implement supplementary measures where required by applicable law.
Anthropic receives only aggregated, non-identifying sector-level market data to generate daily summaries. We do not intentionally provide Anthropic with personal account data.
You may request further information about the relevant transfer safeguards, including a copy of the applicable Standard Contractual Clauses where available, by contacting us at contact@quantrotation.com.
11. Children
The Service is not directed at, and we do not knowingly collect data from, anyone under 18.
12. Changes to this policy
We'll notify you of material changes via email or a notice on the Service.
13. Contact
Questions or requests about your data: contact@quantrotation.com.