Privacy Policy

Last updated: 1 August 2026

1. Who We Are

Quantum Reports is a financial news aggregation and AI analysis service. For data protection purposes, we are the data controller for the personal data we collect about you.

Contact: For all data protection enquiries, please email privacy@quantumreports.io

ICO Registration No. ZC169897

2. Personal Data We Collect

Data you provide directly

• Email address — provided during account registration, used to send account notifications and (with consent) marketing emails.
• Display name — optional, set in account preferences.
• Password — stored as a one-way bcrypt hash; we never store or have access to your plaintext password.
• Two-factor authentication data — if you enable two-factor authentication, we store your authenticator secret and one-way hashes of your backup codes.
• Payment information — we do not store your card details. All payment data is processed and stored by Stripe Inc. We receive only a subscription status and customer reference from Stripe.

Data we collect automatically

• Usage data — articles you save, tickers you star, preferences you set, and email digest settings.
• IP address — collected by our hosting provider (Railway) as part of standard server logs, retained for up to 30 days.
• Device and browser information — user agent string and general device type, collected via server logs.
• Email interaction data — a log of digest emails sent (date, frequency, article count, delivery status), retained until you delete your account.
• Push notification subscription data — if you enable push notifications, your browser's push subscription details (a per-device endpoint and encryption keys), used to deliver breaking news, daily brief, and alert notifications to that device.
• Cookie consent records — a record of the consent choices you make, including timestamp and which categories you accepted.

3. How We Use Your Data and Legal Basis

4. Data Retention

• Account data (email, preferences, saved articles, starred tickers): retained until you request account deletion.
• Payment records: Stripe retains payment history for 7 years to comply with financial regulations. We hold only a customer reference and subscription status.
• Server logs (including IP addresses): retained for up to 30 days by our hosting provider, Railway.
• Email digest logs: retained until you delete your account.
• Push notification subscription data: retained until you disable push notifications or delete your account.
• Cookie consent records: retained until you delete your account.
• Security audit records: certain security-relevant account events — including login records, changes to your password or two-factor authentication settings, and the account deletion event itself — are kept separately, along with the associated IP address, for fraud prevention, account security, and investigating suspicious activity. Following account deletion, these records are retained for 12 months and then permanently deleted.

5. Third Parties We Share Data With

• Stripe Inc. (Payment processing) — processes subscription payments. Your card data goes directly to Stripe; we never receive it. Stripe is an independent data controller. Stripe Privacy Policy
• Resend Inc. (Email delivery) — we pass your email address and email content to Resend to deliver account emails and digests. Resend processes this data on our behalf as a data processor.
• ImprovMX (Inbound email forwarding) — emails sent to our support and privacy addresses are forwarded via ImprovMX to our team's inbox.
• Anthropic PBC (AI features) — we use Anthropic's Claude API for several features: classifying and summarising news headlines sourced from public news feeds; generating your personalised Daily Brief (Premium), which includes the tickers on your watchlist and related market data; and powering the QuantumAI chat assistant (Premium), which sends the messages you type and, where you choose to use it, a summary of your portfolio holdings or the ticker/article you're viewing, in order to generate a response.
• Supabase Inc. (Database hosting) — your account data is stored in a PostgreSQL database hosted by Supabase. Supabase processes this data on our behalf as a data processor.
• Railway Corp. (Server hosting) — our application server runs on Railway infrastructure. Railway may process IP addresses and server logs as a data processor.

We do not sell your personal data to any third party.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you. Use the “Download My Data” feature in Account Settings → Danger Zone, or email privacy@quantumreports.io.
• Right to rectification — you can correct inaccurate data via Account Settings, or by contacting us.
• Right to erasure — you can permanently delete your account and all associated data via Account Settings → Danger Zone, or by emailing us. This does not include the security audit records described in Section 4, which we retain separately for fraud prevention and account security purposes for 12 months following deletion.
• Right to data portability — you can export your data in JSON format using the “Download My Data” feature in Account Settings.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to object — you can object to processing based on legitimate interest. You can unsubscribe from marketing and digest emails at any time using the unsubscribe link in any email or via Account Settings.
• Right to withdraw consent — where processing is based on consent (e.g. marketing emails, cookies), you can withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email privacy@quantumreports.io. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/concerns.

7. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential cookies — required for the site to function. These include a session cookie (_refresh) to keep you signed in, and an authentication cookie (_auth) required to make requests to our API. These cannot be disabled.
• Analytics cookies — we may use analytics tools to understand how visitors use the site. We will only set these if you give consent. Currently, no analytics cookies are set.
• Marketing cookies — we do not currently use any marketing or advertising cookies.

You can manage your cookie preferences at any time using the Cookie Preferences panel.

8. Data Security

We use industry-standard security measures including TLS encryption for all data in transit, bcrypt password hashing, HTTP-only cookies for session tokens, and Content Security Policy headers. Access to personal data is restricted to essential service operations only.

9. International Transfers

Our service providers (Stripe, Resend, Anthropic, Supabase, Railway) may process data in the United States. We rely on Standard Contractual Clauses and/or the UK International Data Transfer Agreement where applicable to ensure adequate protection.

10. Children

Quantum Reports is not directed at children under 18 years of age. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact us at privacy@quantumreports.io and we will delete the data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes. The date at the top of this page shows when the policy was last updated. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

13. QuantumAI Browser Extension

QuantumAI is also available as a separate browser extension that connects to your Quantum Reports account. This section describes what the extension itself collects; the rest of this policy, including Section 5's description of how Anthropic PBC processes QuantumAI messages, continues to apply to the underlying QuantumAI service.

What the extension collects

• An extension authentication token — issued when you connect your Quantum Reports account to the extension. This is a separate device credential, not your account password: it is generated specifically for the extension and can be revoked independently of your main account login at any time.
• Text you explicitly select and submit — when you select text on a webpage and choose “Ask QuantumAI,” that selection is sent to the QuantumAI service to generate a response. The extension does not read, monitor, or log page content you haven’t specifically selected and submitted.

Why we collect it

This data is used solely to provide the QuantumAI feature within the extension: the token authenticates each request as coming from your account, and the selected text is what QuantumAI analyses to produce a response. It is not used for any other purpose. Legal basis: performance of contract (UK GDPR Art. 6(1)(b)), the same basis under which we provide QuantumAI within the main service (Section 3).

Where the token is stored

The raw extension token is generated once, at connection time, and stored only in your browser’s local extension storage — it is never stored on any third-party service. On our servers we store only a bcrypt hash of the token, the same one-way hashing used for account passwords (Section 2), so the raw token cannot be recovered even from our own database.

Retention and revocation

The token remains valid until you revoke it from Account Settings → Connected Devices, or until your Premium subscription lapses — either of which cuts off extension access on the very next request, with no separate expiry. Text you submit via “Ask QuantumAI” is sent to Anthropic PBC (Section 5) to generate a response and is not otherwise logged or stored by us; our servers record only a running count of how many messages you’ve sent that day, not their content, to enforce the daily usage limit.

We do not sell or transfer this data to any third party, and we do not use it for any purpose beyond providing the QuantumAI extension feature described above.

Host permission scope

The extension’s only content script runs on quantumreports.io/extension/authorize, and its sole function is to relay a one-time connection code back to the extension when you connect your account. It does not run on, read, or interact with any other website.

---

For all privacy-related enquiries: privacy@quantumreports.io