Privacy Policy

Who is the controller

QuantAbundance, a Wyoming limited-liability company (USA), is the data controller for personal data processed through quantabundance.com, api.quantabundance.com, our newsletters, our Telegram channels, and any paid subscription. Contact: contact@quantabundance.com.

What we collect

We collect the minimum data needed to operate the Service. In practice this means:

• Email address - when you sign up for the daily digest, premium-tier waitlist, or any paid subscription.
• Signup source tag - a short string (e.g. footer, premium-waitlist-portfolios) so we can tell where an email came from. No tracking pixel, no UTM, no cross-site identifier.
• Stripe customer + subscription metadata - for paid subscribers: billing email, subscription status, plan, country (for tax), and Stripe identifiers. We do not see or store full card numbers - Stripe handles those directly.
• Member sign-in - your email address and a one-time 6-digit code we email you, to open your library, the AI assistant and any paid tier. No password is stored.
• Shop purchases - for one-off products: the email you paid with, the product, the date and the Stripe identifiers, so your permanent link and your library keep working. When a product you own gets a new version, we email it to you once, with a one-click unsubscribe.
• AI research assistant - the messages and any chart image you send are passed to Anthropic, which runs the model, to produce the answer. We do not store the conversation; we keep a per-account count of messages per day (to apply the daily limit) and daily totals with no personal data (to watch costs). Do not paste personal or account details into it.
• YouTube comments - when you comment on one of our videos, the comment and your public channel name are read through YouTube's API and passed to Anthropic to draft a reply that a person reviews before anything is posted.
• Do-not-email list - when you click Unsubscribe in any of our emails, we record the address and the date so that none of our emails (digest, shop updates, checkout reminders) reaches you again.
• Checkout reminder - if you start a checkout in the shop and leave before paying, Stripe passes us the email you typed. We send one reminder with Stripe's link to reopen the same checkout, only if you ticked Stripe's box to receive offers by email or you subscribe to the digest, and at most once every 30 days. Every reminder has a one-click unsubscribe, which also stops any future reminder. The address is never shared with anyone.
• Display name (optional) - if you opt to appear on the public supporters wall. Off by default.
• Telegram chat ID - only if you join a paid Telegram channel and message our bot. Used to deliver your subscription messages.
• Anonymized analytics via Google Analytics 4 (GA4) - page views, country-level location, referrer. Default-deny consent: no analytics cookies until you accept the banner. IP anonymization is on regardless of consent. See /disclosures#cookies for details.
• Cookieless visit counts via Cloudflare Web Analytics - page views, referrer, country, device type. No cookie, no local storage, no identifier: we only see aggregate totals. It runs regardless of the banner because it stores nothing on your device.
• Shop purchase records - kept as long as the product is available to you (your permanent link and library depend on them), and at least as long as tax law requires.
• AI assistant - the conversation is not stored by us; the per-account daily message count expires after a day.
• Server logs - IP, user-agent, timestamp, requested path, referrer. Standard webserver / nginx logs, retained no longer than 30 days for security and abuse-detection.

Why we collect it (lawful bases - GDPR / UK GDPR)

For users in the European Economic Area, the United Kingdom, or Switzerland, the lawful bases under Article 6 GDPR / UK GDPR are:

• Performance of a contract - to deliver newsletters you signed up for and to provide paid subscription services to subscribers.
• Legitimate interests - for security, abuse prevention, debugging, and very basic aggregate analytics. Balanced against your privacy interests by design (no profiling, no advertising, no data sales).
• Consent - for analytics cookies (Google Consent Mode v2 default-deny) and for any optional displays such as the public supporters wall.
• Legal obligation - to keep tax-relevant records (Stripe invoice history) for the periods required by US and applicable foreign tax law.

Who else sees it (third-party processors)

We use the following sub-processors. Each is bound by their own privacy terms; clicking their name will take you to those terms.

• Stripe, Inc. (USA) - payment processing, subscription management. Merchant of record for paid tiers.
• Resend (USA) - transactional email and newsletter delivery.
• Telegram FZ-LLC (UAE) - messaging delivery if you opt into a Telegram channel.
• Google LLC (USA) - Google Analytics 4 (anonymized, consent-gated). No ads, no Google Signals, no audience-targeting features.
• Hetzner Online GmbH (Germany) - VPS hosting. Server logs and the application database live here.
• Cloudflare, Inc. (USA) - DNS, content delivery and security proxy for the site (every request passes through it), and cookieless aggregate visit counts (Cloudflare Web Analytics).
• Anthropic, PBC (USA) - runs the AI model behind the on-site research assistant and the drafts of our replies to YouTube comments. Its commercial API terms say it does not train its models on these inputs by default.

We do not sell, rent, or trade personal data. We do not share personal data with advertisers, data brokers, or audience-targeting platforms.

International transfers

Personal data of EU / UK users may be transferred to and processed in the United States and other jurisdictions where our sub-processors operate. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and (where applicable) sub-processor certifications under the EU-US Data Privacy Framework, as the transfer mechanism.

How long we keep it

• Email subscribers - kept while you are subscribed. When you unsubscribe (one-click link in every email), we keep only what is needed to never email you again: the address, the date and the fact that you unsubscribed. Ask us and we erase it; a later sign-up then starts from scratch.
• Stripe subscription records - kept for the period required by US tax law (typically seven (7) years from the last invoice), then deleted or anonymized.
• Server logs - rotated and deleted within 30 days.
• Anonymized GA4 data - retained per GA4's default settings (currently 14 months), then auto-deleted by Google.

Your rights

Wherever you live, you can email us at contact@quantabundance.com to:

• Access - get a copy of what we hold about you.
• Correct - fix anything inaccurate.
• Delete - have your data removed (subject to tax-record retention).
• Restrict / object - limit or stop a particular use.
• Portability - receive your data in a machine-readable format.
• Withdraw consent - for anything done on the basis of your consent (analytics cookies, supporters wall display).

We respond within 30 days. We do not charge a fee unless your request is manifestly unfounded or excessive.

EU / UK supervisory authorities. You have the right to complain to your local data-protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

California (CCPA / CPRA). California residents have the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise CCPA rights, email us at the address above.

Cookies and similar technologies

We run a single first-party analytics cookie set (Google Analytics 4) under default-deny consent; the Cloudflare visit counter sets no cookie at all. Full cookie inventory, consent mechanics, and how to revoke consent are at /disclosures#cookies.

Security

We use HTTPS everywhere (Let's Encrypt), TLS for all inter-service traffic, encrypted database storage at rest, principle-of-least-privilege access for operators, and dependency patching. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you and the appropriate authorities within the timeframes required by applicable law.

Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal data, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. The version with the latest "Last updated" date below is the version in effect. Material changes affecting paid subscribers or active email subscribers will be notified by email at least fourteen (14) days before they take effect.