Privacy Policy

1. Who we are

This Privacy Policy explains how Kvantra Operations AS (“Kvantra”, “we”, “us”, “our”) processes personal data when you use our websites, mobile applications and platform (together, the “Platform”). Kvantra is the data controller for the processing described here, unless otherwise explicitly stated.

Kvantra AS (parent company) acts as a data processor on behalf of Kvantra Operations AS in connection with the technical operation of the Platform, under a data processing agreement.

Company: Kvantra Operations AS (org.nr 937 809 697)

Address: Keiser Wilhelms gate 22, 6003 Ålesund, Norway

Privacy contact email: contact@kvantra.ai

We comply with the GDPR, the Norwegian Personal Data Act and relevant consumer legislation.

2. What personal data we process

We mainly process the following categories of personal data:

To create an account you must give an email address and a password (or use another login method we offer). Without them we cannot provide the Platform. Everything else is optional, unless a feature you choose needs it.

2.1 Identity and contact data

• Name
• Email address
• Username / display name, if you choose one
• Job title, company and country (if provided)

2.2 Account and subscription data

• Plan, subscription status and billing interval
• Subscription and trial start and end dates, and which trials you have used
• Upgrades, downgrades and cancellations
• Selected preferences (language, display, dashboard layout, etc.)

2.3 Authentication and security data

• Password hash (we never store plain text passwords)
• Two-factor / MFA status (if enabled)
• Security logs (login attempts, IP addresses, changes to critical settings)

2.4 Usage data

• Which pages, screens, tables and features you use
• Clicks, filtering, searches and navigation patterns
• Login times and session usage times
• Error and crash logs

2.5 Technical data

• IP address
• Device type, operating system, browser or app version
• Language and time zone
• Approximate geolocation (country/region based on IP)
• If you use our mobile app: device identifiers needed for login and, if you allow notifications, a push notification token

2.6 Portfolio, analysis and configuration data

If you use the portfolio and analysis features of the Platform, we store:

• Watchlists, favourites lists, saved screeners and alerts
• Portfolios and the transactions you enter or import
• Holdings, returns and dividends we calculate from those transactions
• Custom notes, tags and fields you link to companies or portfolios
• Other storage choices and personalisation in the user interface

Imported files. When you upload a file for import, we use it only to read the transactions in it and store those transactions in your portfolio. The file itself is deleted when the import ends, whether it succeeds or fails. Files uploaded for import should contain your transactions only. If a file could not be read and you send it to our support, we use it only to add support for that file format.

2.7 Referral group data

If you invite others or join a referral group, we process:

• Invitation links you create, when they were created and used, and when they expire
• Who invited whom
• Your group’s name, if it has one, and who chose it
• Your group membership, your status as member or invited person, and the dates you joined, cancelled or left
• The number of members in your group and the discount and price that apply to you
• Events in the referral programme (link created, link used, first payment through an invitation, leaving a group, group dissolved)

2.8 Payment and transaction data

• Subscription price, discount, invoice number, currency, payment status
• Transaction history (paid/unpaid, dates)

Payments on our website are handled by Paddle, which acts as merchant of record and is the seller of record of our subscriptions. Payments made inside a Kvantra app are handled by the relevant app store (Apple App Store or Google Play) as merchant of record. Paddle and the app stores process your payment details as independent controllers under their own privacy policies. We receive limited information from them, such as subscription status, product, amount, country, transaction identifiers and, from Paddle, the last 4 digits and expiry date of your card. We never receive or store full card details.

2.9 Communication and support

• Enquiries to support and sales (email, chat, forms)
• Logs from troubleshooting on your account
• Feedback and surveys (if you respond)

2.10 Marketing and preferences

• Choices about receiving product updates, newsletters and campaigns
• Whether you have unsubscribed from our emails
• If you accept marketing cookies: advertising identifiers (such as cookie IDs and ad click IDs), which ad or campaign brought you to our website, and whether you then signed up or subscribed

We do not knowingly collect:

• Special categories of personal data (health, religion, political opinions, etc.)
• Information about children. The Platform is not directed at persons under 18 years of age.

3. Purposes and legal bases (GDPR)

We process personal data for the following purposes:

3.1 To deliver and operate the Platform

• Create and administer a user account
• Provide access to your subscription and the features you are entitled to
• Read imported files, store your portfolios and calculate returns and dividends
• Send the alerts and notifications you have turned on
• Ensure that services function technically (login, storage of settings, response time, etc.)

Legal bases:

• Art. 6(1)(b): necessary for the performance of a contract (user agreement/subscription).
• Art. 6(1)(f): legitimate interests (stable and secure operation).

3.2 Billing, payment and finance

• Manage your subscription and calculate your price and any discounts
• Receive payment status and transaction details from Paddle or the app store, which handle the payment, invoice and receipt as merchant of record
• Fulfil bookkeeping and tax obligations

Legal bases:

• Art. 6(1)(b): contract.
• Art. 6(1)(c): legal obligation (bookkeeping legislation).

3.3 Referral groups

• Create and run groups, check who counts as a member, and calculate the group price under our Terms
• Show the group overview and invitation pages to the people described in section 5.4
• Send emails about price changes in your group. These are transactional emails and are sent even if you have unsubscribed from newsletters.

Legal basis: Art. 6(1)(b): contract (the referral programme you choose to take part in).

• Measure how the referral programme performs (for example how many invitations lead to a subscription), at an aggregated level
• Detect and prevent misuse of the referral programme, such as duplicate accounts

Legal basis: Art. 6(1)(f): legitimate interests (developing the programme and preventing misuse).

3.4 Analytics, product development and improvement

• Understand how the Platform is used (aggregated and anonymised where possible)
• Analyse which features should be improved or built
• Capacity and performance planning (server resources, scaling)

Legal bases:

• Art. 6(1)(a): consent, for analytics that uses non-essential cookies or similar technologies, such as Google Analytics (see section 8).
• Art. 6(1)(f): legitimate interests (understand usage and further develop the product), for our own server logs and aggregated statistics.

We seek to use aggregated or pseudonymised data where feasible.

3.5 Security, abuse prevention and licence compliance

• Detect and prevent unauthorised access, scraping, API misuse and other breaches of the terms
• Log login attempts, suspicious activity, rate limiting, etc.
• Demonstrate to our data providers (such as FMP) that the use and distribution of market data is in accordance with licence terms, without exposing more personal data than necessary

Legal basis: Art. 6(1)(f): legitimate interests (IT security, licence compliance and prevention of misuse). In the event of security incidents, Art. 6(1)(c), legal obligation, may also be relevant (notification duties to supervisory authorities, etc.).

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (in Norway, Datatilsynet) without undue delay, and where the breach is likely to result in a high risk to you, we will also inform you, in accordance with the GDPR.

3.6 Customer support and communication

• Respond to enquiries via email, chat or forms
• Provide technical support and troubleshoot issues
• Inform you of trials ending, renewals, payment problems and material changes to terms or privacy

Legal bases:

• Art. 6(1)(b): contract.
• Art. 6(1)(f): legitimate interests (good customer service).

3.7 Marketing and product updates

• Send newsletters, product updates and relevant campaigns about our own products
• Choose which emails are relevant to you, based on your plan and preferences

Legal bases:

• Art. 6(1)(a): consent. For prospects and non-paying users, we send electronic marketing only where you have given your prior consent (opt-in), as required by applicable marketing law.
• Art. 6(1)(f): legitimate interests. For existing customers, we may send marketing about our own similar products on the basis of the existing customer relationship, provided you were given the opportunity to decline both when you provided your details and in every subsequent message.

You can withdraw consent or opt out of marketing at any time, free of charge (see section 9). We do not use pre-ticked boxes to obtain marketing consent. We do not send invitations to people on your behalf. Invitation links are shared by you.

3.8 Free plans and trials

If you use the free plan or a trial, we may:

• Use usage data and preferences for product analysis and improvement (Art. 6(1)(f): legitimate interests in understanding how free versions are used)
• Use contact data to send onboarding information and information about your trial (Art. 6(1)(b): contract, to provide the free plan or trial)

Where applicable, we rely on your consent (Art. 6(1)(a)) for specific marketing.

We will not use data from free plans for purposes other than those clearly explained in this Privacy Policy and any applicable consent texts.

3.9 Advertising measurement

• Measure which advertising campaigns (for example on Google Ads and Reddit Ads) bring visitors to our website and lead to sign-ups and subscriptions, and improve our advertising

Legal basis: Art. 6(1)(a): consent, given through the marketing cookies option in our cookie banner. We only use these tags if you accept marketing cookies, and you can withdraw your consent at any time in the cookie settings.

4. Sources of personal data

We obtain personal data from:

• You, when you create an account, use the Platform, upload files or contact us
• Other users, when they invite you to a referral group (that you were invited, and by whom)
• Paddle and the app stores (limited subscription and transaction data)
• Our email and customer support platform (communication history)
• Technical infrastructure (logging of usage and security incidents)

We do not purchase third-party “profile data” about you to enrich your account.

5. Sharing of personal data

We do not sell personal data. We only share data where necessary to deliver the service or fulfil legal and contractual obligations.

5.1 Processors (service providers)

Our parent company Kvantra AS runs the technical operation of the Platform as our processor and uses sub-processors in these categories:

• Hosting and infrastructure: providers operating servers, databases, applications and backups
• Email and communication: distribution of system emails, newsletters and support communication
• Analytics: tools for usage measurement, technical performance and error tracking

They may only process data according to our instructions and in accordance with a data processing agreement. An up-to-date list of sub-processors is available on request.

5.2 Payment providers

Paddle (for purchases on our website) and the Apple App Store and Google Play (for purchases in our apps) receive the data needed to sell and administer your subscription. They act as independent controllers, not as our processors.

5.3 Market data providers (e.g. FMP)

We do not share personal data with Financial Modeling Prep (FMP) for their own purposes. FMP supplies market and company data which we display in the Platform. We may, to a limited extent, have to share aggregated or pseudonymised usage information, or documentation of licence compliance, where this is necessary to fulfil the licence agreement. In such cases, we seek to minimise personal data and use pseudonymisation where possible. Our parent company Kvantra AS holds the licence with FMP. When FMP needs usage reports, Kvantra AS prepares them on our instructions under the data processing agreement, using aggregated data where possible.

5.4 Other users

Your display name (or “PersonX” if you have not chosen one) may be shown to other users where you interact with them on the Platform. If you are in a referral group, the other members can see information about your membership, such as your status in the group and who invited whom. A person who opens an invitation link sees the inviter’s display name, the group name (if any) and the price they would pay. Other users cannot see your email address or payment details.

5.5 Account integrations (if applicable in the future)

If, at a later stage, we allow you to connect external accounts (for example a brokerage account via a third-party aggregator), the relevant provider will be described in an updated version of this Privacy Policy, and data retrieved via such integrations will only be used for purposes you are clearly informed about.

5.6 Public authorities and legal claims

We may share personal data if we are legally obliged to do so, for example following an order from a court or supervisory authority, or in connection with enforcing our rights (for example in cases of serious misuse or fraud).

5.7 Corporate changes

If Kvantra undergoes a merger, acquisition or other corporate transaction, personal data may be included as part of the transaction. In such cases, we will limit sharing to what is necessary and ensure that the recipient maintains a privacy regime that is at least at the same level.

5.8 Advertising platforms

If you accept marketing cookies, the advertising platforms we use receive data from their tags on our website, such as cookie IDs, the pages you visit and whether you signed up or subscribed. We currently use Google (Google Ads) and Reddit (Reddit Ads), and our cookie settings always list the platforms we use. We and each platform are jointly responsible for collecting this data on our website. Each platform is responsible for its own further use of the data, under its own privacy policy.

6. Transfers outside the EEA

Some of our providers, and the advertising platforms in section 5.8, may be established outside the EEA (for example in the United States) or use infrastructure located outside the EEA. For such transfers, we ensure an adequate level of protection, for example by:

• sending data to countries the EU Commission has approved as having adequate data protection (an “adequacy decision”); and/or
• entering into Standard Contractual Clauses (SCCs) approved by the EU Commission, combined with necessary technical and organisational measures.

You can contact us at contact@kvantra.ai if you want more detailed information about relevant transfers and safeguards.

7. Storage periods (retention)

We do not store personal data longer than necessary for the purposes above, unless the law requires longer storage. Typical storage periods:

• Account data (identity, login, subscription): for as long as you have an active account. If your account is deactivated, we may keep it for up to 24 months so that you can reactivate it. After you delete your account, we keep only what we need to handle disputes and meet legal requirements, normally no longer than 24 months.
• Portfolio, watchlist, imported transactions and analysis configuration: for as long as your account is active. When you delete your account, this data is deleted within 30 days. Copies in backups are deleted when the backups are overwritten, within 90 days. You can delete portfolios and transactions yourself at any time.
• Referral group data: for as long as you are in a group and your account is active. Group history (who invited whom, membership dates and discounts) is kept for up to 24 months after you leave the group or delete your account, to handle questions about prices and misuse. Invitation links stop working when they expire, and invited persons who do not make their first payment within 30 days of using the link are no longer linked to the group.
• Usage and security logs: detailed logs normally up to 12 months. Aggregated statistics without identifiable elements may be retained longer.
• Payment and transaction data: for as long as bookkeeping legislation requires, currently 5 years after the end of the financial year.
• Support dialogue and email correspondence: normally up to 36 months after the last active case, unless there is a need for longer storage in connection with disputes or compliance.
• Marketing cookies: until they expire or you withdraw your consent. The advertising platforms keep the data they receive under their own privacy policies.
• Marketing consents: for as long as the consent applies, and up to 6 months after.
• Opt-outs: for as long as we hold your email address, and up to 6 months after, so that we do not email you again.

When the storage period has expired, the personal data will be either deleted, anonymised or irreversibly pseudonymised.

8. Cookies and similar technologies

We use cookies and similar technologies for:

• Necessary functions (login, session management, security, and remembering an invitation link while you sign up)
• Preferences (language, display settings)
• Analytics and statistics (how the Platform is used)
• Marketing (measuring which advertising campaigns lead to sign-ups and subscriptions, see sections 3.9 and 5.8)

You will be informed via our cookie banner when you visit the Platform for the first time and can accept all, accept only necessary, or customise settings. You can change or withdraw your consent to non-essential cookies at any time, as easily as you gave it, via the cookie settings on the Platform or your browser settings.

9. Your rights

As a data subject, you have rights under the GDPR. You can exercise these by contacting us at contact@kvantra.ai.

9.1 Right of access

You can request confirmation as to whether we process personal data about you and obtain a copy of such data.

9.2 Right to rectification

You can ask us to correct or supplement information that is inaccurate or incomplete.

9.3 Right to erasure (“right to be forgotten”)

You can ask us to delete personal data in certain situations, for example when the data is no longer necessary for the purpose, when you withdraw consent and we have no other legal basis, or when you object to processing and there are no overriding legitimate grounds to continue. We may be obliged to store certain data longer (e.g. accounting records).

9.4 Right to restriction of processing

You can ask us to restrict processing for certain periods, for example while we assess an objection or the quality of the data.

9.5 Right to data portability

For data you have provided to us, and which is processed based on consent or contract, you can request that it be provided to you in a structured, commonly used and machine-readable format, and that it be transmitted to another controller where technically feasible.

9.6 Right to object

You can object to processing carried out on the basis of our legitimate interests, including profiling related to such interests. You can always object to processing for direct marketing purposes, and we will then stop such processing.

9.7 Right to withdraw consent

If we process data based on your consent, you can withdraw this at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

9.8 Right to lodge a complaint

You have the right to lodge a complaint with your local supervisory authority if you believe our processing violates data protection rules. In Norway, the supervisory authority is Datatilsynet (the Norwegian Data Protection Authority). We nevertheless encourage you to contact us first, so we can attempt to resolve the issue.

10. Automated decision-making and profiling

We use analytics and algorithms to:

• Calculate factors, scores, ranking models and backtests for companies and markets. These are about securities, not about you.
• Calculate your group price from the number of members, using the formula in our Terms. This is necessary to perform the contract with you. Contact us if you think your price has been calculated wrongly, and a person will review it.
• Understand how features are used, at an aggregated level

Apart from the group price formula, we do not make automated decisions that have legal or similarly significant effects on you.

11. Changes to this Privacy Policy

We may update this Privacy Policy when necessary (for example due to new features, new providers or regulatory changes). The version in force at any given time will be available on the Platform, and the “Effective date” at the top will be updated. In the case of material changes, we will notify you via email and/or within the Platform.

12. Contact information

For questions, access requests or other enquiries related to privacy:

Kvantra Operations AS (org.nr 937 809 697)

Email: contact@kvantra.ai

Keiser Wilhelms gate 22, 6003 Ålesund, Norway