Privacy Policy

1. Who we are

This Privacy Policy explains how Kvantra Operations AS (“Kvantra”, “we”, “us”, “our”) processes personal data when you use our websites and our platform (together, the “Platform”). Kvantra is the data controller for the processing described here, unless otherwise explicitly stated.

Kvantra AS (parent company) acts as a data processor on behalf of Kvantra Operations AS in connection with the technical operation of the Platform, under a data processing agreement.

Company: Kvantra Operations AS (org.nr 937 809 697)

Address: Keiser Wilhelms gate 22, 6003 Ålesund

Privacy contact email: Contact@Kvantra.ai

We comply with the GDPR, the Norwegian Personal Data Act and relevant consumer legislation (including the right of withdrawal rules for digital services where applicable).

2. What personal data we process

We mainly process the following categories of personal data:

2.1 Identity and contact data

• Name
• Email address
• Username / account name
• Job title, company and country (if provided)

2.2 Account and subscription data

• Subscription type and status
• Subscription start and end dates
• Upgrades/downgrades
• Selected preferences (language, display, dashboard layout, etc.)

2.3 Authentication and security data

• Password hash (we never store plain text passwords)
• Two-factor / MFA status (if enabled)
• Security logs (login attempts, IP excerpts, changes to critical settings)

2.4 Usage data

• Which pages, screens, tables and features you use
• Clicks, filtering, searches and navigation patterns
• Login times and session usage times
• Error and crash logs

2.5 Technical data

• IP address
• Device type, operating system, browser and version
• Language and time zone
• Approximate geolocation (country/region based on IP)

2.6 Portfolio, analysis and configuration data

If you use the more advanced features of the Platform, we may store:

• Watchlists, favourites lists and saved screeners
• Custom portfolios and position sizes (if you enter this yourself)
• Custom notes, tags and fields you link to companies or portfolios
• Other storage choices and personalisation in the user interface

2.7 Payment and transaction data

• Subscription price, invoice number, currency, payment status
• Transaction history (paid/unpaid, dates)

We receive limited card information from our payment provider (typically the last 4 digits and expiry date) – we do not store full card information.

Full payment information (card number etc.) is processed by our payment provider (Paddle) as a separate controller/processor. Paddle acts as Merchant of Record, meaning it is the seller of record and processes payments on behalf of Kvantra Operations AS.

2.8 Communication and support

• Enquiries to support and sales (email, chat, forms)
• Logs from troubleshooting on your account
• Feedback and surveys (if you respond)

2.9 Marketing and preferences

• Choices about receiving product updates, newsletters and campaigns
• Email engagement (opened, clicked, unsubscribed) where this is tracked

We do not knowingly collect:

• Special categories of personal data (health, religion, political opinions, etc.)
• Information about children – the Platform is not directed at persons under 18 years of age.

3. Purposes and legal bases (GDPR)

We process personal data for the following purposes:

3.1 To deliver and operate the Platform

• Create and administer a user account
• Provide access to your subscription and the features you are entitled to
• Ensure that services function technically (login, storage of settings, response time, etc.)

Legal bases:

• Art. 6(1)(b) – Necessary for the performance of a contract (user agreement/subscription).
• Art. 6(1)(f) – Legitimate interests (stable and secure operation).

3.2 Billing, payment and finance

• Handle payments, invoices, receipts and accounting
• Fulfil bookkeeping and tax obligations

Legal bases:

• Art. 6(1)(b) – Contract.
• Art. 6(1)(c) – Legal obligation (bookkeeping legislation).

3.3 Analytics, product development and improvement

• Understand how the Platform is used (aggregated and anonymised where possible)
• Analyse which features should be improved or built
• Capacity and performance planning (server resources, scaling)

Legal basis:

• Art. 6(1)(f) – Legitimate interests (understand usage and further develop the product).

We seek to use aggregated or pseudonymised data where feasible.

3.4 Security, abuse prevention and license compliance

• Detect and prevent unauthorised access, scraping, API misuse and other breaches of the terms
• Log login attempts, suspicious activity, rate limiting, etc.
• Document to our data providers (such as FMP) that the use and distribution of market data is in accordance with licence terms, without exposing more personal data than necessary

Legal basis:

• Art. 6(1)(f) – Legitimate interests (IT security, licence compliance and prevention of misuse).

In the event of security incidents, Art. 6(1)(c) – Legal obligation – may also be relevant (notification duties to supervisory authorities, etc.).

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (in Norway, Datatilsynet) without undue delay, and where the breach is likely to result in a high risk to you, we will also inform you, in accordance with the GDPR.

3.5 Customer support and communication

• Respond to enquiries via email, chat or forms
• Provide technical support and troubleshoot issues
• Inform you of material changes to terms or privacy

Legal bases:

• Art. 6(1)(b) – Contract.
• Art. 6(1)(f) – Legitimate interests (good customer service).

3.6 Marketing and product updates

• Send newsletters, product updates and relevant campaigns about our own products
• Segment and analyse email responses to make communication more relevant

Legal bases:

• Art. 6(1)(a) – Consent. For prospects and non-paying users, we send electronic marketing only where you have given your prior consent (opt-in), as required by applicable marketing law.
• Art. 6(1)(f) – Legitimate interests. For existing customers, we may send marketing about our own similar products on the basis of the existing customer relationship, provided you were given the opportunity to decline both when you provided your details and in every subsequent message.

You can withdraw consent or opt out of marketing at any time, free of charge, see section 9. We do not use pre-ticked boxes to obtain marketing consent.

3.7 “Payment with data” – free plans and trial access

If we offer a free plan or an extended trial, we may:

• Use usage data and preferences for product analysis and improvement
• Use contact data to follow up with relevant onboarding and upgrade information

Legal bases:

• Art. 6(1)(b) – Contract (providing a free version as a contractual relationship where the consideration is the use of the platform).
• Art. 6(1)(f) – Legitimate interests (understand use of free versions).
• Where applicable, Art. 6(1)(a) – Consent for specific marketing.

We will not use data from free plans for purposes other than those clearly explained in this Privacy Policy and any applicable consent texts.

4. Sources of personal data

We obtain personal data from:

• You, when you create an account, use the Platform or contact us
• Our payment provider (limited transaction and receipt data)
• Our email and customer support platform (communication history)
• Technical infrastructure (logging of usage and security incidents)

We do not purchase third-party “profile data” about you to enrich your account.

5. Sharing of personal data and processors

We do not sell personal data.

We only share data where necessary to deliver the service or fulfil legal and contractual obligations.

5.1 Processors (service providers)

We use, among others:

• Hosting/infrastructure: cloud provider(s) operating databases, applications and backups
• Analytics tools: tools for usage measurement, technical performance and error tracking
• Email and communication: distribution of system emails, newsletters and support communication
• Payment provider: Paddle (Merchant of Record) for card payments and invoicing

These act as processors on our behalf and may only process data according to our instructions and in accordance with a data processing agreement.

We will publish or make available an up-to-date list of key processors (sub-processors) via the Platform or upon request.

5.2 Market data providers (e.g. FMP)

We do not share personal data with Financial Modeling Prep (FMP) for their own purposes. FMP supplies market and company data which we display in the Platform. We may, to a limited extent, have to share:

• Aggregated or pseudonymised usage information, or
• Documentation of licence compliance,

where this is necessary to fulfil the licence agreement. In such cases, we seek to minimise personal data and use pseudonymisation where possible.

5.3 Account integrations and data aggregators (if applicable in the future)

If, at a later stage, we allow you to connect external accounts (for example a brokerage account via a third-party aggregator such as Plaid, Tink or similar), then:

• The relevant aggregator will be listed as a processor/sub-processor
• This will be explicitly stated in an updated version of this Privacy Policy and/or in a separate overview of sub-processors
• Data retrieved via such integrations will only be used for purposes you are clearly informed about (e.g. portfolio overview in the Platform)

5.4 Public authorities and legal claims

We may share personal data if we are legally obliged to do so, for example:

• Following a final order from a court or supervisory authority
• In connection with enforcing our rights (for example in cases of serious misuse or fraud)

5.5 Corporate changes

If Kvantra undergoes a merger, acquisition or other corporate transaction, personal data may be included as part of the transaction. In such cases, we will:

• Limit sharing to what is necessary
• Ensure that the recipient maintains a privacy regime that is at least at the same level

6. Transfers outside the EEA

Some of our providers may be established outside the EEA or use infrastructure located outside the EEA.

For such transfers, we ensure an adequate level of protection, for example by:

• Using countries covered by an EU Commission adequacy decision; and/or
• Entering into Standard Contractual Clauses (SCCs) approved by the EU Commission, combined with necessary technical and organisational measures.

You can contact us at Contact@Kvantra.ai if you want more detailed information about relevant transfers and safeguards.

7. Storage periods (retention)

We do not store personal data longer than necessary for the purposes above, unless the law requires longer storage.

Typical storage periods:

Account data (identity, login, subscription):

– For as long as you have an active account, and then normally up to 24 months after deletion/deactivation, in order to handle disputes, log requirements and reactivation.

Portfolio, watchlist and analysis configuration:

– For as long as the account is active, and then normally up to 12 months after account deletion, before data is anonymised or deleted.

– This applies in particular to data you have entered yourself about portfolios, positions, ratings and notes.

Usage and security logs:

– Detailed logs: normally up to 12 months.

– Aggregated statistics without identifiable elements may be retained longer.

Payment and transaction data:

– At least 5 years after the end of the financial year, in accordance with bookkeeping legislation.

Support dialogue and email correspondence:

– Normally up to 36 months after the last active case, unless there is a need for longer storage in connection with disputes or compliance.

Marketing consents and opt-outs:

– Until you unsubscribe or the relationship ends, plus a short transitional period for technical processing (normally max 6 months).

When the storage period has expired, the personal data will be either deleted, anonymised or irreversibly pseudonymised.

8. Cookies and similar technologies

We use cookies and similar technologies for:

• Necessary functions (login, session management, security)
• Preferences (language, display settings)
• Analytics and statistics (how the Platform is used)
• Any marketing (for example measuring traffic from campaigns)

You will be informed via our cookie banner when you visit the Platform for the first time and can:

• Accept all,
• Accept only necessary, or
• Customise settings.

You can change your consent to non-essential cookies at any time via your browser settings or dedicated settings on the Platform (where such functionality is available).

9. Your rights

As a data subject, you have rights under the GDPR. You can exercise these by contacting us at Contact@Kvantra.ai.

9.1 Right of access

You can request confirmation as to whether we process personal data about you and obtain a copy of such data.

9.2 Right to rectification

You can ask us to correct or supplement information that is inaccurate or incomplete.

9.3 Right to erasure (“right to be forgotten”)

You can ask us to delete personal data in certain situations, for example when:

• The data is no longer necessary for the purpose
• You withdraw consent and we have no other legal basis
• You object to processing and there are no overriding legitimate grounds to continue

We may be obliged to store certain data longer (e.g. invoice data).

9.4 Right to restriction of processing

You can ask us to restrict processing for certain periods, for example while we assess an objection or the quality of the data.

9.5 Right to data portability

For data you have provided to us, and which is processed based on consent or contract, you can request that it be provided to you in a structured, commonly used and machine-readable format, and that it be transmitted to another controller where technically feasible.

9.6 Right to object

You can object to processing carried out on the basis of our legitimate interests, including profiling related to such interests.

You can always object to processing for direct marketing purposes – and we will then stop such processing.

9.7 Right to withdraw consent

If we process data based on your consent, you can withdraw this at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

9.8 Right to lodge a complaint

You have the right to lodge a complaint with your local supervisory authority if you believe our processing violates data protection rules.

In Norway, the supervisory authority is Datatilsynet (the Norwegian Data Protection Authority).

We nevertheless encourage you to contact us first, so we can attempt to resolve the issue.

10. Automated decision-making and profiling

We use analytics and algorithms to:

• Calculate factors, scores and ranking models for companies and markets
• Understand how features are used, at an aggregated level

We do not use automated decision-making that:

• Produces legal effects concerning you, or
• Similarly significantly affects you personally,

as defined in GDPR Article 22. Any changes to this will require an explicit, updated information notice.

11. Changes to this Privacy Policy

We may update this Privacy Policy when necessary (for example due to new features, new providers or regulatory changes).

The version in force at any given time will be available on the Platform.

The “Effective date” at the top will be updated.

In the case of material changes, we will notify you via email and/or within the Product.

12. Contact information

For questions, access requests or other enquiries related to privacy:

Kvantra Operations AS (org.nr 937 809 697)

Email: Contact@Kvantra.ai

Keiser Wilhelms gate 22, 6003 Ålesund