Privacy policy

Quantral (“we”, “our”) operates the website at quantral.com, the app at app.quantral.com, and our mobile apps. This policy explains what we collect, why we collect it, the legal bases we rely on, and what control you have over it.

Who runs Quantral

Quantral is operated by Mayako LTD, a private limited company registered in Varna, Bulgaria (registration number 205469135). Mayako LTD is the data controller. You can reach us at [email protected].

What we collect

• Reservation email, when you reserve a spot from the website.
• Account details: your name, email address, a hashed password if you sign up with email, and an optional profile image.
• Sign in with Apple or Google: a unique identifier from the provider, and your email. If you use Apple’s “Hide My Email”, we receive a private relay address instead of your real one. We never receive your Apple or Google password.
• Authentication data: session and refresh tokens, and an authentication cookie that keeps you signed in.
• App activity: your watchlist and how you use features, and push-notification tokens if you enable notifications.
• Website usage: pages you view, the page that referred you, approximate location derived from your IP address, and device and browser type, collected through analytics cookies on the website (see Cookies and analytics below).
• Subscription and payments: subscription status and customer identifiers from RevenueCat and Stripe, and invoice records. We do not store card numbers; payment card data is handled directly by Stripe.
• Server logs: IP address, request URL, user agent, and timestamps, as part of normal operations.

Why we use it, and our legal bases

• To create and run your account and provide the Service, and to process your subscription: performance of a contract with you.
• To keep the Service secure, prevent abuse, and debug: our legitimate interests.
• To measure traffic and understand how the website and app are used through analytics: your consent for non-essential cookies where consent is required, and otherwise our legitimate interest in understanding usage in aggregate.
• To keep tax and accounting records such as invoices: compliance with a legal obligation.

Sign in with Apple

If you sign in with Apple, you can share your real email or use “Hide My Email”. With Hide My Email, Apple gives us a private relay address, which we use only to send you account and service emails. If you delete your account, we revoke the Apple token associated with your sign-in so that Quantral no longer has access through Apple.

Who we share it with

We do not sell your information or share it for advertising. We rely on a small number of service providers, acting as our processors:

• Apple and Google provide third-party sign-in.
• RevenueCat and Stripe handle subscription billing and payments.
• Resend delivers transactional and account emails.
• PostHog provides product analytics, hosted in the EU, so we can understand usage in aggregate and improve the Service.
• Google Analytics (Google) provides website traffic analytics; Google may process this data in the United States. We use it only for analytics, never advertising.
• Our hosting and database providers run the app and store your data.
• Cloudflare hosts and delivers the website, and provides our CDN and DNS.

To generate scores and explanations, we also process public market data and public social-media content through third parties (for example market-data and AI providers). That processing uses public content, not your account information.

International transfers

Some of our providers are located outside the European Economic Area, for example in the United States. Where your information is transferred outside the EEA, the transfer is covered by appropriate safeguards, such as the European Commission’s standard contractual clauses or an applicable adequacy framework.

How long we keep it

• Account data: while your account is open, and for a short period after you delete it.
• Authentication tokens: until they expire or you sign out.
• Invoices and tax records: for as long as Bulgarian law requires us to keep them.
• Reservation email: until you ask us to delete it, or we no longer need it.
• Logs: per the defaults of our hosting provider.

Deleting your account

You can delete your account at any time from the account screen in the app. This removes your account, your login methods, and your watchlists, revokes Sign in with Apple where you used it, and cannot be undone. Deleting your account does not by itself cancel a subscription billed through an app store; cancel that through the store. You can also email us to request deletion.

Your rights

Depending on where you live, you may have rights under the GDPR, UK GDPR, CCPA, or similar laws, including the right to access, correct, delete, or port your information, and to object to or restrict processing. To exercise any of these, email us at [email protected]. We will respond within 30 days. You also have the right to complain to your local data protection authority. In Bulgaria, that is the Commission for Personal Data Protection (CPDP).

Cookies and analytics

We use a strictly necessary authentication cookie to keep you signed in. On the website we also use analytics cookies, set by Google Analytics and PostHog, to measure traffic and understand how the site is used: for example pages viewed, approximate location from your IP address, and device and browser type. We never use cookies for advertising, and we do not sell your data.

In the EEA, the UK, and Switzerland we show a cookie banner so you can decline non-essential analytics cookies, and we remember your choice. In other regions we use analytics cookies by default. Wherever you are, you can opt out at any time, which switches off the analytics cookies and signals both Google Analytics and PostHog not to track you.

Your browser settings also let you block or delete cookies, and Google offers a Google Analytics opt-out browser add-on. Blocking the authentication cookie will stop you from staying signed in.

People under 18

The Service is not directed at people under 18, and is intended for adult users only. We do not knowingly collect information from anyone under 18. If you believe an under-18 user has signed up, email us and we will remove the record.

Changes

If we update this policy, we will revise the “last updated” date at the top. We will flag material changes before they take effect.

Contact

Mayako LTD, Varna, Bulgaria. Questions or requests: [email protected].