Privacy Policy

This Privacy Policy applies to the QuantikLab website at https://www.quantiklab.io and https://quantiklab.io, the QuantikLab web application at https://app.quantiklab.io, and the related services, features and communications made available under the QuantikLab name.

It describes the personal data we collect, why we use it, the legal bases on which we rely, the service providers that may process it on our behalf and the rights available to you.

This Policy does not apply to third-party websites, services or platforms that may be linked from QuantikLab and that operate under their own privacy policies.

QuantikLab is an independent project operated from France under the QuantikLab name. It is not currently operated through a registered company, sole proprietorship, association or other legal entity.

For the processing described in this Privacy Policy, QuantikLab acts as the data controller. No data protection officer has been appointed at this time.

Privacy questions and requests can be sent using the contact details provided at the end of this Policy.

The personal data we collect depends on how you interact with QuantikLab and which features you choose to use.

• Account and authentication data, such as your email address, internal user identifier, sign-in information and authentication records handled through our authentication provider.
• Profile data, such as your username, display name, profile image, biography, preferences, privacy settings and any information you choose to add to your profile.
• Product and community content, such as simulated orders and trades, assets, prices, quantities, dates, strategies, results, performance analytics, public posts, comments, likes, follows and other content you create while using QuantikLab.
• Contact and communication data, including your email address, the content of messages you send us and information needed to answer support, privacy or general enquiries.
• Technical data, such as your IP address, browser type, device type, operating system, approximate location derived from your IP address, language, referring page and timestamps.
• Usage and analytics data, such as pages viewed, navigation paths, clicks, feature interactions, session activity and other events used to understand how the website and application are used.
• Security and diagnostic data, such as authentication events, error logs, abuse signals and technical records used to protect QuantikLab and investigate incidents.

Please do not submit passwords for third-party services, real broker credentials, government identification documents, health data or other sensitive personal information unless QuantikLab expressly requests it for a clearly explained and lawful purpose.

Some QuantikLab features may allow you to make selected profile information, simulated trading activity, strategies or performance metrics visible to other users or to the public.

New profiles are public by default. The available visibility settings allow you to control precisely which eligible profile information and simulated-performance data is shown publicly, and you should review those settings before publishing content.

Before making information public, consider that other people may view, copy, redistribute or independently retain it. Search engines may also index publicly accessible information where technically permitted.

We use personal data only where we have a defined purpose and a lawful basis for doing so.

• To create, authenticate and manage your account and provide the features you request. The legal basis is generally the performance of our agreement with you or steps taken at your request before entering into that agreement.
• To save and display your profile, settings, simulated trading activity, journal content and analytics. The legal basis is generally the performance of our agreement with you.
• To answer questions, provide support and manage communications. The legal basis may be the performance of our agreement, your request or our legitimate interest in supporting users.
• To operate, maintain, debug and improve QuantikLab. The legal basis is our legitimate interest in providing a reliable and useful service, subject to your rights and reasonable expectations.
• To protect accounts, detect abuse, prevent fraud and maintain the security of the website and application. The legal basis is our legitimate interest in protecting QuantikLab and its users.
• To measure website and product usage through non-essential analytics tools. Where required by law, the legal basis is your consent.
• To comply with applicable laws, enforce our terms and respond to valid legal requests. The legal basis is compliance with a legal obligation or our legitimate interest in establishing, exercising or defending legal claims.

QuantikLab uses technical storage and similar technologies where they are necessary for authentication, security, language preferences and the basic operation of the service.

We also use PostHog and Google Analytics to understand traffic, page views, navigation and interactions with our website and application. These services may process online identifiers, device and browser information, IP-derived information and usage events.

Where consent is required, non-essential analytics technologies are activated only after you have made a choice. You may withdraw your consent at any time by changing your cookie preferences.

Analytics data is used to identify technical problems, understand which features are useful, improve navigation and measure the general performance of QuantikLab. It is not intended to be used to make investment decisions or assess your financial suitability.

PostHog Session Replay is currently disabled. PostHog is configured not to store client IP addresses with events, although an IP address may be used transiently for functions such as geolocation enrichment or bot detection before being discarded.

We share personal data only where necessary to operate QuantikLab, comply with the law, protect our rights or provide a feature requested by you.

The service providers currently used include:

• Supabase, for authentication, database, backend and related infrastructure services.
• PostHog, for product analytics, page-view measurement and interaction analytics.
• Google Analytics, for website traffic and usage analytics.
• Vercel, for frontend hosting and content delivery; Railway, for backend hosting; and Hostinger, for domain-name registration and related domain services.
• Supabase, Resend and Gmail, for contact forms, email delivery and support communications.
• Third-party market-data providers, where they are necessary to provide, secure or maintain QuantikLab.

QuantikLab does not sell personal data. Providers receive only the data reasonably necessary for their role and are subject to their own contractual, security and data-protection obligations.

We may disclose personal data where we reasonably believe disclosure is required by applicable law, regulation, court order or another valid legal process.

We may also disclose information where necessary to investigate fraud, security incidents, misuse of the service, threats to users or violations of our terms.

If QuantikLab is reorganised, transferred to a company, financed, acquired or involved in another business transaction, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and data-protection measures.

Some service providers may process personal data in countries outside your country of residence, including outside the European Economic Area, the United Kingdom or Switzerland.

Where applicable law requires safeguards for an international transfer, we seek to rely on recognised transfer mechanisms, such as an adequacy decision, standard contractual clauses, a valid data-protection framework or another lawful safeguard.

The actual storage and processing locations may depend on the regions selected in Supabase, PostHog, Google and our hosting infrastructure.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, maintaining security, resolving disputes and complying with legal obligations.

Account, profile and product data is generally retained while your account remains active. When you delete your account, associated data is removed from active systems without undue delay. Limited residual copies may remain temporarily in provider-managed logs or backups until their normal expiry, where applicable.

Support and contact communications are retained for at least six months and longer where reasonably necessary to handle the request or protect legal rights.

Google Analytics data is retained for the period configured in the relevant Google Analytics 4 property, subject to Google’s applicable limits and settings. No custom retention period has been confirmed at the date of this Policy.

PostHog event data is retained for the period made available by the applicable PostHog plan and project settings. The exact period may change with the plan or configuration.

Security, authentication and infrastructure logs are retained for the periods applied by the relevant providers and only for as long as reasonably necessary for security, diagnostics and abuse prevention.

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction.

These measures may include access controls, authentication protections, encrypted communications, database security rules, monitoring, backups and restrictions on who may access operational systems.

No online service can guarantee absolute security. You are responsible for choosing secure authentication methods, protecting access to your account and notifying us if you suspect unauthorised activity.

Depending on where you live and which law applies, you may have rights over your personal data.

• The right to request access to personal data we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request deletion of personal data in applicable circumstances.
• The right to request restriction of certain processing.
• The right to receive certain data in a portable format.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
• The right to lodge a complaint with the data-protection authority responsible for your country or region.

We aim to acknowledge privacy requests within 48 hours and respond within the period required by applicable law. Where possible, send your request from the email address associated with your account. We may request reasonable information to verify your identity, and some rights may be limited where a legal exemption applies.

QuantikLab may calculate statistics, rankings, scores or analytical indicators from simulated trading data.

These product calculations are intended to provide information and feedback. QuantikLab does not use them to make decisions that produce legal effects or similarly significant effects concerning you.

QuantikLab does not provide investment advice and does not determine whether you should make a real-money investment.

QuantikLab is intended for users aged 16 or older. If you are under the age of legal majority or do not have the legal capacity to accept the applicable terms in your country, you may use QuantikLab only with the permission of a parent or legal guardian.

If you believe that a child has provided personal data without the required authorisation, contact us so that we can review and, where appropriate, delete the information.

We may update this Privacy Policy when our services, providers, data practices or legal obligations change.

The updated version will be published on this page with a revised date. For material changes, we may also notify you by email, an in-app notification and/or a notice on the website, and we may request renewed consent where applicable law requires it.