Legal

Privacy Policy

Effective August 4, 2026 · Version 1.0

This Privacy Policy explains how QuantumFlow LLC (“QuantumFlow,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you use QuantumFlow’s websites, applications, market-intelligence tools, alerts, reports, artificial-intelligence features, Telegram features, Nexus community, support channels, and related services (collectively, the “Service”).

This Privacy Policy applies to personal information handled by QuantumFlow as a controller or equivalent responsible entity under applicable law. It does not replace the privacy policies of third parties that independently control information, such as Stripe, Telegram, or an exchange or website you choose to visit.

1. Who controls your information

The controller of personal information covered by this Privacy Policy is:

QuantumFlow LLC
1654 Calle Tulipán, Ste 100
San Juan, PR 00927-6242
United States

Privacy questions and requests may be sent to [email protected].

2. Information we collect

The information we collect depends on how you interact with the Service.

2.1 Account and profile information

We may collect:

Your display name, username, avatar, role, and posts may be visible to other Nexus members. You control whether an optional display name or avatar identifies you personally.

2.2 Waitlist and access-request information

When you join a waitlist or request access, we may collect your email address, IP address, browser or User-Agent information, source page, submission status, approval status, and relevant timestamps. We use this information to manage access, prevent abuse, and send requested waitlist, launch, or availability communications.

2.3 Billing and transaction information

When billing is available, our payment processor may collect your name, billing address, country, payment method, tax status, business-purchase status, tax identification number, and other checkout information. QuantumFlow generally does not receive or store complete card numbers or card security codes.

We may receive and retain transaction metadata such as customer and subscription identifiers, plan, amount, currency, tax, invoice and receipt information, payment status, renewal date, cancellation status, failed-payment status, chargeback or dispute information, and fraud or risk signals.

Payment processors may independently process information for payment-network compliance, fraud prevention, tax, legal compliance, and their own legitimate purposes. Their privacy notices also apply.

2.4 Device, log, security, and approximate-location information

We may automatically collect:

For compromised-password screening, the Service may send a partial cryptographic hash prefix to the Have I Been Pwned Pwned Passwords service. QuantumFlow does not send the complete password or complete password hash through that lookup.

2.5 Product usage and analytics information

Subject to applicable consent requirements, we may collect information about how you use the Service, such as page views, navigation, feature usage, button interactions, subscription or account attributes, performance measurements, and errors.

We currently use PostHog for product analytics. Analytics may use cookies, local storage, device identifiers, and identified user profiles. Session replay or heatmap features may be used only when enabled, configured to protect sensitive fields, and permitted by applicable law and your consent where required.

QuantumFlow uses deliberately defined PostHog events and disables PostHog autocapture. These direct analytics events are not designed to include passwords, payment fields, Oracle prompt text, Telegram conversation content, or Nexus post, reply, or message text. PostHog may nevertheless receive user or account identifiers, page and feature activity, selected chart context, error and performance information, browser and device information, IP addresses, and additional interface information through heatmaps or session replay if those features are enabled.

Section 8 describes these technologies and available choices.

2.6 Oracle and other AI information

When you use Oracle or another AI-assisted feature, we may collect and retain the following information as described in Section 10:

Do not submit information that is unnecessary or that you are not authorized to disclose. AI providers may process these inputs to provide the requested output, maintain security, and comply with law, subject to their applicable contractual terms and data controls.

2.7 Telegram information

If you connect or communicate with a QuantumFlow Telegram bot, we may collect and store:

Using /clear, /unlink, or another Telegram command may clear active context or disconnect the integration without erasing all historical security, operational, or AI trace records. QuantumFlow does not ordinarily retain a separate image copy after a generated chart is delivered, but related inputs, specifications, and delivery records may be retained as described below. Telegram may retain delivered messages and media under its own privacy policy.

2.8 Nexus community information

When you use Nexus, we may collect:

Nexus is a member community. Other members may copy, quote, screenshot, or retain information you post. Do not post information you do not want other members to see.

Canceling a subscription does not automatically remove Nexus posts. If you request account deletion, posts may remain while direct account attribution is removed or replaced with “Deleted User,” subject to legal, safety, moderation, and operational exceptions.

2.9 Alerts, reports, watchlists, and preferences

We may collect assets, symbols, thresholds, conditions, report selections, watchlists, notification channels, Telegram destinations, public-link settings, chart layouts, drawings, saved views, delivery preferences, and related event and delivery logs.

If you create a public or shareable report link, anyone with access to that link may be able to view the associated report. We may log link views and related technical information.

2.10 Communications and support

We collect communications you send to support, legal, privacy, copyright, takedown, or other QuantumFlow addresses. This may include your contact information, message content, attachments, account information, and records of our response.

Email may be processed and retained by our outbound email provider, email-routing provider, and mailbox provider. We may maintain delivery logs including recipient, sender, subject, category, provider message identifier, delivery status, bounce or suppression status, and error information.

2.11 Financial or trading information you voluntarily provide

QuantumFlow does not automatically connect to or import your brokerage accounts, exchange accounts, holdings, account balances, transaction histories, or risk profile. You may voluntarily disclose positions, holdings, trading history, goals, preferences, or risk-related information through Oracle, Telegram, Nexus, feedback, or support.

Such information is treated as content you chose to provide. Providing it does not create an investment-advisory, fiduciary, brokerage, or personalized financial relationship.

2.12 Information derived from other information

We may derive approximate location, account status, feature eligibility, security risk, suspected account sharing, engagement information, preferences, or aggregated usage statistics from the information described above.

2.13 Required and optional information

An email address, username, and authentication credentials are required to create and maintain an account. Necessary billing information must be provided to our payment processor to purchase and maintain a paid subscription. If you do not provide this information, we may be unable to create or authenticate your account, process payment, or provide the Service.

Display names, avatars, Nexus posts, Telegram connections, watchlists, feedback, and voluntary financial or trading information are optional unless a particular feature you request requires them.

3. Sources of information

We obtain personal information:

4. Why we use information

We use personal information to:

We do not use personal information to provide individualized investment advice or to execute trades for users.

Where the European Economic Area or United Kingdom data-protection laws apply, our legal bases include:

5.1 Contract

We process information necessary to create your account, provide requested features, administer your subscription, deliver alerts or reports, operate Nexus, and respond to support requests.

5.2 Legitimate interests

We process information as reasonably necessary for security, fraud prevention, service improvement, debugging, account administration, limited direct marketing where permitted, legal claims, and operating a safe community. We balance these interests against your rights and expectations.

We rely on consent where required for optional analytics cookies, similar technologies, certain marketing communications, or another activity presented as optional. You may withdraw consent at any time without affecting processing already completed lawfully.

We process information to comply with tax, accounting, sanctions, consumer-protection, privacy, safety, law-enforcement, and other legal obligations.

5.5 Vital interests

In rare situations, we may process or disclose information when necessary to protect the vital interests of a person, such as responding to a credible and immediate threat to life or safety.

6. How we disclose information

We may disclose personal information as follows.

6.1 Service providers and subprocessors

We use providers for hosting, infrastructure, content delivery, security, bot prevention, payments, tax, email, analytics, AI processing, support, and related operations. A provider may process information on our behalf for some activities and act as an independent controller for others. Corporate entities, subprocessors, and locations may vary with the service and user location.

Depending on the features you use, our service providers include or may include:

ProviderServicesInformation involvedPrincipal processing locations
Hetzner Online GmbHServer hosting, networking, storage, databases, and backupsAccount information, user content, Oracle records, logs, preferences, security information, and other Service dataGermany, with support or ancillary processing as described by Hetzner
Cloudflare and applicable affiliatesDNS, content delivery, web security, proxying, tunnels, rate limiting, Turnstile, and potentially inbound email routingIP address, requests, security and device information, challenge data, email-routing metadata, and content transmitted through proxied servicesGlobal, including the United States and European Economic Area
Stripe and applicable affiliatesCheckout, recurring billing, Customer Portal, payment processing, automatic tax, tax-ID collection, invoices, fraud prevention, disputes, refunds, and subscription managementName, email, billing address, country, payment and tax information, transactions, device and fraud signals, and subscription statusGlobal, including the United States and European Economic Area
Plus Five Five, Inc., doing business as ResendEmail delivery, delivery logs, bounces, and suppression managementEmail address, sender and recipient information, message subject and content, tags, provider identifiers, status, and errorsUnited States and locations used by Resend's subprocessors
Google and applicable Google Cloud affiliatesVertex AI processing, Google Workspace email, and related cloud servicesAI prompts and responses, conversation context, screenshots, tool and market-data results, email content and metadata, account correspondence, and technical logsGlobal, including the United States, subject to the selected Google Cloud configuration
OpenAI and applicable affiliatesOptional or alternate AI processing through the OpenAI APIPrompts, conversation history, screenshots where applicable, market-data and tool results, generated responses, and request metadataGlobal, including the United States
PostHog, Inc.Product analytics, feature usage, performance and error analysis, heatmaps, and session replay if enabledAccount or user identifiers, IP address, device and browser information, page views, events, feature use, performance data, and replay data if enabledUnited States, with other locations used by PostHog's subprocessors

Security or user-directed services may also receive limited information:

Stripe and Telegram may independently determine certain processing purposes, including fraud prevention, regulatory compliance, payment-network operation, platform security, and account administration. Their privacy policies apply to those activities.

QuantumFlow also obtains market information from exchanges and data providers. These sources are not ordinarily personal-information subprocessors because server-side collection generally does not send them customer accounts, prompts, Nexus posts, or other customer content. They may receive QuantumFlow infrastructure IP addresses and ordinary connection metadata. If a future feature sends customer personal information to a market-data provider, we will provide appropriate notice.

6.2 Other users and the public

Nexus profile information and User Content are visible to other authorized Nexus members. Content you intentionally publish through a public report link or other public feature may be visible to anyone with access to the link or page.

6.3 User-directed services

We disclose information when you direct us to connect or interact with Telegram, Stripe, a shared link, or another third-party service.

6.4 Business transfers

We may disclose information in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.

We may preserve or disclose information when we reasonably believe it is necessary to comply with law or valid legal process; enforce our agreements; collect amounts owed; protect QuantumFlow, users, or others; investigate fraud, security incidents, illegal content, or abuse; or establish, exercise, or defend legal claims.

6.6 Professional advisers

We may disclose information to attorneys, accountants, auditors, insurers, and other professional advisers subject to appropriate duties of confidentiality.

6.7 Aggregated and deidentified information

We may use and disclose information that has been aggregated or irreversibly deidentified so that it no longer identifies or is reasonably linkable to you. We commit to maintaining and using such information in deidentified form and will not attempt to reidentify it except solely to test whether our deidentification processes are effective or where required by law.

7. AI providers

QuantumFlow currently supports Google Vertex AI and OpenAI. QuantumFlow may also use third-party hosted models, self-hosted open-source models, proprietary models, custom models, or a combination. The provider or model used may depend on the feature, availability, configuration, performance, or operational needs.

When a third-party AI provider is used, it may receive prompts, conversation history, Telegram messages, screenshots, chart context, market-data results, tool outputs, and related instructions as described above.

QuantumFlow’s own databases and logs may retain more extensive Oracle history and operational traces than the AI provider retains. Provider retention, abuse-monitoring, caching, and contractual controls vary by provider and configuration. We will describe material provider changes in this Privacy Policy.

QuantumFlow may review identifiable Oracle records and User Content when reasonably necessary to provide requested history, investigate specific feedback or failures, secure the Service, prevent abuse, provide support, or establish or defend legal claims. For general product evaluation, feature development, and internal model development, QuantumFlow uses information that has been aggregated so that it no longer identifies or is reasonably linkable to an individual, or has otherwise been irreversibly deidentified.

QuantumFlow does not currently use identifiable Oracle records or User Content to train or fine-tune any artificial-intelligence or machine-learning model. If that practice changes, we will provide appropriate prior notice and obtain any consent required by applicable law.

Under our current provider arrangements, QuantumFlow does not authorize third-party AI providers, including Google or OpenAI, to use Service inputs or outputs to train or fine-tune their general-purpose models. Provider security, abuse-monitoring, caching, and retention practices may still apply.

8. Cookies and similar technologies

Cookies are small text files stored by a browser or device. Local and session storage let an application store information in a browser. Pixels, tags, and software development kits can record events or communicate with a provider. This section refers to them collectively as “cookies and similar technologies.”

8.1 Categories

We use or may use:

QuantumFlow does not use advertising cookies for cross-context behavioral or targeted advertising at launch. We will update this Policy and request legally required consent before introducing them.

Session replay, if enabled, may capture interactions and visible interface information. QuantumFlow will use session replay only after reviewing its masking and exclusion configuration and implementing consent controls required by applicable law. No masking configuration can guarantee that every unexpected disclosure will be excluded, so do not enter unnecessary sensitive information.

8.2 Technology schedule

The following schedule summarizes technologies QuantumFlow uses or may use depending on the features and configuration involved. Exact names, domains, and durations may vary by browser, provider, configuration, and later Service changes.

Provider or featureCategoryPurposeTypical storage period
QuantumFlow authenticationNecessaryLogin, session continuity, account security, and token rotationSession-based or until the applicable session expires
QuantumFlow privacy preferencesNecessaryStore consent choices and avoid repeatedly requesting the same choiceUp to 12 months, then renewed as appropriate
CloudflareNecessaryContent delivery, network security, bot protection, rate limiting, and Turnstile challengesSession-based or as set by Cloudflare for the security purpose
Stripe Checkout and Customer PortalNecessaryCheckout, payment authentication, fraud prevention, subscription management, and tax processingDetermined by Stripe for the applicable payment and security purpose
QuantumFlow preferencesFunctionalTheme, chart, layout, and interface choicesSession-based or until cleared or changed
PostHogAnalyticsProduct analytics, page views, feature use, performance, and error analysisAccording to the applicable project configuration and consent choices
PostHog session replay or heatmapsAnalyticsDiagnose interface and usability problems, if enabledAccording to the applicable project configuration and consent choices

Third-party checkout or linked services may set technologies on their own domains under their own policies.

Where applicable law requires consent, QuantumFlow will not enable optional analytics technologies until you make an affirmative choice. Accepting the Terms, acknowledging this Policy, purchasing a subscription, or continuing to browse is not consent where a separate choice is required.

You may accept, reject, or configure optional public-site categories through the cookie banner or “Manage privacy preferences” link. Registered users may manage in-app usage analytics in Settings under Security. Withdrawing consent does not affect earlier lawful processing. Most browsers also let you inspect, block, or delete cookies and site storage, but blocking necessary storage may prevent login, checkout, saved layouts, security controls, or other features from working. Browser deletion does not necessarily erase information already transmitted to QuantumFlow or a provider.

Where legally required and technically applicable, QuantumFlow will honor recognized browser-based opt-out signals such as Global Privacy Control. Because QuantumFlow does not sell personal information or use it for targeted advertising at launch, such a signal may not change behavior beyond applicable analytics choices. There is no universally accepted response standard for the separate “Do Not Track” signal.

8.4 Email technologies

QuantumFlow does not intentionally enable optional email open or click tracking unless the practice is accurately disclosed and lawfully configured. Email providers still process delivery information needed to send, route, suppress, troubleshoot, and secure messages. Promotional messages will include an unsubscribe mechanism where required.

9. Marketing and service communications

We may send:

You may unsubscribe from promotional email using the link in the message or by contacting support. Opting out of marketing does not stop necessary transactional, security, legal, subscription, or service communications.

Joining a waitlist does not by itself constitute consent to unrelated or indefinite marketing where specific consent is required. We will request any additional marketing consent required by applicable law.

10. Retention

Except where a more specific statement below applies, we retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide and improve the Service, preserve requested history, maintain security, satisfy legal obligations, resolve disputes, and enforce agreements.

Our retention framework is:

We may retain aggregated or irreversibly deidentified information indefinitely when it no longer identifies or is reasonably linkable to an individual. Removing only a user ID or account relationship does not make content anonymous if the remaining content can still reasonably identify someone.

11. Account deletion and privacy requests

Account deletion and subscription cancellation are different. To request access, correction, deletion, restriction, portability, or another applicable privacy right, email [email protected].

We may verify your identity and account ownership before acting. Verification information will be used only to process the request, prevent fraud, and maintain an appropriate record of our response.

Deletion does not require us to erase information that must or may lawfully be retained for invoices, tax, fraud, payment disputes, security, legal holds, moderation evidence, legal claims, freedom of expression, or the rights of others. When legally permitted, QuantumFlow may honor a deletion request by deleting the account association and irreversibly removing or transforming other identifying information while retaining the resulting deidentified content. If the content itself remains reasonably identifiable, it remains personal information and will be deleted when applicable law requires deletion and no exception permits retention.

12. Your privacy rights

Depending on where you live and subject to exceptions, you may have the right to:

QuantumFlow does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under applicable US state privacy laws. We do not use personal information for targeted advertising at launch. If these practices change, we will update this Privacy Policy and provide any notice, consent, or opt-out mechanism required by applicable law before beginning the activity.

We will not discriminate against you for exercising an applicable privacy right. Authorized agents may submit requests where permitted by law, subject to verification of their authority and your identity.

EEA and UK requests generally will be answered within one month, subject to lawful extensions. Other requests will be answered within the period required by applicable law.

To exercise a right or appeal a decision, email [email protected]. Include enough information for us to identify the account and understand the request, but do not send unnecessary identity documents unless requested through a secure method.

13. International data transfers

QuantumFlow operates from Puerto Rico and uses service providers that may process personal information in the United States, European Economic Area, and other countries. Those countries may have privacy laws different from the laws where you live.

International transfers are governed by applicable law and the terms and data-protection arrangements of the relevant provider. Depending on the provider, destination, and applicable law, available transfer mechanisms may include an adequacy decision or regulation, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, a recognized data-transfer framework, or another lawful mechanism.

You may contact [email protected] to request more information about any safeguards applicable to a particular transfer.

14. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No online service or storage system is completely secure, and we cannot guarantee absolute security.

Where required by applicable law, we will notify affected individuals and relevant authorities of a personal-information breach in the required manner and timeframe.

You are responsible for using a strong, unique password, protecting authentication credentials, securing your devices, and promptly reporting suspected compromise to [email protected].

15. Automated decision-making

QuantumFlow may use automated systems to detect fraud, abuse, account sharing, or security risk and to generate market analysis. QuantumFlow does not use solely automated processing to make decisions about you that produce legal or similarly significant effects, except where permitted by law with required safeguards.

AI-generated market output concerns financial markets, not eligibility for credit, employment, housing, insurance, education, or another legally significant opportunity.

16. Children

The Service is not intended for anyone under 18, and we do not knowingly permit anyone under 18 to create or use an account. If you believe a person under 18 has provided personal information through the Service, contact [email protected].

Users who have not reached the age of majority where they live or otherwise lack legal capacity must have the authorization and supervision described in the Terms of Service.

The Service may link to exchanges, market-data sources, Telegram, payment services, social networks, or other third parties. Their privacy practices are governed by their own notices. QuantumFlow is not responsible for the privacy practices of independent third parties.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, providers, practices, or law. We will post the updated version and revise the effective date.

For material changes, we will provide notice by email, through the Service, or by another reasonable method. When practical, we will provide notice at least 30 days before a material change takes effect. We will request consent where required by law.

19. Contact and complaints

Privacy requests, questions, legal notices, and complaints: [email protected]
General support: [email protected]

QuantumFlow LLC
1654 Calle Tulipán, Ste 100
San Juan, PR 00927-6242
United States

If EEA or UK data-protection law applies, you may also complain to the supervisory authority where you live, work, or believe a violation occurred. We encourage you to contact us first so we can try to resolve the concern.