At Account Registration:

• We collect: Name, email, password
• Purpose: Create your account and provide the Service
• Retention: Duration of subscription + 30 days after deletion

Voice-to-Text Processing:

• We process (not store): Audio spoken into microphone
• We store: Text transcription generated by AI
• Purpose: Convert spoken trading journals into text
• Retention: Text transcriptions follow journal retention schedule
• Sharing: Audio transmitted to Google Gemini API for real-time processing only
• Audio storage: None - discarded immediately after transcription

Automatically Collected:

• We collect: Usage data (features used, login times), cookies
• Purpose: Improve service, analytics, security
• Retention: 2 years for identifiable data

Account Information (email, name, password hash):

• Active accounts: Duration of subscription
• After account deletion: 30 days for recovery, then permanent deletion
• Email addresses for anti-spam purposes: 2 years after deletion

Text Transcriptions & Journal Entries:

• Active users: Duration of subscription
• After account deletion: 30-day grace period or immediate deletion (user choice)
• Anonymized/aggregated data: May be retained indefinitely for product improvement

Screenshots/Images:

• Active users: Duration of subscription
• After deletion: 30-day grace period, then permanent deletion

Usage Analytics:

• Identifiable analytics: 2 years maximum
• Anonymized analytics: Indefinitely

Payment Records (via Stripe):

• Billing history: 7 years (financial/tax compliance)
• Note: Credit card details are never stored by us (handled by Stripe)

Backup Data:

• Deleted data is purged from backups within 90 days

Legal Basis for Processing:

• Consent: Voice-to-text processing (transient), marketing communications
• Contractual Necessity: Account data required to provide the Service
• Legitimate Interest: Fraud prevention, service improvement
• Legal Obligation: Tax records, compliance with law

Your GDPR Rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure ("Right to Be Forgotten"): Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: Withdraw consent at any time (doesn't affect prior processing)
• Automated Decision-Making: Right to human review of AI-generated decisions that significantly affect you

How to Exercise Your Rights

Contact privacy@quantcypher.com or support@quantcypher.com. We will respond within 30 days.

Right to Complain:

You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority) if you believe we are not complying with GDPR.

Data Protection Officer:

For GDPR-related inquiries, contact privacy@quantcypher.com

International Data Transfers:

If we transfer your data from the EEA to the United States, we use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection.

Categories of Personal Information We Collect (Last 12 Months):

• Identifiers (name, email, account ID)
• User-generated content (trading journals - text only, notes, images)
• Commercial information (subscription tier, payment history)
• Internet/network activity (usage data, login times)
• Audio (processed in real-time, not stored - transient processing only)

Sources of Personal Information:

• Directly from you (account registration, uploads, voice input)
• Automatically (usage analytics, cookies)
• From payment processors (Stripe - transaction confirmations)

Business/Commercial Purposes:

• Providing the Service (voice-to-text transcription, AI analysis)
• Account management and customer support
• Improving our algorithms and user experience
• Fraud prevention and security
• Legal compliance

Categories of Third Parties We Share With:

• AI service providers (Google Gemini API - for voice-to-text transcription only)
• Cloud hosting providers (Supabase, Vercel)
• Payment processors (Stripe)
• Analytics providers (if applicable)

Sensitive Personal Information:

Audio processed during voice-to-text may constitute sensitive personal information. However, we do not store audio - it is processed in real-time and immediately discarded. We only use audio for the sole purpose of providing transcription services during the API call.

Your California Rights:

• Right to Know: Request disclosure of personal information collected, used, or disclosed
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt-out of sale/sharing of personal information (we don't sell/share)
• Right to Limit Use of Sensitive Information: Limit use of sensitive data to necessary purposes
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

How to Exercise Your Rights

Email support@quantcypher.com with subject line "California Privacy Request" or use the contact form. We will verify your identity and respond within 45 days.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization.

Essential Cookies:

• Authentication (keeps you logged in)
• Security (prevents unauthorized access)
• These cannot be disabled without affecting functionality

Analytics Cookies:

• Usage analytics (which features are used most)
• Performance monitoring
• You can opt-out of analytics cookies

Cookie Duration:

• Session cookies: Deleted when you close browser
• Persistent cookies: Stored for up to 12 months

How to Manage Cookies

Browser settings allow you to block or delete cookies. Note: Disabling essential cookies may prevent login. For EU users: You will see a cookie consent banner on first visit. You can manage your preferences at any time.

Do Not Track:

Our website does not respond to "Do Not Track" browser signals. You can opt-out of analytics via Settings.