Privacy Policy

Effective date: April 29, 2026

1. Scope and Controller

Quantago is a cloud-based software platform for algorithmic trading strategy creation, backtesting, and automated bot execution. It is operated by Universal Reason LLC, a Wyoming limited liability company (“Quantago,” “we,” “our,” or “us”).

This Privacy Policy explains how we collect, use, store, and disclose information when you use the Quantago website, waitlist, application, marketplace, and broker-connected automation services.

This policy applies to information collected through quantago.co, app.quantago.co, and any related product surfaces that reference it.

Quantago is not a broker-dealer, investment adviser, custodian, or financial services firm. We are a software technology company. All brokerage services accessible through the platform are provided by third-party regulated brokers (such as Alpaca Securities LLC, member FINRA/SIPC) under their own terms and regulatory oversight.

2. Information We Collect

We collect information you provide directly, information generated through your use of the service, and limited technical data collected automatically.

Identity and account data: name, email address, login method (email/password or OAuth SSO), and account metadata.
Onboarding and application data: waitlist submissions, onboarding responses, support communications, and creator application details you submit.
Strategy and platform data: strategy prompts, configurations, backtests, execution settings, bot parameters, and marketplace listing content you create or upload.
Broker connection data: when you connect a third-party broker account (such as Alpaca), we receive and store the OAuth access token issued by that broker. This token is encrypted at rest using AES-256 and is never stored in plaintext, never logged, and never shared with third parties except the broker it was issued by. We store only the OAuth token and the metadata necessary to maintain your connection (e.g., broker name, connection status, token expiry). We do not store your broker username, password, or full account credentials. Connecting a broker account is voluntary and entirely at your direction; you may revoke access at any time.
Usage and technical data: performance metrics, execution logs, subscription status, device type, browser type, IP address (truncated), and security telemetry. We do not use persistent cross-site advertising trackers.

3. How We Use Information

We use information to operate the platform, secure accounts, deliver broker-connected automation, process subscriptions, communicate with you, and improve the service.

Legal bases for processing (where applicable under GDPR or similar laws): contract performance, legitimate interests, consent, and legal compliance.

Create and secure user accounts
Store and execute strategy workflows you configure and activate
Transmit instructions to broker APIs you have authorized, solely at your direction
Generate and display backtests, live performance history, and marketplace data
Administer subscriptions, creator payouts, onboarding, and support
Detect abuse, investigate security incidents, and comply with applicable law
Improve platform functionality and user experience

4. Broker Connections and Third-Party Services

When you connect a broker account through Quantago, you are authorizing that broker (not Quantago) to grant us a limited OAuth access token. The following applies to all broker connections:

Quantago acts only on instructions you have configured. We do not make discretionary trading decisions.
Quantago does not hold, custody, move, or have ownership of your funds. All assets remain in your broker account.
OAuth tokens are used exclusively to transmit the trade instructions your activated strategies generate. They are not used for any other purpose.
You may disconnect your broker account at any time, which revokes our ability to place further instructions. Disconnecting does not affect trades already executed.
Third-party brokers (such as Alpaca Securities LLC) operate under their own terms of service, privacy policies, and regulatory frameworks. Alpaca’s brokerage services are provided by Alpaca Securities LLC, member FINRA/SIPC. Quantago is not affiliated with or endorsed by Alpaca Securities LLC or AlpacaDB, Inc.

5. Sharing and Disclosure

We do not sell personal information. We share information only when necessary to operate the service, comply with law, protect the platform, or complete a transaction you request.

Infrastructure and hosting providers: Cloudflare, Inc. (edge compute, CDN, storage) and Neon, Inc. (database). These providers process data on our behalf under data processing agreements.
Authentication, analytics, observability, and support vendors: limited to what is necessary to operate the product.
Broker, exchange, and market-data providers you choose to connect: only the data necessary to fulfill your authorized connection is transmitted.
Payment processors: Stripe, Inc. processes subscription payments. We do not store full payment card data.
Marketplace visibility: if you publish a strategy to the marketplace, strategy titles, descriptions, pricing, and verified live performance metrics may be visible to other users. No personal account data is exposed.
Professional advisers, regulators, or law enforcement: where required by applicable law or to protect the rights and safety of the platform and its users.
Business transfers: in the event of a merger, acquisition, or asset sale, user data may be transferred as part of that transaction, subject to equivalent privacy protections.

6. Data Retention and Security

We retain information for as long as necessary to provide the service, operate the marketplace, comply with legal obligations, resolve disputes, and enforce agreements.

Active account data: retained for the duration of your account.
Broker OAuth tokens: deleted within 30 days of account deletion or broker disconnection, whichever is earlier.
Execution logs and performance data: retained for up to 2 years for audit and dispute resolution purposes.
Operational logs: stripped of PII and retained for up to 90 days.
Deleted account data: purged within 30 days of deletion request, except where retention is required by law.

Security measures

TLS 1.3 encryption in transit, AES-256 encryption for sensitive credentials at rest, Cloudflare WAF and DDoS protection, access controls and least-privilege principles, and automated vulnerability monitoring. No system can be guaranteed perfectly secure. You are responsible for maintaining the confidentiality of your own account credentials.

7. International Transfers

Quantago and its service providers process data across multiple countries, including the United States. If you are located in the European Economic Area, United Kingdom, or other regions with data transfer restrictions, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses or equivalent) for cross-border data handling where required.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: request a copy of personal data we hold about you.
Correction: request correction of inaccurate or incomplete data.
Deletion: request deletion of your account and associated personal data.
Portability: request an export of your data in a machine-readable format.
Restriction or objection: request that we limit or stop certain processing.
Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

Exercising your rights

To exercise any of these rights, contact us at privacy@quantago.co. We may need to verify your identity before acting on a request. We will respond within 30 days or as required by applicable law.

California residents: under the CCPA, you have the right to know what personal information is collected, to request deletion, and to opt out of sale (we do not sell personal information). To exercise these rights, contact privacy@quantago.co.

9. Cookies and Similar Technologies

We use cookies and similar technologies for core session management, language preferences, fraud prevention, and product analytics. We do not use advertising cookies or sell browsing data to third parties.

You may control cookies through your browser settings. Disabling certain cookies may affect platform functionality.

10. Children’s Privacy

Quantago is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at privacy@quantago.co and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date and may provide additional notice through the product or by email. Continued use of the platform after the updated effective date constitutes acceptance of the revised policy.

Contact

For privacy requests or questions, contact privacy@quantago.co.

Legal entity: Universal Reason LLC
Jurisdiction: Wyoming, United States