Privacy Policy

1. Who is responsible

QuantLabs is operated by Arden McArthur, a sole proprietor doing business as QuantLabs, in Quebec, Canada (“we”, “us”). We are responsible for the personal information described here.

Person in charge of the protection of personal information: Arden McArthur, reachable at support@quantlabs.ca (subject “Privacy”) or by mail at shown at checkout before you subscribe, and available on request at support@quantlabs.ca. Write to this person for any question, request or complaint about your personal information.

2. What we collect

Account. When you sign in with Google, Facebook or an email link, we receive your name, email address and a unique identifier from that service. We never receive your password.

Subscription and payments. Stripe processes payments. We receive and keep your plan, billing period, subscription status and dates, and Stripe's customer and subscription identifiers. Your card details go directly to Stripe; we never see or store your full card number.

What you create. Watchlists, portfolios (including holdings you enter or import), saved backtests, price alerts, notification settings, share links you make, AI briefs you request, and the questions you ask in AI Mode.

Brokerage import (optional). If you import a Questrade account, you authorize it on Questrade's own site. We receive the account's holdings and balances to build your portfolio; we do not receive your Questrade password, and we do not keep the access token once the import is done.

Emails and consent records. If you turn on the newsletter, digests or alerts, we keep your choices and when you agreed. We do not track whether you open emails or click their links.

Feedback. If you send feedback, we receive your message, its category, the page you were on, your plan and, if you are signed in, your email address.

Usage analytics (only with your consent). If you accept analytics cookies, Google Analytics records the pages you visit and actions you take (such as running a backtest or starting a trial), with general device, browser and approximate location information. When you are signed in, these events carry your account identifier and plan, never your name or email.

Security and diagnostics. Our servers record each request (address requested, time, outcome) and errors (page, browser, error details and, if signed in, your account identifier) to keep the Service working. We use your IP address briefly to limit abuse; it is not stored with your account. To keep automated traffic out, Google reCAPTCHA (through Firebase App Check) evaluates signals from your browser.

Aggregate counts. The “Most active” lists count asset-page views per hour. Only the totals are stored, not who viewed what.

3. Why we use it

We use personal information only for these purposes:

• to create and secure your account and sign you in;
• to provide the features you use: saving your lists and portfolios, running backtests, sending the emails you turned on, writing AI briefs and answers;
• to process your subscription, prevent payment fraud and keep the records the law requires;
• to answer your messages and feedback;
• to keep the Service secure, prevent abuse and fix problems;
• with your consent, to understand how the Service is used so we can improve it, and to show personalised ads on the Free plan.

We do not sell or rent your personal information, and we do not use it to make decisions about you based solely on automated processing. Q-Scores and similar outputs are about companies and funds, not about you.

4. Consent

We collect and use your information with your consent, which you give when you create an account, turn on a feature or accept optional cookies, or where the law otherwise allows (for example, to complete a contract you asked for or meet a legal obligation). You can withdraw consent at any time: turn emails off on the Notifications page, change your cookie choice with “Cookie settings” at the bottom of every page, or delete your account. Withdrawing consent may mean a feature can no longer be provided.

5. AI features

AI briefs, AI Mode and watchlist digests are written by Google's Gemini models, called from our servers. A request contains the financial data for the page, the tickers involved and, for AI Mode, the question you typed. We do not include your name, email address or account identifier. Do not type personal information into AI Mode. AI Mode can also search the web through Google Search to answer a question.

6. Who we share it with

We share personal information only with the service providers that run the Service for us, and only what each needs:

• Google (Firebase Authentication, Firestore database, Cloud Functions and Hosting, Cloud Logging, Gemini, reCAPTCHA, and, with your consent, Google Analytics; and AdSense for ads on the Free plan);
• Meta, if you sign in with Facebook;
• Stripe, for payments and subscriptions;
• Resend, to send the emails you turned on;
• Questrade, if you import an account.

These providers act under contracts that require them to protect the information and use it only to provide their services (Google AdSense and Analytics also follow Google's own policies, linked below). We may also disclose information if the law requires it, to protect rights or safety, or as part of a transfer of the business, in which case the recipient must keep honouring this policy. Share links you create are visible to anyone who has the link.

7. Where your information is stored

Our providers store and process information outside Quebec and Canada, mainly in the United States. Before communicating personal information outside Quebec we assess whether it will be adequately protected, as Quebec law requires, taking into account the provider's safeguards and contract. Information held in another country may be accessible to that country's courts and authorities under its laws.

8. Cookies and similar technologies

Necessary: your sign-in session and preferences (such as a dismissed notice or your cookie choice) are kept in your browser. These are needed for the Service to work.

Optional, off by default: Google Analytics cookies, and personalised advertising by Google AdSense on the Free plan. They are used only if you click “Accept”; until then, analytics is not loaded and any ads are non-personalised (Google may still use cookies to limit how often an ad is shown and to detect fraud). You can change your choice at any time with “Cookie settings” in the footer, or by clearing your browser data. Pro accounts see no ads. See how Google uses information from sites that use its services.

9. How long we keep it

• Account information and your content: while your account exists. When you delete your account, we delete it and your watchlists, portfolios, backtests, share links, alerts, notification settings and AI briefs.
• Server logs and error reports: about 30 days.
• Google Analytics data: at most 14 months.
• Feedback messages: up to 2 years, then deleted.
• Payment and invoice records: kept by Stripe, and by us where needed, for as long as tax and accounting law requires (generally 6 years in Canada).
• Backups: deleted information can remain in backups for a short time before it is overwritten.

10. How we protect it

Information is encrypted in transit and at rest by our providers. Access is limited to what each part of the Service needs, database rules stop one account from reading another's data, payment data never touches our servers, and we do not keep service-account keys on personal devices. No system is perfectly secure; if an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as the law requires, and we keep a register of incidents.

11. Your rights

Subject to the law, you have the right to:

• know what personal information we hold about you, and get a copy;
• have it corrected if it is inaccurate, incomplete or out of date;
• receive information you gave us in a structured, commonly used technological format, or have it sent to another organization;
• withdraw your consent, and have your information deleted (most of it at once, by deleting your account from your profile);
• be told how your information is used and to whom it is disclosed.

Write to support@quantlabs.ca. We will answer within 30 days, free of charge, and may ask you to confirm your identity first. If you are not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada. If you live in the European Economic Area or the United Kingdom, you have equivalent rights, including to object to processing, and may complain to your local data protection authority.

12. Children

QuantLabs is not directed at children. You must be at least 13 to create an account, and personal information of a person under 14 is collected only with the consent of a parent or guardian. If you believe a child under 14 has given us information without that consent, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change and show the new effective date at the top. If a change is significant, we will tell you by email or in the Service before it takes effect and, where the law requires, ask for your consent again.

14. Contact

Arden McArthur, person in charge of the protection of personal information, QuantLabs. Email: support@quantlabs.ca. Mail: shown at checkout before you subscribe, and available on request at support@quantlabs.ca. A French version of this policy is available on request.