Privacy Policy

Account data. Your email address and a password (stored only as a salted hash), or your basic Google profile (name, email) if you sign in with Google.

Trading-venue credentials. The API credentials you supply to connect a venue (for example Kalshi or Alpaca). They are encrypted at rest with AES-256-GCM and used only to operate your connection.

Trading data. The budgets and limits you set, the proposals drafted for you, your approvals and rejections, the orders placed, and your resulting positions and performance — plus the account data those venues report back (balances, positions, fills).

Chat and AI activity. Your conversations with the agent, the briefs and research generated for you, and a record of each AI call (for audit and cost accounting).

Technical data. Server logs (such as IP address and request metadata, for security and debugging) and aggregate, cookieless usage analytics via Vercel Analytics.

We use this data to:

• run the service — research, draft proposals, and place, monitor, or cancel the orders you approve;
• enforce the budgets and risk limits you set at the moment of placement;
• keep the record straight — an auditable history of trades, briefs, and AI activity;
• secure the service and prevent abuse; and
• understand aggregate usage and improve the product.

We do not sell your personal data, and we do not use it for third-party advertising.

Chat messages and research requests are processed by third-party AI model providers, reached through Vercel’s AI Gateway: the model you select in the product, plus a small set of fixed helper models the service itself uses (naming chats, drafting documents, the research analyst). Only models on the product’s own allowed list can be selected — anything else is rejected before it reaches a provider. The model creators currently behind all of these are Anthropic, Google, OpenAI, and xAI — a list generated from that same allowed list, so it stays in step with the catalog; if it changes, we update this policy and its dates. The gateway may serve a given model through its creator’s own API or through an authorized cloud host of that model (for example Google Vertex AI or Amazon Bedrock), and every processor handles requests under its own terms. We send what the request needs: your messages, plus the trading context relevant to them, which can include your positions, balances, orders, budgets and limits, and performance. Requests are processed primarily in the United States. We do not use your content to train AI models, and we send it to providers only to serve your request.

• Your trading venues — orders you approve for a connected venue account are sent to that venue through the credentials you supplied: live orders, and Alpaca paper orders (which go to Alpaca’s paper-trading environment). The one exception is Kalshi paper orders, which are simulated by Quantreno and never sent to Kalshi (see section 5 of the Terms).
• Infrastructure providers — hosting, database, and storage (the service runs on Vercel), which process data on our behalf.
• Payment processor — subscription billing runs on Stripe. When you subscribe, your card details go directly to Stripe and never touch Quantreno; Stripe processes your name, email, and payment information to take payment on our behalf.
• AI model providers — as described in section 3.
• Market-data and web-search providers — research queries are sent to fetch prices, news, and sources; these queries do not include your identity.
• Legal — if required by law, or to protect the service and its users.

Quantreno sets a session cookie to keep you signed in. Your theme preference is stored in your browser. There are no advertising or cross-site tracking cookies; the analytics are cookieless and aggregate.

Do Not Track and Global Privacy Control. We do not track you across other sites, we do not sell or share your personal data, and no third party collects personal information about your activity over time and across other sites through Quantreno. Because there is nothing to opt out of, the service responds to a Do Not Track or Global Privacy Control browser signal by behaving exactly as it does without one.

Data is encrypted in transit (TLS). Venue credentials are encrypted at rest with AES-256-GCM; passwords are stored only as salted hashes. Access to production systems is restricted. No system is perfectly secure — if a breach affects your data, we will notify you as the law requires.

We keep your data while your account is active. Trading records and the audit history are kept as long as needed for accurate books and legal obligations. When your account is closed (you can request this at any time — section 8), we delete or anonymize your personal data except what those obligations require us to keep.

You can disconnect a trading venue at any time (and revoke its credentials at the venue itself). You can ask us to access, correct, export, or delete your personal data — email support@quantreno.com and we will respond as your local law requires (including the CCPA for California residents and the GDPR where it applies).

Quantreno is for adults. It is not directed at anyone under 18, and we do not knowingly collect data from them.

We may update this policy as the product evolves. The “Last updated” date at the top reflects the current version, and material changes will be announced with reasonable notice.

Quantreno is operated by AutEng, Inc., a Delaware corporation. Questions about privacy: support@quantreno.com. See also the Terms of Service.