Privacy Policy
Version 2.0 · Effective 13 October 2026.
This Privacy Policy explains how Kuantura collects, uses, shares and protects personal data in connection with the website at kuantura.com, the Kuantura application, the early-access waiting list and our support channel (together, the “Service”), and the rights you have in relation to that data.
In brief
- What we hold. Your account details, the portfolio data you enter or import, your settings, and limited technical data needed to run the Service securely.
- What we use it for. To provide the Service to you, keep it secure and meet our legal obligations.
- What we do not do. We do not sell personal data, we do not use it for advertising, and we do not run product analytics or session recording inside your signed-in account.
- Where it is stored. Account and portfolio data is stored in the European Union. Some of our service providers belong to groups headquartered in the United States.
- Things you might not expect. To display market prices, your browser may request public market data directly from third-party sources, which then see your IP address and the instrument requested (section 6). If you connect a broker or other platform, we store the read-only credentials needed to maintain the connection (section 5).
- Your rights. You can access, export, correct and delete your data, object to certain processing, and complain to a supervisory authority (section 11).
This summary is the first layer of this notice. The sections below contain the full information.
1.Who is responsible for your data
1.1The controller of the personal data described in this policy is the operator of Kuantura, as identified in clause 1 of the Terms of Service (“Kuantura”, “we”, “us”). Kuantura is operated from Norway.
1.2You can contact us about any privacy matter, and exercise your rights, at support@kuantura.com. The controller’s full name and geographic address are provided on request to the same address.
1.3When the limited liability company that will operate Kuantura has been registered, it will become the controller. Section 15 explains how that change will be made.
2.Scope
2.1This policy applies to personal data that we process as a controller. It does not apply to the services of brokers, banks, exchanges or other third-party platforms, which process your data under their own privacy notices.
2.2Where a business customer uses Kuantura to process personal data about its own clients, that customer is the controller and we act as its processor (section 14).
3.The data we process, why, and for how long
3.1The table below sets out the categories of personal data we process, the purposes, the legal basis under the General Data Protection Regulation (“GDPR”), and how long we keep the data.
| Category and data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data E-mail address, display name (optional), authentication data (a hashed password and sign-in session identifiers). |
Creating and administering your account; signing you in; sending service messages such as sign-in codes, password resets, security alerts and notices under the Terms. | Performance of our contract with you (Art. 6(1)(b)). | For as long as you have an account. Deleted when you delete your account (see section 9). |
| Portfolio data The transactions you enter or import (date, instrument, type, quantity, price, currency, account label, notes), the investment accounts you label, your corrections to instrument details and your benchmark selections. |
Providing the Service: storing your data, calculating and displaying your portfolio figures, and exporting your data to you. | Performance of our contract with you (Art. 6(1)(b)). | For as long as you have an account, or until you delete the data. |
| Settings Language, display currency and other display and feature preferences. |
Presenting the Service in the way you have chosen. | Performance of our contract with you (Art. 6(1)(b)). | For as long as you have an account. |
| Connection credentials If you connect a third-party platform: the read-only access key or access tokens issued by that platform. |
Retrieving your holdings and transactions from that platform when you ask us to synchronise. | Performance of our contract with you (Art. 6(1)(b)). | Until you remove the connection or delete your account. |
| Early-access requests E-mail address and the plan you are interested in. If you choose to provide them: telephone number, type of investor, approximate portfolio size, platforms you use and any note you add. |
Handling your request and sending your invitation. The optional details are used to plan the order of invitations and which platforms to support. | Steps taken at your request before entering into a contract (Art. 6(1)(b)); for the optional details, our legitimate interest in planning the roll-out of the Service (Art. 6(1)(f)). | Until you create your account, and in any event no longer than 12 months after public launch. |
| Support correspondence Your e-mail address and the content of your messages to us. |
Answering your enquiry, resolving problems and keeping a record of how a matter was handled. | Performance of our contract with you (Art. 6(1)(b)); our legitimate interest in handling enquiries and defending legal claims (Art. 6(1)(f)). | Up to 24 months after the matter is closed. |
| Technical and security data IP address, browser and device information, and the date, time and nature of requests made to the Service. |
Delivering the Service to your device; keeping it secure; detecting and preventing misuse; diagnosing faults. | Our legitimate interest in operating a secure and reliable service (Art. 6(1)(f)). | Normally no longer than 30 days, unless needed for longer to investigate a specific incident. |
| Product updates If you have asked to receive them: your e-mail address and a record of your consent. |
Sending you news about Kuantura. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. | Until you unsubscribe. A record of your consent and of its withdrawal is kept for up to three years afterwards. |
| Website usage data If you have allowed optional analytics: an identifier stored on your device, the pages you view and the elements you select on the public website and in the public demonstration, a recording of your session on those pages, and technical information such as your browser, device type and approximate location derived from your IP address. This does not include any data from a signed-in account. |
Understanding how the public website and the public demonstration are used, in order to improve them. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. | No longer than 12 months. |
| Billing data If you buy a paid plan: the plan, the amounts charged, payment status and invoice details. Payment-card details are collected and processed by the payment provider; we do not store card numbers. |
Charging for a paid plan; managing renewals, cancellations and refunds; meeting accounting and tax obligations. | Performance of our contract with you (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)). | Five years after the end of the financial year to which the record relates, as required by Norwegian bookkeeping law. |
3.2Where we rely on legitimate interests, we have assessed that our interests are not overridden by yours. You can ask us for more information about that assessment, and you have the right to object (section 11).
3.3Providing your e-mail address is necessary to create an account; without it we cannot provide the Service. You decide what portfolio data to enter. Fields marked as optional are optional.
3.4We do not ask for, and the Service is not intended to hold, special categories of personal data (such as data about health, political opinions or religious beliefs). Please do not enter such data in free-text fields.
4.Where the data comes from
4.1We obtain personal data: (a) from you, when you register, enter or import data, change settings, join the waiting list or contact us; (b) from a third-party platform that you choose to connect, which sends us the holdings and transactions you have authorised it to share; and (c) automatically from your device, in the form of the technical data described in section 3.
5.Imports and connected platforms
5.1When you import a file exported from a broker or other platform, the file is read on your device. We store the transactions that result from the import, not the file itself.
5.2Connecting a platform directly is optional. If you do so, we store the read-only credentials needed to maintain the connection and use them only to retrieve your holdings and transactions when you ask us to synchronise. The credentials are stored in encrypted form and are deleted when you remove the connection or delete your account. You can also revoke access at any time in the platform’s own settings.
5.3A platform that you connect is not our processor. It is an independent controller that already holds your data under its own terms.
6.Requests made from your device to third parties
6.1To display prices, exchange rates, company information and logos, the Service retrieves public market data from third-party data sources. Some of these requests are made by our servers. Others are made directly by your browser, either to the source or through a relay service.
6.2A request made directly by your browser necessarily discloses to the source or relay concerned your IP address, standard browser information and the instrument, currency or company for which data is requested. It does not include your name, your e-mail address, your account identifier, or the size or value of your holdings.
6.3These sources and relays are independent controllers and process that information under their own privacy notices. Some of them are located outside the European Economic Area (section 8). We rely on performance of our contract with you (Art. 6(1)(b)) for these requests, because they are necessary to provide the price-dependent features of the Service.
6.4The application also loads certain open-source software components from a content-delivery network, which receives your IP address and standard browser information as part of the request.
7.Who receives your data
7.1We do not sell personal data, and we do not share it with anyone for advertising or marketing purposes.
7.2We use service providers that process personal data on our behalf, as our processors, under data processing agreements that meet the requirements of Art. 28 GDPR:
| Category of recipient | What it does | Location |
|---|---|---|
| Cloud database and authentication provider | Stores account and portfolio data and authenticates users. | Data stored in the EU (Germany). The provider belongs to a group headquartered in the United States. |
| Website hosting, content-delivery and serverless-computing provider | Delivers the website and application to your device and runs server-side functions, including those that retrieve market data and maintain platform connections. | Global delivery network. The provider is headquartered in the United States. |
| E-mail delivery provider | Sends service messages such as sign-in codes and password resets. Receives your e-mail address and the content of the message. | EU or United States. The provider is headquartered in the United States. |
| E-mail and office-software provider | Hosts the mailbox through which we receive and answer support requests. | EU. The provider belongs to a group headquartered in the United States. |
| Product-analytics provider | Where you have given your consent, records how the public website and the public demonstration are used. It does not receive data from signed-in accounts. | Data stored in the EU (Germany). The provider belongs to a group headquartered in the United States. |
7.3The following recipients act as independent controllers:
- third-party platforms that you connect, such as a broker or exchange, with which we exchange the requests needed to retrieve your data;
- public market-data sources, relay services and content-delivery networks, as described in section 6;
- a payment provider or authorised reseller, if you buy a paid plan, which processes your payment details;
- professional advisers, such as lawyers, accountants and insurers, where necessary and under a duty of confidentiality;
- public authorities and courts, where we are required by law to disclose data or where disclosure is necessary to establish, exercise or defend legal claims; and
- a successor entity, if the Kuantura business is transferred to a company or another operator, as described in section 15.
7.4You can ask us at any time for the names of the recipients to which your personal data has been or will be disclosed.
8.Transfers outside the EEA
8.1Your account and portfolio data is stored in the European Union. Because several of our service providers belong to groups headquartered in the United States, and because the website is delivered through a global network, personal data (typically technical data such as IP addresses, and your e-mail address when a message is sent) may be accessed from or processed in the United States.
8.2Where personal data is transferred to a country outside the European Economic Area, the transfer is based on: (a) an adequacy decision of the European Commission, including, for recipients certified under it, the decision on the EU–US Data Privacy Framework; or (b) where no adequacy decision applies, the standard contractual clauses adopted by the European Commission, with supplementary measures where required.
8.3You can obtain more information about these safeguards, and a copy of the relevant clauses, by contacting us.
8.4The requests described in section 6 may be sent by your browser directly to sources located outside the European Economic Area, including in the United States.
9.Deletion
9.1The retention periods for each category of data are set out in section 3.
9.2When you delete your account, your account data, portfolio data, settings and connection credentials are deleted from the live systems. Copies in routine backups are overwritten within 30 days.
9.3If no one has signed in to an account for 24 months, we will notify the account holder by e-mail and, if no one signs in within 30 days after that notice, delete the account.
9.4We may keep data for longer than the periods stated where this is necessary to comply with a legal obligation or to establish, exercise or defend legal claims, for as long as the obligation or the limitation period lasts.
10.Security
10.1We apply technical and organisational measures that are appropriate to the risk, such as encryption of data in transit and at rest, access controls, and the logical separation of each customer’s data.
10.2No system can be guaranteed to be completely secure. You are responsible for keeping your sign-in credentials confidential and for the security of the devices and e-mail account you use.
10.3If a personal data breach occurs, we will notify the supervisory authority and the individuals affected where the law requires it.
11.Your rights
11.1Under the GDPR you have the right to:
- access your personal data and receive a copy of it. You can download your account and portfolio data at any time using the export function in your account settings;
- rectify inaccurate data. You can edit most data directly in the Service;
- erase your data. You can delete your account at any time from your account settings;
- restrict the processing of your data in certain circumstances;
- object to processing that is based on our legitimate interests;
- data portability: to receive the data you have provided in a structured, commonly used and machine-readable format, which the export function provides; and
- withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing before it. You can unsubscribe from product updates as described on the unsubscribe page.
11.2To exercise a right that you cannot exercise in the Service, e-mail support@kuantura.com. We respond within one month. That period may be extended by up to two further months where a request is complex or we have received a number of requests, in which case we will tell you within the first month.
11.3To protect your data, we may ask you to confirm your identity, normally by replying from the e-mail address registered on your account or by signing in.
11.4Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act on it, and we will explain why.
11.5You have the right to lodge a complaint with a supervisory authority. In Norway this is Datatilsynet. You may also complain to the authority in the EEA country where you live or work, or where you believe an infringement has taken place.
12.Automated decision-making
12.1We do not make decisions about you that are based solely on automated processing and that produce legal effects for you or similarly significantly affect you. The figures and projections in the Service are calculations that are displayed to you; they do not decide anything about you.
13.Children
13.1The Service is intended for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe that a minor has provided personal data to us, please contact us and we will delete it.
14.Business customers
14.1Where a business customer, such as an advisory firm, uses Kuantura to process personal data about its clients or other individuals, that customer is the controller of the data and we process it on the customer’s behalf under a data processing agreement. The customer’s own privacy notice applies, and we refer any request from the individuals concerned to the customer.
14.2We remain the controller of the business customer’s own account, billing and support data, as described in this policy.
15.Change of controller
15.1When the limited liability company that will operate Kuantura has been registered, the Service, and the personal data needed to provide it, will be transferred to that company, which will become the controller. The purposes for which your data is processed will not change.
15.2We will notify account holders by e-mail at least 30 days before the transfer takes effect, stating the company’s name, organisation number and address, and this policy will be updated accordingly. If you do not wish your data to be transferred, you can delete your account before that date.
16.Device storage
16.1The Service stores information on your device, in your browser’s local storage, in order to keep you signed in, remember your settings and load your data quickly. If you allow optional analytics on the public website, an identifier is also stored on your device for that purpose. Our Cookies and Device Storage Notice describes this in detail.
17.Changes to this policy
17.1We keep this policy up to date. Each version carries a version number and an effective date, and earlier versions are available on request.
17.2If we make a change that materially affects how we process your personal data, we will notify account holders by e-mail before the change takes effect.
18.Contact
18.1For any question about this policy or about your personal data, e-mail support@kuantura.com.