Privacy policy

Last updated October 2026. Applies to qanteris.com, the community at community.qanteris.com, the AI chat at chat.qanteris.com, the knowledge base at kb.qanteris.com, our emails, support and the ordering of the courses.

1. Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is AXEON TECHNOLOGIES FZCO IFZA Business Park, DDP P.O. Box 342001 Dubai, United Arab Emirates Email: support@qanteris.com Personal data means any data that can be used to identify you personally. All our sites transmit data in encrypted form (TLS); you can see this from the lock icon in your browser’s address bar.

2. Visiting the site and server logs

If you only view the site, we collect only the data that your browser transmits to the server: the page accessed, date and time, the amount of data transferred, the page you came from, browser, operating system and IP address. We need this data to display the site to you and to operate it securely. The legal basis is our legitimate interest in stability and security (Article 6(1)(f) GDPR). We only analyze the logs if there are specific indications of misuse, and we delete them after a short time.

3. Hosting and delivery

The website, the community, the AI chat, the knowledge base and our other tools run on our own server at Contabo GmbH, Munich, located in the EU (data centre in Lauterbourg, France). We run the search service of the knowledge base on a second server at Hetzner Online GmbH, Gunzenhausen, located in Nuremberg (Germany). Contabo and Hetzner process the data on our behalf (Article 28 GDPR). For name resolution (DNS), protection against attacks and fast delivery of pages and images, we use Cloudflare (Cloudflare, Inc., San Francisco, USA). Your requests, including your IP address, pass through Cloudflare servers, including servers outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. The legal basis is our legitimate interest in secure and fast delivery (Article 6(1)(f) GDPR). The AI chat (chat.qanteris.com) and the knowledge base (kb.qanteris.com) also run through Cloudflare. For this, Cloudflare accepts the encrypted connection and forwards it encrypted to our server; your requests and messages pass through Cloudflare's systems in the process.

4. Cookies and audience measurement

The website qanteris.com does not set cookies and does not load fonts or scripts from third party servers. Your browser stores the selected language locally. Also only locally in your browser, the site remembers via which link you arrived first and last (campaign parameters, referring page, landing page). This information only leaves your computer when you submit a form (section 6). You can delete these entries in your browser at any time. To understand which pages are read, we use Umami, which we run ourselves on our own server. Umami does not set cookies, stores nothing on your device, creates no profiles and does not store full IP addresses; the data does not leave our server. It records the page accessed, the referring page, browser, operating system, device type, country and individual clicks on buttons. The legal basis is our legitimate interest in a clear and well-functioning site (Article 6(1)(f) GDPR). In the community (community.qanteris.com), the software sets technically necessary cookies so that you stay signed in. They are required for the service and do not need consent.

5. Contact and support

If you send us an email, we process your address and the content of your message to handle your request. Our mailboxes are hosted by Hostinger (Hostinger International Ltd., Cyprus). We manage support requests in a ticket system (Zammad) that we run ourselves on our own server. To prepare replies more quickly, the text of your request may be sent to an AI service (section 9). The legal basis is our legitimate interest in responding (Article 6(1)(f) GDPR); if your message concerns a contract, Article 6(1)(b) GDPR also applies. We delete the data once your request has been resolved and no retention obligations prevent deletion.

6. E-book, course start notice and emails

When you join the community for free, you can tick an optional box: we will then send you the free e-book “Trading Strategies in Series” and the notice when the course starts. If you tick it, in addition to the data in section 7 we store the wording of the box, the language it was shown in, the time of your sign-up and the time you confirmed your address via the link in our email. We only send the e-book after this confirmation. For every sign-up we also store the page it came from, the design variant you saw and, if you arrived via a link with campaign parameters, these parameters and the referring page (section 4). You can optionally tell us a language you are missing. The data is kept in our own email tool (Mautic) on our server. We also keep a record of the sign-up in our own database, where the address is stored only as a checksum (hash) and in shortened form. The emails are sent via Brevo (Sendinblue SAS, Paris, France) as a processor. We measure whether an email was opened and whether a link in it was clicked, in order to improve our emails. The legal basis for the e-book and the course start notice is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, via the unsubscribe link in any email or by sending a message to support@qanteris.com. After that we will no longer send you such emails; your community account is not affected. We keep the record of your earlier consent (the wording of the box and the times) so that we can prove it existed, and delete it after the standard limitation period of three years. The legal basis for this is our legitimate interest in this proof (Article 6(1)(f) GDPR). If you signed up for our waiting list earlier, the consent you gave then remains valid, and this section applies to it accordingly. Emails that belong to your community account or to a contract (confirmation link, access details, information about the course you bought) are sent on the basis of Article 6(1)(b) GDPR.

7. Community and customer area

For the community and the course area (community.qanteris.com), you create an account. We store your first and last name, your email address, your username, the language, your posts and messages, and technical sign-in data. Your name appears on every post and is visible to the other members; that is part of the community. Posts are automatically translated into the other languages of the community (section 9). If you buy a course, we unlock the course content in your account and store your learning progress; we use your name for a certificate of participation or completion. The legal basis is the user agreement for the community and, where applicable, the course contract (Article 6(1)(b) GDPR). You can have your account deleted at any time; posts that others have quoted are then anonymized.

8. Ordering and payment

The courses are sold by a payment service provider acting as the seller (Merchant of Record). When you buy, it is your contracting party, collects the payment, remits the VAT and issues the invoice. We will name the provider here and on the order page as soon as sales begin. The provider is itself responsible for the data you enter on its order page; its privacy policy applies. We do not see payment data such as your card number or PayPal account. From the payment service provider we receive your name, your email address, country and language, the product purchased, amount and currency, the order number and the payment status (paid, refunded, charged back). We use this to set up your access, to block it in the event of a refund or chargeback, to write to you about the course you bought, and for our accounting. The legal basis is the performance of the contract (Article 6(1)(b) GDPR) and our statutory retention obligations (Article 6(1)(c) GDPR).

9. Artificial intelligence, AI chat and knowledge base

We use AI services in four places: for the automatic translation of posts in the community, in the AI chat, when your own AI accesses the knowledge base, and to prepare replies in support. For translation and support, we send the relevant text to DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) or to Anthropic (Anthropic PBC, San Francisco, USA). There is no adequacy decision by the EU Commission for China; the level of protection there is lower. So do not include any information you do not want to share in posts or support requests. AI chat: With valid access to the knowledge base, you can ask an AI questions at chat.qanteris.com. The chat runs on the LibreChat software on our server at Contabo in the EU. You sign in with your community account; the chat receives your name, your username, your email address and an identifier of your account. We store your chats with your messages, the replies and attached images, as well as your use of the monthly allowance. Other members cannot see your chats. Model provider: The replies in the AI chat are generated by a language model from Anthropic (Anthropic PBC, San Francisco, USA). For this, we send your message, the previous course of the chat, attached images and the matching excerpts from the knowledge base to Anthropic. Anthropic processes this data as our processor (Article 28 GDPR) under its Data Processing Addendum. The transfer to the USA is based on the standard contractual clauses of the EU Commission agreed in it (Article 46(2)(c) GDPR). Under Anthropic's Commercial Terms (version of 17 June 2025), Anthropic may not use content from the application programming interface (API) to train its models. Do not write any information about yourself or others in the chat that your question does not need. Knowledge base: The knowledge base is provided by our service at kb.qanteris.com, which also runs on our server at Contabo. It checks your access, answers the requests and forwards the search to our search service at Hetzner in Nuremberg (section 3). The search service only receives the search query and, for a case, the uploaded file under a pseudonymous identifier, no name and no email address. Your own AI can query the knowledge base via MCP (Model Context Protocol, an open standard that lets an AI use external knowledge sources). Your own AI: If you connect your own AI, such as Claude, ChatGPT or Cursor, to the knowledge base, its provider is a separate controller for this use. Everything you enter there, and the replies from the knowledge base that your AI receives, are governed by its terms and its privacy policy, not ours. We only receive the requests your AI sends to the knowledge base. Personal keys and connected apps: In the customer area, you can create up to two personal keys. We show you the full key only once. We store only a check value (hash), the beginning of the key, the name you give it, the times of creation and last use, and the network last used with a shortened IP address. If you sign in to an app with your community account (OAuth), we store which app you granted access to and when, and when it last used that access; we store access tokens only as a check value. You can revoke keys and apps in the customer area at any time. Log and usage limit: For each request to the knowledge base, we log the time, the tool, the query (shortened to 300 characters), the entries retrieved, the app, the country and your IP address, shortened to the network (for IPv4 the first three blocks, for IPv6 the first 48 bits). From this we count the requests per day to enforce the usage limit and detect whether an access is used from many networks and countries at the same time and is therefore probably shared. Such an indication does not lead to an automatic block. Uploads and cases: You can attach images in the AI chat and upload files from StrategyQuant X as a case in the customer area or through your own AI. No person looks at these files; they are used only for automatic analysis with the knowledge base. Do not upload files or images containing personal data. Storage periods: We delete each chat message 12 months after it was sent; a chat without new messages therefore disappears completely 12 months after the last activity. We delete uploaded images and cases after 30 days, and the access log also after 30 days. We delete the daily counters (number of requests, shortened networks, countries and apps per day) after 400 days. If you delete your community account, we revoke all keys and apps and delete your cases as well as your AI chat account with its history. Legal bases: For the translation in the community, the AI chat, the knowledge base, keys, apps and uploads, it is the contract with you (Article 6(1)(b) GDPR). For the log, the usage limit and the detection of shared access, it is our legitimate interest in secure and fair operation and in protecting our content (Article 6(1)(f) GDPR); for support, it is our legitimate interest in fast replies (also point (f)).

10. Error monitoring

So that we can quickly find technical errors in the community and our services, we record error reports with GlitchTip, which we run ourselves on our own server. An error report may contain technical information about your browser, the address accessed and, if you are signed in, your username. The legal basis is our legitimate interest in a functioning service (Article 6(1)(f) GDPR). We delete the reports after 90 days at the latest.

11. Our presence on social networks

QANTERIS is present on Instagram and Facebook (Meta Platforms Ireland Ltd., Dublin, Ireland), on X (Twitter International Unlimited Company, Dublin, Ireland) and on YouTube (Google Ireland Ltd., Dublin, Ireland). On our website these networks are only linked, not embedded; no data is transmitted before you click a link. If you visit our profiles there, the respective operator processes your data under its own privacy policy. For the statistics on our Facebook and Instagram page, we are joint controllers with Meta (Article 26 GDPR); Meta provides the corresponding agreement. If you write to us there, we process your message in order to reply. The legal basis is our legitimate interest in communicating with interested people (Article 6(1)(f) GDPR).

12. YouTube API Services

We publish our videos on YouTube through the YouTube API Services, a programming interface provided by Google (Google Ireland Ltd., Dublin, Ireland, and Google LLC, Mountain View, USA). Our own publishing tool uses it to upload videos to the QANTERIS YouTube channels, one per language, and then to read the status and details of these videos. For this we signed in with Google (OAuth) and granted the tool two permissions, for our own channels only: uploading videos (youtube.upload) and reading channel and video data (youtube.readonly). What we retrieve and store: only information about our own videos, namely the video ID, title, description, thumbnail and upload status (for example processing, private or public). We use it to check whether an upload has arrived and to record in our publishing schedule which video appeared on which channel. In addition, for our own uploaded videos we read the statistics, namely the number of views, the number of likes and the number of comments, to measure how our content performs. We do not read the content of comments. Through the interface we do not retrieve any data about visitors to this website, members of the community, viewers of our videos, subscribers or other YouTube channels. We do not share the data with third parties and do not use it for advertising. The legal basis is our legitimate interest in publishing our own content (Article 6(1)(f) GDPR). Storage and deletion: we refresh stored information from the interface at least every 30 days or delete it. The statistics of a video are measured at four points (24 hours, 72 hours, 7 days and 28 days after publication) and deleted 30 days after publication. If access is revoked, we delete the data stored through the interface within 7 days. Anyone can revoke an application's access to their Google account at any time in Google's security settings: https://security.google.com/settings/security/permissions. You can request deletion with a message to support@qanteris.com. When you watch our videos on YouTube, the YouTube Terms of Service apply: https://www.youtube.com/t/terms. How Google processes data is described in the Google Privacy Policy: https://policies.google.com/privacy.

13. Your rights

You have the following rights against the controller: access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), notification (Article 19), data portability (Article 20), withdrawal of consent given (Article 7(3)) and complaint to a supervisory authority (Article 77), in the EU to the authority where you live. Right to object: If we process your data on the basis of a legitimate interest, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). We will then stop the processing unless compelling legitimate grounds prevail or the processing serves the establishment, exercise or defense of legal claims. You may object to direct marketing at any time without giving reasons. For any of this, a message to support@qanteris.com is sufficient.

14. Storage period

How long we store data depends on the legal basis, the purpose and statutory retention periods. We store data based on consent until consent is withdrawn, and data based on a legitimate interest until you object, unless compelling legitimate grounds prevail. We store account data for as long as your account exists. We keep order and invoice data for as long as commercial and tax law require. Otherwise, we delete data as soon as it is no longer needed for the purpose. We keep the record of a consent you gave until the limitation period of three years has expired after withdrawal (section 6). The periods for the AI chat, the knowledge base, uploads and the access log are set out in section 9.

15. Transfers to third countries

The controller is based in the United Arab Emirates. Your data may be processed there and by the service providers named outside the EU, in particular in the USA and in China. Where the recipient is certified, we base transfers to the USA on the EU-US Data Privacy Framework, and otherwise on standard contractual clauses of the EU Commission. For countries without an adequacy decision, we expressly point out the lower level of protection in this policy.

16. Changes

We update this policy when our services or the law change. The current version is always available here, with the date at the top.