Privacy Policy

1. Introduction

Welcome to Quantt ("we," "us," or "our"). Quantt is operated by Scott Bromley. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at www.quantt.co.uk and use our online learning platform for quantitative finance (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Personal Information You Provide

When you register for an account, subscribe to a plan, or contact us, we may collect:

• Full name
• Email address
• Phone number (optional, when provided via our contact form)
• Account credentials (managed securely by our authentication provider)
• Payment and billing information (processed securely by Stripe; we do not store your full card details)
• Code, written answers and other work you submit on the platform, including answers marked by our AI grader
• Any other information you choose to provide (e.g., messages via our contact form)

2.2 Information Collected Automatically

When you access the Service, we automatically collect certain information, including:

• Usage Data: Pages visited, features used, course progress, time spent on pages, and interaction patterns
• Learning Activity: While you are signed in and using lessons, we record how you work through them — for example time spent on each notes page, quiz answers and attempts, exercise test runs and results, hints or solutions opened, difficulty ratings, and your answers (plus any note you choose to write) to occasional quick questions about how a lesson is going. We use this to improve lessons, estimate which topics you have mastered so we can recommend what to study next, and understand which content keeps learners engaged. It is stored on our own servers, linked to your account, and not sold or shared with advertisers. We never store the code you write, only a fingerprint of it. Detailed activity records are deleted after 18 months; summary statistics may be kept longer
• Device Information: Browser type, operating system, device type, screen resolution, and language preferences
• Log Data: IP address, access times, referring URLs, and error logs
• Advertising Identifiers: If you arrive by clicking one of our ads, the click ID the ad platform adds to the link (for example Google's gclid, Meta's fbclid or Reddit's rdt_cid), and, if you came through a referral link, the affiliate code
• Cookies and Similar Technologies: We use cookies, pixels, local storage and similar technologies to collect information about your browsing activity (see Section 5 and our Cookie Policy)

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Service: Deliver course content, track your learning progress, and manage your account
• Process payments: Handle subscriptions, billing, and refunds through Stripe
• Communicate with you: Send account-related notifications, respond to enquiries, and provide customer support
• Improve the Service: Analyse usage patterns to enhance our courses, features, and user experience
• Personalisation: Tailor content and recommendations based on your learning activity
• Security: Detect and prevent fraud, abuse, and security incidents
• Marketing: With your consent, send promotional communications about new courses, features, or offers (you can opt out at any time)
• Advertising measurement: Measure which of our ads lead to sign-ups and purchases, and show our ads to people likely to find them useful (see Section 4.1)
• Affiliate programme: Credit affiliates for customers they refer
• Legal compliance: Comply with applicable laws, regulations, and legal processes

3.1 Legal bases

• Contract: running your account, delivering courses, processing payments and support
• Consent: analytics and advertising cookies that are not strictly necessary, and marketing emails. You can withdraw consent at any time on our Cookie Policy page or by unsubscribing
• Legitimate interests: keeping the Service secure, improving it, measuring whether our advertising works, and running our affiliate programme
• Legal obligation: keeping tax and accounting records

4. Third-Party Services

We use the following third-party services to operate and improve the Service. Each has its own privacy policy governing the use of your information:

• Clerk — Authentication and user account management
• Stripe — Payment processing and subscription management
• Vercel — Hosting, deployment, cookieless web analytics, and the AI Gateway that routes AI requests
• Neon — Database hosting
• Anthropic (via Vercel AI Gateway) — Marks written answers to some brain teasers. We send the question and your answer, not your name or email
• Resend — Sending account and marketing emails
• Sentry — Error monitoring. When something breaks we send the error message, stack trace, page address, and browser details. If you are signed in we include your account id. We do not send your name, email, cookies, or the contents of requests
• Google Analytics — Website usage analytics
• Google Ads — Advertising and conversion measurement
• Meta Pixel and Conversions API (Facebook, Instagram) — Advertising and conversion measurement
• Reddit Pixel and Conversions API — Advertising and conversion measurement
• LinkedIn Insight Tag — Advertising analytics and conversion tracking
• Hotjar — Session recording, heatmaps, and user behaviour analytics
• ipify — After you accept cookies, looks up your public IP address so it can be included with events sent to Meta
• Cloudflare Turnstile — Bot protection and security verification

4.1 What we share with advertising platforms

To measure whether our ads work, we tell Google, Meta, Reddit and LinkedIn when someone who clicked one of their ads visits a page, signs up or makes a purchase. Depending on the platform, this can include:

• The ad click ID and the platform's browser cookie ID
• Your IP address and browser details
• The page visited, the event (for example a purchase) and its value
• A hashed (SHA-256) copy of your email address, and where you have given them your name and phone number. Hashing turns them into a code the platform can match against its own users without us sending the details in readable form

For Google, this is "enhanced conversions": when you buy, the Google tag hashes your email in your browser before sending it. Meta and Reddit receive events both from their pixels in your browser and directly from our servers through their Conversions APIs. We only share this data with advertising platforms if you have accepted cookies. Before that, Google receives only the limited cookieless signals described in our Cookie Policy, and Meta, Reddit and LinkedIn receive nothing. Details are in our Cookie Policy.

We do not sell your personal information to third parties. We only share information with third-party services as described above and as necessary to provide the Service.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your activity on our Service. Cookies are small data files placed on your device.

Types of cookies we use:

• Essential Cookies: Required for the Service to function properly (e.g., authentication session cookies and remembering your cookie choice)
• Analytics Cookies: Help us understand how visitors interact with the Service (Google Analytics, Hotjar). Vercel Web Analytics is cookieless
• Advertising Cookies: Used to measure campaign effectiveness (Google Ads, Meta, Reddit, LinkedIn)

A banner asks for your consent when you first visit. We use Google Consent Mode, so the Google tag runs without cookies until you accept. Our Cookie Policy lists every cookie, what it does, how long it lasts, and when it is set, and lets you change your choice at any time. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymise your personal information within 90 days, unless we are required to retain it for legal, accounting, or regulatory purposes.

Usage data and analytics information may be retained in an aggregated, anonymised form for longer periods to help us improve the Service.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication through Clerk
• PCI-compliant payment processing through Stripe
• Regular security reviews and updates

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Rectification: Request correction of inaccurate or incomplete information
• Erasure: Request deletion of your personal information ("right to be forgotten")
• Restriction: Request that we restrict the processing of your information
• Data Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to the processing of your personal information for certain purposes
• Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time

To exercise any of these rights, please contact us at support@quantt.co.uk. We will respond to your request within 30 days.

8.1 UK GDPR

If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR). Our legal bases for processing your personal information include: performance of a contract, legitimate interests, and consent. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.

8.2 EEA / EU GDPR

If you are located in the European Economic Area, you are protected under the EU General Data Protection Regulation (GDPR) and have the rights listed above. You may lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us at support@quantt.co.uk, and we will take steps to delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. Most of the services listed in Section 4 are based in, or process data in, the United States. These countries may have data protection laws that are different from the laws of your country. Where we transfer personal information out of the UK, we rely on the UK Extension to the EU-US Data Privacy Framework (where the provider is certified) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: