QuantLab
DE EN

Privacy Policy

Last updated: 8 August 2026

This policy describes which personal data we process, for what purpose and on what legal basis. It covers the customer platform and the licence check that comes from the running Expert Advisor.

This is a courtesy translation. In case of any discrepancy, the German version prevails.

Controller

We have not appointed a data protection officer; the legal requirements for doing so are not met.

What we process

Account and sign-in

We store your e-mail address, the time of registration and your sessions (a random token and the time it was last used).

We do not store a password. Signing in works through a link we send you; it is valid for a few minutes. What is not stored cannot be stolen.

Legal basis: Art. 6 (1)(b) GDPR (performance of a contract).

Purchase and billing

Payments run through Stripe. We never see complete card details. From Stripe we receive the customer ID, the subscription status, the end of the paid period and the payer's e-mail address.

Legal basis: Art. 6 (1)(b) GDPR. For retaining invoices additionally Art. 6 (1)(c) GDPR (§ 147 AO, § 257 HGB).

Licence and connected trading accounts

This is the processing that an ordinary website does not have, which is why it is set out here in detail:

Every Expert Advisor we deliver checks at regular intervals whether your licence is valid. In doing so it transmits to our server:

We store the account number, the broker and the first and last time an account reported in. This produces the list under Licences, where you can release slots yourself.

What the Expert Advisor does NOT transmit: no positions, no orders, no trading results, no broker credentials. We see that an account uses the bot — not what it trades.

Legal basis: Art. 6 (1)(b) GDPR. Binding a licence to a limited number of accounts is part of the contract; without it a licence key could be passed on without limit.

Account balances — only if you switch it on

Under Accounts you can set a switch per account. When it is on, the Expert Advisor additionally transmits, in the same licence check:

Nothing more. Even with the switch on we transmit no positions, no orders and no individual trades.

The switch is off by default. It does not control what we store but what leaves your machine in the first place: the server tells the Expert Advisor in the licence response whether it should send anything. For anyone who never sets it, the section above remains complete — nothing about their trading is transmitted.

Purpose: from this the cockpit calculates your distance to the daily loss limit and plots the history. We store one value per day and account.

Legal basis: Art. 6 (1)(a) GDPR (consent). You may withdraw it at any time with effect for the future by switching it off again; transmission then stops with the next licence check. If you remove the account, we delete the stored daily figures with it immediately.

Downloads

For every download we record which algorithm in which version was downloaded when and by which account. We need this in order to keep older versions available to you and to detect misuse.

Legal basis: Art. 6 (1)(b) and (f) GDPR.

Server logs

Retrieving the pages generates technical data: IP address, time, requested address, status code, volume transferred, browser identification. These serve operation and defence against attacks and are deleted after 14 days at the latest.

Legal basis: Art. 6 (1)(f) GDPR (operation and security).

Cookies

We set two cookies, both technically necessary, none for advertising:

There is no consent banner because there is nothing to consent to: § 25 (2) no. 2 TDDDG does not require consent for technically necessary cookies.

We embed no external fonts, no analytics services and no advertising networks. The site loads files exclusively from our own server.

Who else receives the data

Data processing agreements pursuant to Art. 28 GDPR are in place with these providers where they act in that role. Stripe processes payment data partly under its own responsibility; see Stripe's own policy at stripe.com/privacy.

Where data is transferred to countries outside the EU, this is done on the basis of the European Commission's standard contractual clauses.

We do not sell data. Any disclosure beyond the above occurs only where we are legally obliged to make it.

How long we keep data

After that we delete or anonymise.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with effect for the future.

Write to %%email%%. We reply within the statutory period of one month.

Independently of this, you may lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg.

Minors

Our offering is directed at persons aged 18 and over. We do not knowingly collect data from minors.

Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The licence check decides only whether a key is valid on an account — it does not assess a person.

Changes to this policy

If what we process changes, we change this policy and the date above. In the case of material changes we will also inform you by e-mail.