Privacy Policy
Last updated: 4 July 2026
This Privacy Policy explains how Quant Kollective ("QK", "we", "us") collects, uses, and protects personal data when you use the QK member platform at qk-prop-tools.pages.dev and related tools (the "Platform").
- Data controller: Quant Kollective (UK-based operator)
- Company number: TODO-OPERATOR
- Registered address: TODO-OPERATOR
- Contact / Data protection queries: TODO-OPERATOR (email)
QK is the data controller for the personal data described in this policy, for the purposes of the UK GDPR and the Data Protection Act
- 2018. Whop, Inc. acts as an independent controller (or processor, depending on the data) for identity and payment data it collects directly from you as part of your Whop account — see Section 4.
1. What Data We Collect
1.1 Identity data relayed from Whop
When you access the Platform, we receive a limited identity relay from Whop confirming: your Whop user ID, membership/tier status, email address, and display name. We do not receive or store your full payment card details, billing address, or payment history — that remains with Whop.
1.2 Member app data
Data you generate or upload while using the Platform, keyed to your Whop user ID:
- uploaded trade logs (for prop-firm evaluation simulations);
- saved simulations and simulator configurations;
- watchlists and "liked" strategies;
- download history (which strategies, when, credit usage);
- sizing preferences and other tool settings;
- optional custom prop-firm rule sets you create.
1.3 License and telemetry data
To operate the credit, seat, and license-revocation system described in the Terms of Service, we collect:
- license key checks — timestamp and result of each phone-home validation performed by a downloaded strategy;
- seat / session registrations — which strategy instances are currently registered as running under your license, for concurrency enforcement;
- strategy run heartbeats — periodic pings from a running strategy confirming it remains licensed;
- timestamps of the above events; and
- coarse IP address / approximate location (e.g., country or region level, derived from IP) associated with license checks, used for anti-abuse and seat-integrity purposes — not for precise tracking of your location.
1.4 The embedded watermark
Each strategy file you download is compiled with your own name, email address, and Whop license key embedded in the file, for traceability (see Terms of Service Section 5.3). This is data about you, placed into a file that you own and control. We do not use the watermark to monitor your trading activity beyond the license-check telemetry described in Section 1.3; the watermark's function is to identify the source of a file if it is found outside your control (e.g., shared or leaked).
1.5 Technical data
Standard web/application logs (browser type, device type, coarse usage analytics, error logs) generated by ordinary use of the Platform.
We do not knowingly collect special category data (e.g., health, biometric, or similarly sensitive data), and we ask that you do not include such data in any upload (e.g., trade log filenames or notes).
2. Why We Use Your Data (Purposes and Lawful Bases)
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Provide Platform functionality (simulators, leaderboard, downloads, saved data) | Identity relay, app data | Performance of a contract (Art. 6(1)(b)) |
| License validation, seat enforcement, credit ledger | License/telemetry data, identity relay | Performance of a contract (Art. 6(1)(b)) |
| Prevent fraud, credential sharing, and abuse of the license/seat system | License/telemetry data, coarse IP | Legitimate interests (Art. 6(1)(f)) — protecting the integrity of a paid licensing system |
| Watermarking downloaded files for traceability | Identity relay (your own data) | Performance of a contract (Art. 6(1)(b)) |
| Product improvement, aggregate analytics (e.g., which tools are used) | Technical data, aggregated app data | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (if applicable, e.g., product updates) | Email (via Whop or opt-in) | Consent (Art. 6(1)(a)), withdrawable at any time |
| Compliance with legal obligations (e.g., tax, regulator requests) | As applicable | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered that our interest in protecting a paid licensing system from abuse does not override your privacy rights, given the limited and proportionate nature of the telemetry collected.
3. What We Don't Do
- We do not sell your personal data.
- We do not use your uploaded trade logs or app data for any purpose other than providing the Platform's functionality to you (and aggregate, anonymised product analytics where stated).
- We do not use license-check telemetry to monitor your live trading performance or share it with your prop firm.
4. Data We Don't Control: Whop
Whop, Inc. is the platform through which you create your account, subscribe, and pay for membership. Whop collects and processes your payment details, billing information, and subscription history directly, under Whop's own privacy policy, which you should review separately. QK receives only the limited identity/membership relay described in Section 1.1 — we do not have access to your card details or full Whop account data beyond what Whop's API exposes for entitlement purposes.
5. Processors and Third Parties
We use the following categories of third-party processor to operate the Platform. Processors are contractually bound to only process data on our instructions and to apply appropriate security measures.
| Processor | Role |
|---|---|
| Whop, Inc. | Identity, subscription, and payment relay (see Section 4) |
| Cloudflare, Inc. (Cloudflare Pages / Workers) | Hosting, content delivery, and backend functions for the Platform |
| Hosting / database provider(s) for member app data | TODO-OPERATOR (name once finalised) |
We do not share member app data or license telemetry with prop firms, advertisers, or data brokers.
6. International Transfers
Some processors above (e.g., Whop, Cloudflare) may process data outside the UK, including in the United States. Where this occurs, we rely on appropriate safeguards recognised under UK GDPR, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy finding, as applicable to each processor. You can request details of the specific safeguard used for a given processor via the contact details in Section 10.
7. Data Retention
- Member app data (uploads, saved sims, watchlists, download history) is retained for as long as your membership is active, plus a limited period after cancellation to allow reinstatement, after which it is deleted or anonymised unless a longer retention is required by law (e.g., financial record-keeping).
- License/telemetry data is retained for the period necessary to operate the seat/credit/revocation system and to investigate abuse, typically no longer than 24 months from the event, unless needed for an active dispute or fraud investigation.
- Technical/log data is retained for a limited operational period (typically under 12 months) before deletion or aggregation.
We will delete or anonymise personal data when it is no longer needed for the purposes described above, subject to legal retention requirements.
8. Your Rights (UK GDPR)
Subject to applicable exemptions, you have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — correct inaccurate or incomplete data;
- Erasure — request deletion of your data ("right to be forgotten"), subject to legitimate reasons we may need to retain it;
- Restriction — request we limit processing in certain circumstances;
- Portability — receive your data in a portable format where processing is based on consent or contract and carried out by automated means;
- Object — object to processing based on legitimate interests (including profiling for anti-abuse purposes), and to direct marketing at any time;
- Withdraw consent — where processing is based on consent (e.g., marketing emails), withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at TODO-OPERATOR (email). We will respond within one month as required by law.
Right to complain. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113, if you believe we have not handled your data lawfully. We would appreciate the chance to address your concern directly first.
9. Cookies and Similar Technologies
The Platform uses minimal, functional cookies/local storage necessary for login sessions, security (e.g., CSRF protection), and remembering basic preferences (e.g., saved layout settings). We do not currently use third-party advertising or cross-site tracking cookies. If this changes, we will update this policy and, where legally required, request your consent via a cookie banner.
10. Contact
Data protection queries, rights requests, or complaints: TODO-OPERATOR (email).
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our data practices or legal requirements. Material changes will be notified via the Platform, Discord, or email, with the "Last updated" date above revised accordingly. Continued use of the Platform after an update constitutes acknowledgement of the revised policy.
This document is a launch-grade template. It has not been reviewed by a solicitor or data protection specialist. See COMPLIANCE_NOTES.md for flagged items requiring professional review before scaling the business.