Quantato ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform ("the Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not access or use the Service.

The Service is an educational platform open to anyone seeking to learn.

Data Controller: Quantato is the data controller responsible for your personal data. For contact details, see Section 14 below.

Account Information:

• Email address (required for account creation)
• Name (optional, may be provided during signup or obtained from Google if using OAuth)
• Profile picture (if provided through Google OAuth)
• Password (encrypted; only for email-based accounts)

Learning Data:

• Topic and section progress within each realm
• Quiz responses and scores
• Code submissions and exercise completions
• Time spent on topics and sessions
• Learning preferences and settings

Technical Data:

• IP address (for security and fraud prevention)
• Browser type and version
• Device type and operating system
• Referring URLs and pages visited
• Date and time of access

Payment Information:

For premium subscriptions, payment processing is handled by a third-party payment processor. We do not store complete credit card numbers or banking details on our servers.

Information You Provide Directly:

• When you create an account
• When you update your profile or settings
• When you complete quizzes or exercises
• When you contact us for support

Information Collected Automatically:

• Usage data through your interaction with the Service
• Technical data through cookies and similar technologies
• Progress tracking as you navigate through content

Information from Third Parties:

• If you sign in with Google OAuth, we receive your email, name, and profile picture from Google
• We do not purchase or obtain personal information from data brokers

We use your information for the following purposes:

To Provide and Maintain the Service:

• Create and manage your account
• Track and synchronise your learning progress across devices
• Personalise your learning experience
• Process transactions (when applicable)

To Improve the Service:

• Analyse usage patterns to improve content and features
• Identify and fix technical issues
• Develop new features based on user behaviour

For Security and Protection:

• Detect and prevent fraud, abuse, and security incidents
• Monitor for account sharing or unauthorized access
• Enforce our Terms of Service

For Communication:

• Send important service announcements
• Respond to your enquiries and support requests
• Notify you of changes to our terms or policies

We Do Not Sell Your Personal Data: We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR) and UK GDPR:

Performance of Contract (Article 6(1)(b)):

• Creating and managing your account
• Providing access to educational content
• Processing subscription payments
• Tracking your learning progress

Legitimate Interests (Article 6(1)(f)):

• Improving and developing our Service
• Ensuring security and preventing fraud
• Analysing usage patterns to enhance user experience
• Enforcing our Terms of Service

Consent (Article 6(1)(a)):

• Sending marketing communications (where applicable)
• Processing data obtained via Google OAuth
• Setting non-essential cookies

Legal Obligation (Article 6(1)(c)):

• Retaining transaction records for tax purposes
• Responding to lawful requests from authorities

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Where We Store Your Data:

Your data is stored on secure servers provided by Supabase, our database and authentication provider. Supabase infrastructure may be located in various regions globally.

Security Measures:

• Encryption in Transit: All data transmitted between you and our servers is encrypted using HTTPS/TLS
• Encryption at Rest: Sensitive data is encrypted when stored
• Password Security: Passwords are hashed using industry-standard algorithms; we never store plaintext passwords
• Row Level Security: Database policies ensure users can only access their own data
• Access Controls: Strict internal access controls limit who can view personal data

While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We use the following third-party services:

Supabase:

• Purpose: Authentication, database storage, and real-time features
• Data shared: Account information, learning data
• Privacy policy: https://supabase.com/privacy

Google OAuth:

• Purpose: Optional authentication method
• Data received: Email, name, profile picture (with your consent)
• Privacy policy: https://policies.google.com/privacy

Payment Processor:

We use a reputable payment processor (such as Stripe) for premium subscriptions. Payment data is handled directly by the processor and subject to their privacy policy.

We use cookies and similar technologies for:

Essential Functions:

• Authentication tokens to keep you logged in
• Security features and fraud prevention
• Session management

Preferences:

• Theme preference (dark/light mode)
• Learning settings and display preferences

Local Storage:

• Offline progress data for improved performance
• Cached content for faster loading

No Advertising Cookies: We do not use cookies for advertising or tracking across other websites. We do not work with advertising networks.

You have the following rights regarding your personal data:

Access: You can request a copy of the personal data we hold about you.

Correction: You can update or correct inaccurate information through your account settings or by contacting us.

Deletion: You can request deletion of your account and associated personal data. Some data may be retained as required by law or for legitimate business purposes.

Export/Portability: You can request an export of your personal data in a structured, commonly used, machine-readable format.

Restriction: You can request that we restrict the processing of your personal data in certain circumstances.

Object: You can object to processing based on legitimate interests.

Withdraw Consent: Where processing is based on consent, you can withdraw that consent at any time.

Right to Complain: You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact your local data protection authority.

To exercise these rights, please contact us at: privacy@quantato.com

We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing certain requests.

Active Accounts:

We retain your data for as long as your account is active and as needed to provide you with the Service.

Account Deletion:

When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain certain information for legal, regulatory, or legitimate business purposes.

Retention for Legal Compliance:

• Transaction records may be retained for up to 7 years for tax and accounting purposes
• Security logs may be retained for up to 2 years
• Data required for legal proceedings will be retained until the matter is resolved

The Service is an educational platform designed to be accessible to learners of all backgrounds. We are committed to providing a safe learning environment.

Parents or guardians who have concerns about any information associated with a young learner's account may contact us to request access, correction, or deletion of that information.

We encourage parents and guardians to be involved in their young learners' educational journey and to review this Privacy Policy together.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

By using the Service, you consent to the transfer of your information to countries outside your country of residence, including to servers and databases operated by our third-party service providers.

We take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Policy regardless of where it is processed.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.

Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Do Not Sell: We do not sell personal information. We have not sold personal information in the preceding 12 months.

To exercise your California privacy rights, please contact us at privacy@quantato.com with the subject line "California Privacy Request".

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page with an updated "Last updated" date.

For significant changes, we may also notify you by email or through a prominent notice on the Service before the changes become effective.

Your continued use of the Service after any modifications to this Privacy Policy constitutes your acceptance of the revised policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

Privacy Enquiries: privacy@quantato.com

Data Protection Requests: dpo@quantato.com

For general enquiries about the Service, please visit our FAQ page or contact our support team.