Privacy Policy

This Privacy Policy explains, in plain language, what personal data QuoTrend collects, why we collect it, who we share it with, and the rights you have over your data.

1. Who we are

QuoTrend (the “Service”, “we”, “our”) is a financial-data service operated by Candlewise Technologies Ltd, a company registered in Cyprus under registration number HE 495173, with its registered office at 18 Spyrou Kyprianou, 7577 Mazotos, Larnaca, Cyprus. Candlewise Technologies Ltd is the data controller responsible for your personal data.

You can reach us at [email protected] about any privacy matter — including subject-access requests, rectification, erasure, portability, objection, or complaints. We respond within 30 days as required by GDPR Article 12.

2. What we collect and why

We group personal data into a small number of clear categories:

Account & identification

Email address, hashed password, display name, account creation timestamp, last sign-in. If you sign in with Google, we also receive your Google account email + profile name. This is the minimum needed to give you an account, sign you in, and contact you about the service.

Subscription & billing

If you subscribe to QuoTrend Premium, our payment processor collects your payment information directly. We never see your card number. We retain your customer ID with the payment processor, your subscription tier, and the billing history we need to give you receipts. The payment processor retains tax records for 7 years as required by EU tax law.

Content you create

Tickers you watch, portfolios + transactions, screener presets, alert configurations, dashboard layouts, free-text notes. We store this so we can show it back to you across sessions and devices. Please do not put sensitive personal data (such as health, political, religious, or financial-identifier information) into free-text fields like portfolio notes.

Technical & security data

IP address, user-agent, request paths, response codes, timestamps. We use this to keep QuoTrend secure, detect fraud, and investigate incidents. IPs in our consent log are stored as a one-way hash, not in the clear. Server logs are retained for 12 months.

Bot detection

On our registration and login pages we use a third-party bot-detection service. The service receives your IP address and interaction signals directly from your browser to determine whether the request is human. We do not see the raw signal — we only receive a pass/fail score that we use to decide whether to allow the action.

Cookies & consent record

When you respond to our cookie banner we record your choices, the policy version, a hashed IP, your browser, and a timestamp. This is the proof of consent the law requires us to keep. See section 8 for more on cookies.

Special categories

We do not knowingly collect special categories of personal data (health, political, religious, biometric, sexual orientation, etc.) or data about criminal convictions. We have no business reason to do so.

3. Why we are allowed to process your data (legal bases)

Under GDPR we must rely on one of six legal bases for each processing activity. The bases we rely on are:

Performance of a contract (Art. 6(1)(b)) — running your account, processing your subscription, storing the portfolios and alerts you created. We cannot deliver QuoTrend without this data.
Legal obligation (Art. 6(1)(c)) — keeping tax + invoicing records, keeping proof of your consent, responding to your data-subject requests.
Legitimate interests (Art. 6(1)(f)) — security logging, fraud and abuse prevention (including Google reCAPTCHA), and error and stability monitoring (diagnosing crashes and failed page loads so the service keeps working — this uses an EU-hosted monitoring provider, is limited to technical error details, records no special-category data, and does not capture your screen or the text you type). We have weighed our interest against your rights and concluded the processing is proportionate and expected. You can object at any time by emailing us.
Consent (Art. 6(1)(a)) — non-essential cookies, marketing emails (when we offer them). You can withdraw consent at any time from the cookie banner or your account settings.

4. Who we share your data with

We share personal data only with the vendors that help us run QuoTrend, and only the minimum each one needs. Vendors that process personal data on our behalf are bound by Data Processing Agreements under GDPR Article 28; a small number of recipients — such as Google when you choose “Sign in with Google”, or Telegram if you connect it to receive alerts — act as independent controllers under their own privacy policies. The categories of recipients are:

Payment processors — for managing subscriptions, billing, invoicing, and the customer billing portal.
Authentication providers — for “Sign in with Google” if you choose to use single sign-on.
Bot-detection / fraud-prevention services — to distinguish genuine users from bots on registration and login.
Hosting and infrastructure providers — for running the application server, the database, and our worker processes.
Content-delivery and edge-security providers — for serving the site quickly, terminating TLS, and mitigating DDoS / abusive traffic.
Logging and observability providers — for diagnosing issues and detecting security incidents.
Email-delivery providers — for sending account and security emails (password resets, alert notifications you configured) and, where you have consented, product emails.
Messaging platforms you connect — if you choose to connect Telegram to receive alerts, Telegram receives your chat identifier and the alert messages we send you there.
Analytics providers — only if you consent through the cookie banner; pseudonymous usage statistics with no name or email attached (see section 8).
AI / machine-learning providers— when you use our AI screening features, the text you type is sent to an AI provider to translate it into screener filters. Please enter only what you would put in a search box; don’t include personal or sensitive information.

A current list of the specific sub-processors we use is available on request from [email protected]. If we ever add a category of recipient or a sub-processor in a different jurisdiction, we will update this Privacy Policy and notify you before the change takes effect.

Our market-data feeds receive only public ticker symbols and our own API keys — no personal data of QuoTrend users is shared with them.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

5. International transfers of data

Some of our vendors are located outside the European Economic Area (EEA), most commonly in the United States. Where this happens, we rely on one of the following safeguards:

The EU-US Data Privacy Framework adequacy decision, where the recipient is certified under the framework.
The European Commission's Standard Contractual Clauses(SCCs) included in the vendor's Data Processing Agreement, with supplementary technical measures where appropriate.

You can request a copy of the safeguards in place for any specific transfer by emailing [email protected].

6. How long we keep your data

Account data:while your account is active. If you don't sign in for around 23 months we email you a warning, and after 24 months of inactivity we delete the account (signing in at any point keeps it). When you delete your account yourself we soft-delete for 20 days (in case you change your mind), then permanently delete.
Payment records: 7 years.
Server & security logs: 12 months on a rolling basis.
Consent records: 3 years from the most recent consent action, so that we can prove your consent if required.

7. Your rights

If you are in the EU, EEA, UK, or Switzerland, GDPR gives you the following rights. We honour the same rights for users elsewhere as a matter of policy.

Access — get a copy of the personal data we hold about you.
Rectification — correct data that is inaccurate or incomplete.
Erasure (right to be forgotten) — ask us to delete your data, subject to limited legal exceptions (e.g. tax records).
Restriction — ask us to pause processing while a dispute is being resolved.
Portability — receive your data in a machine-readable format and transfer it to another service.
Objection — object to processing based on legitimate interests, including any profiling.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaintwith the data protection supervisory authority of the EU/EEA member state where you reside, where you work, or where the alleged infringement took place. You can also contact us first at [email protected] — we'd rather hear it from you and try to put it right.

You can exercise most rights from your account settings (export your data, change preferences, delete your account) or by emailing [email protected]. We respond within 30 days. We may ask you to verify control of your account email before completing a request.

8. Cookies and similar technologies

We use a small number of cookies and equivalent browser-storage items, grouped into three categories:

Strictly necessary — authentication, session management, security, and remembering your cookie choice itself. These are always on; the service does not work without them.
Analytics (off by default) — aggregated, non-identifying statistics that help us understand how QuoTrend is used. Activated for you only if you consent through the cookie banner; without your consent no analytics run.
Marketing (off by default) — email-engagement and campaign-measurement cookies. Currently not in use — would be turned on only with consent.

Separately, we use a privacy-first, cookieless audience-measurement tool that stores nothing on your device and creates no persistent or cross-site identifier. Because it sets no cookies and does not identify you, it runs for all visitors under our legitimate interest in understanding aggregate traffic and site performance — it is not part of the consent-based Analytics category above and does not require a cookie choice. It records only aggregate signals such as page views, referrers, approximate country, and page-load timing.

You can change your cookie choices at any time — .

9. How we protect your data

We apply technical and organisational measures appropriate to the risk, including: TLS 1.2+ in transit, encryption at rest, salted password hashing (bcrypt), least-privilege access controls, infrastructure separation between staging and production, and a documented incident-response procedure. If we ever detect a personal data breach, we will notify the relevant supervisory authority within 72 hours where required, and notify affected users when the breach is likely to result in a high risk to their rights.

10. Children

QuoTrend is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it.

11. California & other US state residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA, as amended by CPRA). We grant substantively the same rights to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, and other US states that have adopted comparable laws.

Right to know what personal information we have collected about you, the sources, the purposes, and the categories of third parties we share it with.
Right to delete the personal information we hold, subject to limited legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing for cross-context behavioural advertising. QuoTrend does not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of. If this ever changes we will update this policy and add a clear opt-out mechanism.
Right to non-discrimination for exercising any of the above.

To exercise any of these rights, email [email protected]. We will verify your identity (typically by confirming control of the email address on your account) and respond within 45 days, with a possible 45-day extension for complex requests. You may also designate an authorised agent to make a request on your behalf — we will require written confirmation from you that the agent is authorised before acting.

Global Privacy Control (GPC): we honour the Global Privacy Control browser signal. Where your browser sends a GPC header, we treat it as an opt-out of any future sale or sharing of personal information for cross-context behavioural advertising. As stated above, we do not sell or share at all today, so the GPC signal currently confirms what is already true; if our practices ever change, the signal will continue to apply.

12. Changes to this Privacy Policy

We may update this policy from time to time. The version number and last-updated date at the top of the page identify the current version. If we make material changes — for example, a new processing purpose or a new third-party recipient — we will notify registered users by email and re-prompt for consent through the cookie banner before the change takes effect.

13. Open Source Attribution

We are grateful to the open-source community and the developers who build the tools that power our platform. Below is a list of the open-source libraries we use, along with their respective licenses and copyright notices.

lightweight-charts

This product includes software developed by TradingView, Inc.

Library: lightweight-charts
License: Apache License 2.0
Copyright: Copyright (c) 2025 TradingView, Inc.

Attribution Notice:

TradingView Lightweight Charts™
Copyright (c) 2025 TradingView, Inc.
https://www.tradingview.com/

lightweight-charts-drawing

Library: lightweight-charts-drawing
License: MIT License
Copyright: Copyright (c) deepentropy

License Text:

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

14. Comments and Questions

If you have any questions, comments or concerns about this Privacy Policy or how we handle your personal data, please email [email protected] or use our contact form.