Skip to content

QuantSoc Privacy Policy

Effective Date: 22 September 2026

Introduction

This Privacy Policy explains how Blue Wisdom Software Innovations (the "Company," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use the QuantSoc website and platform (the "Service"). We build and operate the Service and are the controller of the personal information described in this Policy. QuantSoc itself is a student society, a Special Interest Group of CompSoc at the University of Edinburgh. This Policy covers the Service; records the society or CompSoc keep about you outside the Service (for example, membership records) are handled under their own arrangements. This Privacy Policy is a notice describing how we process personal information; it is not a contract, and where the law requires a legal basis for processing we rely on the legal bases described below (not on this notice itself). If you do not agree with our practices, please do not use the Service. This Privacy Policy should be read together with our Terms of Service. Any capitalized terms not defined in this Policy have the meanings given to them in the Terms.

This Privacy Policy applies to all users of our Service worldwide. However, additional notices or rights may apply depending on your country or state's privacy laws (for example, the UK GDPR and Data Protection Act 2018, which apply to us; the EU GDPR; or the CCPA in California). Please read this Policy carefully to understand our practices regarding your information. If you have any questions, you can contact us using the information provided at the end of this Policy.

Information We Collect

We may collect several types of information from and about users of our Service. This includes information that you provide directly, information that is collected automatically as you use the Service, and information from third parties. We aim to collect the minimum data necessary to operate the Service effectively. Below is an overview of the categories of information we collect:

  • Information You Provide to Us: When you use our Service, you may provide certain personal information. This can include:

    • Account Registration Data: When you create an account, we ask for information such as your name, username, email address, password, and/or other contact details. You may also provide profile details like a photo, bio, or other optional information.
    • Content and Communications: If the Service allows you to post or upload content (e.g., text, images, videos, comments) or communicate with us or other users, we will collect the information you submit. This includes any postings on the Service, messages you send to others through the Service, and any feedback or inquiries you send to customer support. Please remember that any content you share publicly on the Service can be seen by others.
    • AI Feature Inputs: Where the Service includes AI-powered features (such as assistants, chat, voice interaction, or content generation), we collect the inputs you choose to provide to those features, such as prompts, messages, uploaded files, or audio, together with the outputs generated in response, in order to provide the feature and maintain your history within it (see "AI-Powered Features" below). Where an AI feature includes a memory capability, we may also store facts or preferences derived from your interactions with that feature (including facts extracted automatically from earlier parts of a conversation) so the feature can remember relevant context across sessions and conversations; where such a capability is offered, you can review, correct, or delete stored memories through the feature or by contacting us, and they are deleted when your account is deleted.
    • Third-Party Connection Details: Where the Service allows you to connect your own third-party tools or services to a feature (for example, by providing an integration address and an access token or key), we collect and store the connection details you supply and use them only to connect to that service on your behalf.
    • Optional Information: You may choose to provide other information directly to us. For example, if you participate in surveys, contests, promotions, or if you submit testimonials or requests for support, you will provide information such as your responses or contact info. We will also collect any information you send us via email or other channels when you contact us.

  • Information We Collect Automatically: Like many online services, we (or our service providers acting on our behalf) automatically collect certain information about your device and usage of the Service whenever you visit or use our platform. This Usage Data helps us to understand how users interact with our Service, to troubleshoot issues, and to improve performance. Information we collect automatically may include:

    • Device and Log Information: We collect details about the computer or mobile device you use to access the Service, such as the device type (e.g., phone, tablet, PC), operating system name and version, browser type and version, screen resolution, unique device identifiers, and network information (e.g., IP address, mobile network). We also maintain server logs which record information when you use the Service, including your IP address, access times, pages viewed, the website you visited before navigating to our Service, and other standard log data.
    • Usage and Analytics Information: We collect information about your activities on the Service, such as the pages or screens you view, how long you spend on each page, navigation paths between pages, your search queries on the Service, crash reports, and other interaction data. We currently use a performance-analytics tool that does not set cookies; if we adopt analytics tools that use cookies or similar technologies, we will ask for any consent the law requires before they are set (see "Cookies and Tracking" below). This helps us understand user engagement and improve our features.
    • Feature-Specific Activity Data: Depending on the features the Service offers, we may record data generated by your use of those features, such as your saved state or settings within a feature, your inputs or submissions, and any output, result, or status a feature produces for you. We use this data to operate the relevant features (such as saving your state and generating results), and, where a feature is public or shared by design, some of it may be visible to other users along with the name and profile photo on your account (see "Sharing with Other Users or the Public" below).
    • Notification Subscriptions: If you enable push or in-app notifications, we store the technical subscription details needed to deliver them (such as a device push token or browser subscription endpoint) and your notification preferences. You can disable notifications at any time through your device, browser, or account settings.
    • Cookies and Tracking Technologies: We use cookies and similar technologies (such as browser local storage) to keep you signed in, remember your settings, and protect the Service. We do not currently use cookies for analytics or advertising. Please see the "Cookies and Tracking" section below for more details on how we use cookies and how you can control them.
    • Approximate Location: We may infer your general location (e.g., city or country) from your IP address or choose to ask for location information (such as city or timezone) to customize certain services. We do not collect your precise geolocation (e.g., GPS data) without your explicit permission.

  • Information from Third Parties: We may receive information about you from other sources, which we may combine with information collected through the Service. For example:

    • Third-Party Services and Social Login: If you choose to register or log in through a third-party account (currently Google or Apple), that service may send us information like your name, email, and profile photo (depending on what the third party's privacy policy and your settings allow). We use this information to facilitate account creation and social features. We will handle any such third-party account data in accordance with this Privacy Policy.
    • Service Providers: We may obtain information from vendors and service providers we work with for security purposes. These third parties collect and share data with us pursuant to their own privacy policies and relevant agreements.

We collect and use personal data only in ways consistent with the purposes described in this Policy and in compliance with applicable laws. If we ever plan to use your personal information for a new purpose that is not compatible with the purposes we originally collected it for, we will update this Policy and notify you as required.

How We Use Your Information

We use the information we collect for various purposes in order to operate, improve, and protect our Service, as well as to comply with legal obligations. Our uses of personal information include:

  • To Provide and Maintain the Service: We use your information to create and manage your account, authenticate you when you log in, and provide you with the features and services you request. For example, we use your information to display your profile and content, to enable communications (like delivering messages between users), and to provide customer support. Essentially, all the day-to-day operations of the Service rely on processing your information as needed to carry out the contract between you and us (the Terms of Service).
  • To Improve and Personalize the Service: We analyze usage information (both individually and in aggregate) to understand user behavior and preferences in order to improve our offerings. This helps us fix technical issues, develop new features, refine the user experience, and inform our decision-making. We may also use information (such as your interactions or profile information) to personalize the Service for you, for example by suggesting content you might be interested in, remembering your preferences, or customizing the way content is presented to you.
  • To Communicate with You: We use contact information (like your email address or in-app notifications) to send you account or transactional communications and important updates. This includes confirmations of your sign-up, technical notices, security alerts, and administrative messages. We may also send you marketing communications such as newsletters, offers, surveys, or promotions, but only in accordance with applicable law: for example, we will obtain any necessary consent before sending promotional emails, and you will have the ability to opt out of such communications at any time. (See "Your Rights and Choices" below regarding communication preferences.) We might occasionally send announcements about new features or solicit feedback to help improve the Service.
  • To Monitor and Ensure Compliance with Policies and Laws: We use information to monitor user activity and ensure it aligns with our Terms of Service and policies (like the Acceptable Use Policy). This includes detecting, investigating, and preventing fraudulent transactions, spam, abuse, security incidents, and other harmful or unlawful activities. For instance, we may use automated systems to screen for known malicious content or use manual review when necessary. If we become aware of violations, we may use data (like logs and user content) to take appropriate action. Additionally, we process personal data as needed to comply with legal obligations, such as responding to lawful requests by public authorities, fulfilling regulatory reporting requirements, or enforcing our legal rights.
  • To Provide Customer Support: If you contact us for help or to report a problem, we will use the information (including your communications with us and any contact info provided) to respond to and resolve your inquiries, issues, and concerns. This may involve reaching out to you via email or through the Service with updates on your support ticket or follow-up questions to ensure resolution.
  • To Provide AI-Powered Features: Where the Service includes AI-powered features, we use the inputs you provide to those features (and relevant context, such as your conversation history within the feature) to generate responses and operate the feature, including maintaining your history and applying usage limits. This processing may involve third-party AI model providers acting on our behalf, as described under "How We Share Your Information" below. Where you are interacting with an AI system rather than a human, we will make that clear unless it is obvious from the context. We do not use AI systems to make automated decisions about you that produce legal or similarly significant effects without human involvement; if that ever changes, we will update this Policy and provide any notices and rights required by applicable law.
  • Aggregated and De-Identified Data: We may aggregate or anonymize personal information so that it can no longer be linked to any specific individual (for instance, by removing or hashing identifiers). We may use such aggregated data for purposes such as research, analysis, improving the Service, and marketing. For example, we might publish trends or insights (like average usage time or the percentage of users interested in a category) as long as that information does not identify any individuals.
  • Legal Bases for Processing: UK data protection law (and, for users in the EEA, the EU GDPR) requires a legal basis for each use of your information. Ours, by purpose: running your account, your learning progress, and leaderboards, contract (the Terms); sending you account and service emails, contract; sharing your CV with partner firms, consent, which you can withdraw at any time; error monitoring, security, and improving the Service, our legitimate interest in running a reliable and safe platform, balanced against your rights; marketing emails and any non-essential cookies, consent; and anything the law requires us to do, legal obligation.

If we need to use your information for a purpose that is materially different from the ones listed here, we will update this Privacy Policy and, if required, seek your consent or give you the opportunity to opt out.

How We Share Your Information

We understand that your personal information is important, and we are not in the business of selling your data to others for profit. We will not sell or rent your personal information to third parties for their own marketing purposes without your explicit consent. However, in the normal course of providing our Service and running our business, we do share information with certain categories of recipients under strict conditions. Below are the scenarios in which we may share or disclose user information:

  • Service Providers and Vendors: We may share your information with third-party service providers and vendors who perform functions and services on our behalf. These include, for example:

    • Cloud Hosting and Storage: We may store data on servers provided by third-party hosting companies. These providers process data only as needed to store and retrieve it for our Service's use.
    • Analytics Providers: We use a performance-analytics tool (currently a service supplied by our web hosting provider that does not set cookies). It processes usage data (which pages are loaded and how quickly they load) on our behalf to provide insights on how the Service is performing.
    • Email and Communications Services: We might use third-party services to send out emails, notifications, or messages (for example, an email service to send verification emails or newsletters). Such services would have access to your email address and the content of the communication as needed to send it.
    • AI and Machine-Learning Providers: Where the Service includes AI-powered features, the inputs you provide to those features (such as prompts, messages, files, or audio) and relevant context may be sent to third-party AI model or infrastructure providers to generate the response or provide the capability (for example, text generation, speech-to-text, text-to-speech, or image generation). These providers process such data on our behalf to deliver the feature. We do not permit them to use your inputs to train their generally available models, and we do not use your AI inputs or your content to train generally available AI models of our own, except where we have told you otherwise at collection and obtained any consent required by law. We aim to send only the data needed to provide the feature, and we may use aggregated or de-identified information to evaluate and improve AI features.
    • Error Tracking and Security Monitoring: We use error-tracking, logging, and security monitoring services to detect and diagnose crashes, bugs, and abuse. These providers may process technical data (such as device and browser information, IP address, and the actions that preceded an error) on our behalf so we can keep the Service reliable and secure. When you upload a CV, if we cannot read your name or email address from it automatically, we send the text of its first page to our AI provider (OpenAI, in the United States) to fill in the missing field, which you can then edit. We may also use AI tools internally to help us operate the Service (for example, to diagnose errors), processing only the information needed for that purpose under the same safeguards as our other service providers.
    • Partner Firms (CV sharing): If you choose to put your CV forward through the Service, the partner firms named on the Service receive it, together with the record of your progress on the Service that you choose to attach. We share nothing with partner firms without that choice. You can withdraw at any time through the Service or by contacting us; we then delete your CV and stop sending it, although a firm that has already received it may keep its copy under its own privacy policy.
    • Other Contractors: We might engage contractors or agencies for services like marketing, improving user experience, or data analysis. They may have access to certain data strictly as needed for their function.

    We ensure that all service providers are bound by appropriate confidentiality and data protection obligations. They are not permitted to use your personal information for any purpose other than providing services to us and to you.

  • Affiliates: We may share information with companies under common control with us ("Affiliates"), for example for data hosting or internal operations. Any Affiliate receiving your information will be required to treat it in accordance with this Privacy Policy (or under practices at least as protective).

  • Business Transfers: If we undertake a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be disclosed or transferred as part of that transaction. For instance, if another company acquires or merges with us, user information would likely be one of the assets transferred to or reviewed by that entity (along with all the rights and obligations related to it). We would seek to ensure that any new owner continues to honor the commitments we have made in this Privacy Policy with respect to your personal data. This type of sharing is common in corporate transactions to ensure continuity of service (your data is part of what makes the service functional) and is done in compliance with applicable laws.

  • Legal Compliance and Protection of Rights: We may disclose your information if required to do so by law or in the good-faith belief that such action is necessary to: (a) comply with any applicable law, regulation, legal process or enforceable governmental request (for example, we may receive court orders or subpoenas to disclose information in a legal proceeding); (b) enforce our Terms of Service, Acceptable Use Policy, or other agreements, or to investigate potential violations thereof; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of the Company, our users, or the public. This can include exchanging information with other companies and organizations for fraud protection and spam/malware prevention. We will limit the disclosure to what is legally necessary and will object to overly broad requests as appropriate.

  • Sharing with Other Users or the Public: Some aspects of the Service may allow you to share information with others. Any information or content that you voluntarily disclose for posting to the Service (such as User Content you post publicly, a profile that is publicly viewable, or comments on a forum) becomes available to other users and can be collected or used by them. For example, if you post a review or a comment, other users may see your username, photo, and the content of your post. Similarly, if the Service allows you to create a public profile, the information in your profile (e.g., bio, city, interests) will be visible to others on the Service. Some features are public or shared by design: for example, if the Service includes features that share your activity or results with other users, the name and profile photo on your account, and your results, may be visible to other users as part of that feature. Please be mindful of your own privacy needs and the privacy of others as you choose what to share in these public or semi-public spaces; we are not responsible for how other users or third parties who have access to your publicly shared information may use or re-share it.

  • With Your Consent: We may share your personal information with other third parties in situations where you have given us your consent to do so. For example, if we partner with another company to offer a joint service or promotion, we might ask if you would like your information to be shared with that partner for a specific purpose. Another scenario might be if you use a feature that allows you to share information to a third-party platform (like sharing an update to Twitter or Facebook from within our Service), in which case we will send data to that platform at your direction. We will make it clear at the time of obtaining your consent what data will be shared and with whom, and we will only do so in accordance with that consent. If you direct us to share data (for example, through an API integration you enable), we consider that as you giving us permission to share. In particular, where you connect your own third-party tool or service to a feature of the Service (such as an AI feature), relevant parts of your activity in that feature (for example, requests the feature makes to your connected tool) are sent to that third party at your direction; such a provider acts on your instructions, not on our behalf, and its own terms and privacy policy govern its use of that data.

  • Organization or Team Accounts: Where the Service offers accounts for organizations or teams and you use the Service through an account provided or administered by an organization, that organization's administrators may access information associated with your account and your use of the Service under that account, as described in our agreement with that organization.

  • No Sale of Personal Information: As stated, we do not sell personal information. The only case in which a partner firm receives your details is the CV sharing you choose, described above, and that happens only with your explicit consent.

  • Advertising Partners: The Service does not serve third-party advertisements and we do not share your information with advertising networks. If that ever changes, we will update this Policy first and provide the notice and choices the law requires (including consent where required and opt-out mechanisms for targeted ads).

In all cases of sharing, we endeavor to share only the information that is necessary to fulfill the purpose (for instance, our email provider doesn't need your full profile data, only your email and name to send communications). We also enter into agreements with third parties to ensure they treat personal information in a manner consistent with this Policy and applicable law. If any sharing does not fall under the categories above, we will disclose it at the time of collection or before sharing.

Cookies and Tracking Technologies

What Are Cookies: Cookies are small text files that websites or services place on your device's browser to store data that can be recalled by the server later. Other similar technologies include local storage, pixels, web beacons (tiny graphic images used to track interactions), and SDKs in mobile apps. We use these technologies for several reasons, as described below. By understanding and controlling cookies, you can influence how information is collected on websites.

How We Use Cookies: The Service uses cookies and similar tracking technologies to enhance your experience and enable certain functionality. We may use cookies to:

  • Authentication and Session Management: When you sign in, we set secure sign-in cookies so you stay signed in on that device until you sign out or they expire. This saves you from having to re-enter your password as you navigate through different pages.
  • Preferences and Personalization: Cookies help us remember your preferences (such as language selection, time zone, or other settings) so that you don't have to reset them each visit. They also allow us to provide personalized content or remember the last page you visited. For example, if you customize certain dashboard settings, we may store those in a cookie.
  • Analytics and Performance: Our current performance-analytics tool does not set cookies. It records how quickly pages load and basic technical details of your device and browser, in aggregate. If we introduce analytics cookies, we will update this section first and ask for your consent where the law requires it.
  • Security: Certain cookies are used to protect the Service and our users, for example by helping us detect malicious activity or violations of our Terms. A cookie might be used to throttle login attempts or to remember an additional verification step.
  • Advertising and Marketing: We do not use advertising cookies. If that ever changes, we will update this Policy first and obtain any consent the law requires.
  • Third-Party Functionality: The Service might integrate third-party services that also use cookies or similar tech. For instance, when you sign in with Google or Apple, that provider may set its own cookie. We do not control these cookies, so we recommend checking those third parties' cookie policies. We will endeavor to only integrate third-party features that respect privacy and provide transparency.

Your Choices Regarding Cookies: You have several options to manage or limit how cookies and similar technologies are used:

  • Browser Settings: Most web browsers allow you to refuse or delete cookies. You can typically find the controls in your browser's "Settings" or "Preferences" menu. However, please note that if you disable cookies entirely, our Service (and many others) may not function properly. For example, you might not be able to log in or certain features might break. It's often better to selectively disable third-party cookies rather than all cookies.
  • Do Not Track: Your browser may offer a "Do Not Track" (DNT) option, which is a preference you can set to signal websites that you do not wish to be tracked across different sites. The web industry doesn't have a consensus on how to respond to DNT signals, and at this time, the Service does not respond differently to a browser DNT signal; we adhere to the practices in this Privacy Policy regardless of receiving one. This does not affect legally recognized opt-out preference signals: where a signal such as Global Privacy Control applies to our processing under the law of your jurisdiction, we will honor it as required.
  • Cookie Banner & Consent: If you are in the UK, the EU, or another jurisdiction where consent is required for non-essential cookies (such as analytics or advertising cookies), we will ask for your consent through a cookie banner or settings mechanism before setting those cookies, and we will honor the choices you make there. Strictly necessary cookies (such as those used to keep you logged in) do not require consent. If you later change your mind, you can usually adjust your preferences through a "Cookie Settings" link on our site.
  • Third-Party Opt-Outs: If we ever use third-party analytics or advertising cookies, you will be able to opt out with those parties as well as through our own settings.

Local Storage and Other Technologies: In addition to cookies, we may use local storage (like browser local storage or HTML5 local storage) to store content information and preferences. Local storage is similar to cookies in that it is stored on your device and can persist between sessions, but it typically stores more data and isn't sent automatically by browsers in the same way cookies are. We use local storage to, for example, remember certain settings or cache data to improve performance. If you want to clear local storage data, you would need to do so from your browser's settings (it may be cleared when you clear your cache or site data). We may also use small graphics (pixels) in our HTML emails to know if emails have been opened or acted upon, which helps us improve our communications. Where the law of your jurisdiction requires consent for such technologies (for example, in the UK or EU), we will only use them with your consent or not at all, and you can also configure your email client to not automatically load images.

We strive to respect user privacy and preferences with regard to cookies and tracking. We will update this section if our use of cookies changes, especially as we implement secure authentication cookies or other new features, to ensure you remain informed about what is stored on your device. If you ever have any questions or concerns about our use of cookies or other technologies, please contact us.

Data Security

We take the security of your personal information seriously and employ measures designed to protect it from unauthorized access, disclosure, alteration, or destruction. We have implemented a combination of technical, administrative, and physical security safeguards appropriate to the sensitivity of the personal data we handle. These measures include:

  • Encryption: We use encryption protocols to protect data transmitted to and from the Service. For example, the Service is served over HTTPS, which encrypts information (such as your login credentials) between your browser and our servers. We may also encrypt certain sensitive information at rest (such as passwords, which are stored using hashing algorithms).
  • Access Controls: Access to personal information is limited to the people who need it to run the Service and to the service providers that process it on our behalf, all under confidentiality obligations. Access to the systems that hold personal data is protected by authentication (strong passwords, two-factor authentication on provider accounts, and unique access keys).
  • Network & System Security: Our hosting providers supply network-level protection, and we keep our software and systems updated to address security vulnerabilities. We keep secure backups.
  • Review: We periodically review our information collection, storage, and processing practices and address any issues we find.

Despite all these efforts, please note that no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. Cyber threats continually evolve, and even well-protected systems can potentially be compromised by skilled attackers or via social engineering. Therefore, you should also take care in how you handle and disclose your personal information. Remember that you are responsible for keeping your account credentials safe. Do not share your password with anyone, and use a unique, strong password for our Service to minimize the risk of unauthorized access. If you suspect that your account or information is no longer secure (for example, if you feel your account has been hacked or you notice unusual activity), please contact us immediately so we can help take appropriate steps.

In the unfortunate event that a data breach occurs and personal information is compromised, we will act promptly to identify the cause and remediate the issue. Where required by law, we will notify affected users and/or regulatory authorities of certain data breaches. We continuously work on improving our security practices to keep your data as safe as reasonably possible.

Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes for which we collected it, as outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In practice, this means:

  • For active user accounts, we generally keep the information for as long as your account exists or as long as needed to provide you with the Service. This allows you to have a continuous experience (e.g., your content and profile persist over time).
  • If you delete your account or request deletion of your personal data, we will delete or anonymize your information so that it no longer identifies you, except for information that we are required or permitted to retain by law. For example, we may retain certain data for a limited time to comply with legal obligations such as resolving disputes, enforcing our agreements (e.g., to have a record of who previously had an account in case of future issues), or as evidence of our compliance with legal requirements. When we retain data for such reasons, we ensure that access to it is restricted to the purpose for which it's retained.
  • Content that you have posted (especially in a public forum or other users' content) might remain on the Service even after you delete your account or delete the original content, if it has been shared or re-posted by others. For example, if you posted in a community forum and later delete your account, your posts might be labeled as from a "deleted user" but still visible. Or if you sent messages to another user, those messages may remain in that user's inbox. We cannot retroactively remove all traces of your interactions that have been stored or copied by others. However, we can anonymize them so that they are not easily associated with your identity.
  • Backup and Archival Copies: Even after you delete information from your account or profile, it may persist in backup or archival copies for a certain period (typically not accessible to others). We maintain backups to ensure the integrity and availability of the Service, so your data might remain on backup servers that aren't actively in use by the Service until those backups are cycled out. We secure those backups and limit access strictly.
  • In certain cases, we may retain data in an aggregated or de-identified form, which does not identify you personally, for purposes such as analytics, research, or business planning. For example, we might keep aggregated statistics about usage even after personal data is purged, but those statistics will not identify any individual user.

In practice: account information and learning progress are kept while your account exists and deleted when you delete it; a CV you have put forward is deleted when you withdraw it or delete your account; error-monitoring events and server logs are kept for the short rolling period our providers apply to them and then discarded; backups roll over on a fixed cycle; and support emails are kept while the matter is open and for a limited period afterwards. When we no longer need personal information, we either delete it or anonymize it. We consider factors such as the sensitivity of the data, the volume, the potential risk of harm from unauthorized use or disclosure of the data, the purposes for which we process it and whether we can achieve those purposes through other means, and any applicable legal requirements.

If you have any specific questions about how long we keep certain types of data, you can contact us (see Contact Information section). We can provide more information or honor requests as required by applicable law (for instance, some privacy laws give you a right to ask that we delete your data; we describe those rights in the next section).

Your Rights and Choices

You have certain rights and choices regarding your personal information and how we handle it. We are committed to providing you with appropriate access and control over your data, in line with our broad compliance approach. Below is an outline of your rights and how you can exercise them:

  • Access and Portability: You have the right to request a copy of the personal information we hold about you, and to obtain it in a portable format (in many cases). This means you can ask us to confirm whether we are processing your personal data and, if so, to provide you with a copy of that data in a commonly used electronic form. For example, you might want a copy of your profile information and content you've provided. In certain jurisdictions, you may also have the right to transfer that data to another service (where technically feasible). If you need such a copy, please contact us and specify what information or processing activities your request relates to. We will need to verify your identity (to ensure we don't give your data to someone else), and then we will supply the data consistent with legal requirements.

  • Correction (Rectification): We strive to keep your personal information accurate and up-to-date. If you discover that the information we have about you is incorrect or incomplete, you have the right to request that we correct or update it. Much of your basic account info can be corrected by you directly through your profile settings (e.g., you can update your email or name). For any information you cannot update yourself, you may contact us to request correction. We may ask for documentation to validate the correct data in some cases, and we will make the corrections as soon as practicable.

  • Deletion (Right to Erasure): You can request that we delete or remove your personal information. There are various ways to do this: you may delete certain content or information directly via the Service (for example, deleting a post or removing a profile field), you may use a provided account deletion function (if available in your account settings), or you may contact us to request deletion. We will honor deletion requests and wipe your personal data, except where retention is required or permitted by law. For instance, if you simply withdraw consent for marketing emails, we would suppress your email address for that purpose (to respect your opt-out) but not delete it entirely if you still have an account. We will inform you if any information cannot be deleted due to legal obligations. When we delete data, we will also inform any processors or third parties who have it due to our service (where feasible) to also delete it, provided no legal exception applies. Do note that removal from backups may take additional time.

  • Withdrawal of Consent: In cases where we rely on your consent to process personal data (for example, if you agreed to receive marketing emails or allowed us to collect precise location), you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, and it will not affect processing of your data under other legal bases (e.g., if we still need your data to perform a contract with you). If you withdraw consent for something like marketing communications, we will stop the processing for those purposes promptly. For example, you can unsubscribe from marketing emails via the unsubscribe link in those emails, or adjust certain privacy settings in your account if available.

  • Objection to Processing: You may have the right to object to the processing of your personal data under certain circumstances. For example, if we are processing your data based on legitimate interests (like for direct marketing or personalization), you can object to that processing. If you object, we will evaluate whether our legitimate grounds for processing override your privacy interests or if we need to retain the data for legal claims. For direct marketing objections, we will stop processing your data for those purposes as required by law.

  • Restriction of Processing: In certain cases, you can request that we temporarily limit the processing of your data (for example, while we address a data correction request or an objection). This means we would hold onto the data but not use or share it during the restriction period except for limited purposes (like legal compliance or with your consent). If you request restriction, we will let you know if we can comply and for how long.

  • Opting Out of Communications: Even if you cannot exercise a full deletion or objection right, you always have the ability to opt out of specific communications. For instance:

    • Promotional Emails: As mentioned, you can click the "unsubscribe" link in any marketing email we send to opt out of further marketing communications. You can also adjust your preferences in your account settings (if provided) or contact us to be removed from our mailing lists. Keep in mind, even if you opt out of promotional emails, we may still send you service-related communications (like account notices or password reset emails) as those are not promotional.
    • Notifications: If we offer in-app or push notifications, you can usually disable these by changing the settings on your device or in the app (for push notifications) or in your user settings (for in-app alerts).
    • Cookies and Tracking: As discussed in the Cookies section, you can control tracking technologies to some extent (e.g., by opting out of analytics or ad cookies). Use the tools described above to manage those preferences.

  • California Privacy Rights (if applicable): If you are a California resident, state law (such as the California Consumer Privacy Act, CCPA) provides you specific rights, including the right to know and access what personal information has been collected about you in the past 12 months, the right to know the categories of sources and third parties with whom it is shared, the right to delete (with similar exceptions as above), and the right to opt out of any "sale" of your personal information. We have essentially structured our Policy to already honor those rights (we do not sell personal info in the traditional sense, as stated, and we provide access and deletion rights to all users). California's "Shine the Light" law also allows residents to request a notice identifying the categories of personal information shared with third parties for direct marketing in the preceding year, along with contact information for those third parties. As we do not share personal info with third parties for their direct marketing without consent, this is largely not applicable. California law also provides rights to correct inaccurate personal information and to limit the use of sensitive personal information, which we honor as described in this section and the rights above. We do not "sell" or "share" personal information as those terms are defined in California law (including "sharing" for cross-context behavioral advertising). If we ever begin to sell or share personal information in that sense, we will first provide the required notice and opt-out mechanisms, including honoring opt-out preference signals such as Global Privacy Control. Nevertheless, if you are a California resident and have questions or requests under those laws, you can contact us and we will address them per applicable law.

  • GDPR and Other Regions: If you are located in the European Economic Area (EEA), United Kingdom, or other regions with similar laws (like GDPR or equivalent), the rights described above (access, correction, deletion, objection, etc.) generally apply to you, and in some cases even more rights (like portability) explicitly. We aim to allow those rights to all users where feasible. Additionally, under the UK GDPR you have the right to complain to the Information Commissioner's Office (ico.org.uk), and if you are in the EEA to your local data protection authority, if you believe we have infringed your data protection rights. We encourage you to contact us first so we can try to resolve any concerns directly.

To exercise any of your rights, please contact us at hello@quant-soc.com. For security, we will likely ask you to verify your identity (for example, by confirming control of your account email) before fulfilling your request. We will respond to your request within a reasonable timeframe as required by law (within one month for most requests, but we may extend that period if necessary and permitted). If we cannot fulfill your request, we will provide an explanation, such as if the request conflicts with legal obligations or if it is excessive or unfounded.

Your choices: In summary, you have choices in how your information is used. You are not required to provide all personal information identified in this Policy to use the Service, but certain functionality may be unavailable if you do not. For example, if you choose not to provide an email, you cannot create an account. You can use the Service in a more privacy-preserving manner by limiting what you share publicly, by adjusting settings, and by not connecting unnecessary third-party accounts. We encourage you to take advantage of the privacy controls built into our Service and to contact us if you need any clarifications.

We are committed to enabling and honoring these rights and choices for all users where feasible, not only where a specific law compels it. This broad compliance approach is intended to keep our practices robust even as privacy laws evolve.

Children's Privacy

Protecting the privacy of young users is especially important. Our Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 years old. If you are under 13, please do not attempt to register for the Service or send any personal information about yourself to us. If we learn that we have inadvertently collected personal data from a child under 13, we will take prompt steps to delete such information from our records.

Users aged 13 to 17 may use the Service. We do not rely on parental consent for their use; where a feature needs consent, we ask the user directly, and we encourage parents and guardians to be involved. Where the law of your country sets a higher age of digital consent for information society services (for example, 14 to 16 in some EU countries), we will not rely on your own consent for processing that requires consent below that age; we will instead require parental consent or not offer you the relevant feature. Even so, we encourage parents and guardians to be involved in their children's online activities and to teach them about safeguarding their personal information.

Parental Control: If you are a parent or legal guardian and you believe that your child under 13 (or a minor under 18 using the Service without consent) has provided us with personal information, please contact us immediately at hello@quant-soc.com. We will work with you to investigate and, if applicable, delete that information. We may require proof or verification of your relationship to the child for safety and privacy reasons.

Teen Users (13-17): For users under 18 we collect no more than we do for adults, show no advertising, and share nothing with partner firms unless you choose to put your CV forward. Two features are worth knowing about: leaderboards show the name and profile photo on your account to other signed-in users, and the CV book is shared with partner firms only if you choose to put your CV forward. If you are under 18, think about what name and photo you use on your account, and talk to a parent or guardian before sharing a CV.

We do not knowingly collect data from children, and we have measures in place to remove any such data if discovered. We encourage all users, especially young users, to exercise caution and not share sensitive personal details on the Service.

International Users and Data Transfers

The Service is open to users around the world, and as such, your personal information may be stored and processed in countries other than your own. Specifically, the Company is based in the United Kingdom. Our backend servers and main database are hosted in Germany (in the European Union), so if you live in the UK your account information is stored outside the UK, in a country the UK recognises as giving adequate protection. Some of the service providers that act on our behalf are based in, or may process data in, the United States: our website host and content-delivery network, our file-storage provider, our error-monitoring provider, the providers of our AI features, and the host of our support mailbox. This means that when you use the Service, your information may be transferred to and stored on servers in a country different from where you reside.

Different countries have different data protection laws, which may not be as protective as the laws of your home jurisdiction. However, we take steps to ensure that your personal information is treated securely and in accordance with this Privacy Policy and applicable law, regardless of where it is processed. Our measures include:

  • Legal Frameworks: Where we transfer personal information out of the UK or the European Economic Area (EEA), we rely on an adequacy decision or UK adequacy regulations, or on standard contractual clauses (the EU clauses, with the UK Addendum or the UK International Data Transfer Agreement for UK data) that bind the recipient to protect your data to UK and EU standards. Similarly, for other international transfers, we comply with analogous frameworks or requirements.
  • Service Providers in Other Countries: Several of our US providers are certified under the EU-US Data Privacy Framework and its UK Extension; for the others we rely on standard contractual clauses, as described in the notice for EU and UK users below. We choose reputable providers with strong privacy and security commitments and flow down our data protection obligations to them via contracts.
  • Consent for Specific Transfers (rare): We do not rely on your consent for our routine international transfers; we rely on the safeguards described above. In limited cases, we may specifically ask for your explicit consent to a particular transfer where the law requires it, after informing you of the possible risks, and you may refuse or withdraw that consent. If you sign up from a country with strict data localization laws, we will abide by those laws (and perhaps not transfer data out unless allowed).
  • Monitoring Changes: The landscape of international data transfers is evolving (for example, the EU-US Data Privacy Framework replaced an earlier framework that was struck down). We are committed to staying current with these developments and will adjust our data transfer practices to remain compliant. We will update this Policy or provide other notice if there are significant changes to how we handle cross-border data transfers.

Jurisdiction-Specific Rights: If you reside outside of the country where our main operations are, you may have certain rights under your local laws which we have endeavored to cover in the "Your Rights and Choices" section. We also note that by having a broad, flexible policy, we intend to respect these rights for all users where feasible, even where a particular right might not formally be enforceable against us in your jurisdiction.

Important Notice for EU/UK Users: The personal information we collect from individuals in the EEA, UK, or Switzerland may be transferred to and processed in a country outside of those regions, in particular the United States. In such cases, we ensure that at least one of the following safeguards is implemented: (i) the destination is covered by an EU adequacy decision or UK adequacy regulations (for the United States these apply only to companies certified under the EU-US Data Privacy Framework and, for transfers from the UK, its UK Extension, known as the UK-US "data bridge"); (ii) use of specific contracts approved by those authorities (such as the EU Standard Contractual Clauses and, for transfers from the UK, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) which give personal data similar protection as in the UK and EU; or (iii) reliance on an applicable derogation under Article 49 of the UK GDPR or EU GDPR (such as your explicit consent or necessity for contract). If you have inquiries about international data transfer or want to obtain a copy of the relevant safeguard (e.g., contractual commitments), you can contact us.

Where we transfer personal information internationally, we rely on the safeguards described above rather than on your consent, unless we expressly ask for your consent for a specific transfer. We will do our utmost to ensure that any cross-border data handling complies with all applicable data protection rules and that your rights are protected.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Our goal is to ensure that this Policy keeps pace with what we actually do. Significant changes in how we collect or use personal information will be reflected here.

Notification of Changes: If we make material changes to this Privacy Policy, we will notify you by appropriate means. This may include:

  • Updating the "Effective Date" at the top of this Policy (and possibly noting in the introduction that the Policy has been revised).
  • Posting a notice on our website or within the Service (for example, a banner or pop-up notification) to grab attention to the fact that the Privacy Policy has changed.
  • In some cases, we might send you a direct communication, such as an email or message, especially if required by law or if the change is significant (for instance, if we were to start collecting new types of data or using data in a materially different way than stated at collection, you might receive an email outlining the changes).

We encourage you to periodically review this Privacy Policy to stay informed about how we are protecting the personal information we collect. If you continue to use the Service after an updated Policy takes effect, the updated Policy will describe our processing from that point on; where a change requires a new legal basis (such as fresh consent), we will obtain it rather than rely on your continued use. If you do not agree with any changes, you should discontinue use of the Service and can request deletion of your data as outlined above.

Minor updates that do not materially affect your rights (such as clarifications, typographical corrections, or changes that expand your rights or further limit our uses) may be made without prior notice, though the updated Policy will always be accessible.

We maintain an archive or change log of previous privacy policy versions (available upon request), so you can see how the policy has evolved. If there's any discrepancy between older versions and this current version, this version prevails.

Contact Information

If you have any questions, concerns, or requests regarding these Terms of Service or the Privacy Policy, you can contact us at:

Email: hello@quant-soc.com (for general inquiries or privacy-specific requests)

For privacy-specific inquiries or requests (such as data access or deletion requests), please include "Privacy Request" in the subject line of your email or correspondence, and describe the nature of your request with sufficient detail to allow us to respond appropriately. We may need to verify your identity before addressing certain requests, to protect your privacy and security.

If you are a resident of certain regions, you may also have the right to lodge a complaint with your local data protection authority (e.g., in the EU, the supervisory authority in your country; in the UK, the ICO; in Canada, the OPC; etc.) if you believe your privacy rights have been violated. We would appreciate the chance to deal with your concerns directly before you approach a regulator, so please consider reaching out to us first.

Language: This Privacy Policy may be available in multiple languages. The English version shall be the governing version in case of any conflict or inconsistency between translations.

Thank you for taking the time to read our Privacy Policy. We value your trust and are committed to safeguarding your personal information.