Privacy policy
Effective date: [EFFECTIVE DATE]
This policy explains what personal information Kwaant collects through kwaant.com, why, who it is shared with, how long it is kept and the choices you have. We have written it to be read, not skimmed past. If anything is unclear, email us at hello@kwaant.com.
1. Who we are
Kwaant is an AI quantitative research tool for retail traders. The website kwaant.com and the early-access programme are run by Tosh Grob and a co-founder (together "Kwaant", "we", "us"), based in Florida, United States.
Where the EU or UK General Data Protection Regulation (GDPR) applies, we are the controller of the personal information described here. We have not appointed a data protection officer. Contact for anything in this policy: hello@kwaant.com, or by post to the address above.
2. What we collect
We collect only what we need to run the website and the early-access application.
When you apply (step 1)
- Your email address. This is the only information you must give to apply; without it we cannot record your application or contact you about it.
- Where on the page you applied from (for example, the opening section or the final section).
- The address of the website that sent you to us, if any (the "referrer"), and any campaign tags in
the link you followed (for example,
utm_source). We use these to understand which channels bring interested traders. - The time you applied.
- Whether you ticked "Send me occasional updates about Kwaant". If you did, we record the time and the exact wording you saw, as a record of your consent. The box is never ticked for you.
If you answer the optional questions (step 2)
Every question can be skipped, and skipping does not affect your place on the list.
- What you trade (Futures, Options, Forex, Something else).
- How you would describe your trading style.
- How long you have been trading.
- Whether you have a strategy you trade today.
- Whether you use Pine Script.
- "Describe your strategy": a short description you write in your own words, up to 2,000 characters.
To link your answers to the email you gave in step 1, your browser holds a random one-time code for the length of your visit. The code expires after a day and is not stored in your browser afterwards.
Information needed to keep the form free of spam
Before an application is accepted, a spam check provided by Cloudflare (Turnstile) confirms it comes from a person rather than an automated program. To do this, Cloudflare processes your IP address and technical information about your browser and connection (such as its user agent and TLS fingerprint). It does not read what you type into the form. We receive only a pass or fail result. We do not store your IP address with your application.
Information processed when you visit
- Like every website, our hosting provider receives your IP address and basic request details (such as the page requested, time and browser type) so it can deliver the page and protect it from abuse. These server logs are kept by the provider for a short period under its own policies. We do not use them to identify you.
- We count visits with privacy-friendly analytics provided by Cloudflare Web Analytics. They do not use cookies, do not follow you across websites and do not build a profile of you. We see totals, such as how many people visited a page or which country visits came from.
What we do not collect
We do not ask for payment details, broker details, account balances or trading records. Please do not include in your strategy description anything you consider highly sensitive, any information about other people, or anything you are not free to share.
3. Why we use it, and our legal basis
| What we do | Information used | Legal basis (where the GDPR applies) |
|---|---|---|
| Record and manage your application and send you a confirmation email | Email, application details | Steps taken at your request before a possible contract (Art. 6(1)(b)) |
| Understand who is applying and choose who to invite to the beta, including the few applicants we pick for a free strategy test | Your optional answers and strategy description | Our legitimate interest in selecting suitable beta users and building a product that suits them (Art. 6(1)(f)) |
| Contact you about your application, the beta and the early-access benefits | Steps taken at your request (Art. 6(1)(b)) | |
| Send occasional updates about Kwaant | Your consent, only if you ticked the box (Art. 6(1)(a)) | |
| Measure which channels and parts of the page bring applicants | Where you applied, referrer, campaign tags, visit totals | Our legitimate interest in improving the website (Art. 6(1)(f)) |
| Keep the form and website secure and free of spam | Technical data processed by the spam check and hosting provider | Our legitimate interest in security (Art. 6(1)(f)) |
| Comply with the law and protect our rights | Any of the above, as needed | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 8).
People at Kwaant read applications and decide who to invite. We do not make decisions about you by automated means alone. The spam check is automated, but it only screens out automated submissions; if it blocks you by mistake, email us and we will add your application by hand.
4. Your strategy description
A strategy can be personal and valuable, so we treat what you write in "Describe your strategy" as confidential:
- We use it only to understand you as an applicant and to decide who to invite, including the few applicants we pick for a free strategy test.
- Only the people who run Kwaant can read it, along with the service providers in section 5, who act on our instructions.
- We never sell it, publish it or share it with anyone else, and we do not trade on it.
This does not stop us from building features or tests that happen to resemble ideas we see in applications, as long as we do not use or disclose your description itself.
5. Who we share it with
We do not sell or rent your personal information, and we do not share it for advertising. We share it only with service providers that process it on our behalf, under data processing terms that require them to protect it and use it only to provide their service to us:
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Cloudflare, Inc. | Hosts the website, runs the application form and stores applications in its database (Cloudflare D1) | The website on Cloudflare's global network; the database in eastern North America |
| Plus Five Five, Inc. ("Resend") | Sends the confirmation email, our application notifications, and updates if you opted in | United States |
| Cloudflare, Inc. (Turnstile) | Spam check on the application form | Cloudflare's global network |
| Cloudflare, Inc. (Web Analytics) | Cookieless visit totals | Cloudflare's global network |
| [EMAIL PROVIDER] | Our business email, where a copy of each application (including your answers) arrives as a notification | [EMAIL PROVIDER REGION] |
Cloudflare also uses the technical signals from the spam check, as its own controller, to improve its bot detection. Its Turnstile privacy addendum explains how.
We may also disclose information if the law requires it, to protect our rights or the safety of others, or to a successor if Kwaant is reorganised, merged or sold. In that last case we will tell you before your information becomes subject to a different privacy policy.
6. International transfers
We are based in Florida, United States, and several of our providers process data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information may therefore be transferred to countries whose data protection laws differ from yours. When it is, we rely on recognised safeguards: the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or the European Commission's Standard Contractual Clauses with the UK Addendum, which our providers include in their data processing terms. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
We keep your application until the private beta opens and for 12 months after that, so we can invite applicants in stages and honour the early-access benefits. Then we delete it, including the notification copies in our inbox. If you become a Kwaant user, your account will be covered by its own privacy terms.
You can ask us to delete your application at any time, and we will. If you unsubscribe from updates, we stop sending them and keep only your email address and the date you unsubscribed, so we do not email you updates again.
8. Your rights
Depending on where you live, you can:
- Access the information we hold about you and get a copy.
- Correct information that is wrong or incomplete.
- Delete your information.
- Object to our use of your information where we rely on legitimate interests.
- Restrict how we use it while a concern is resolved.
- Port it: receive the information you gave us in a common, machine-readable format.
- Withdraw consent to updates at any time, using the unsubscribe link in any update email or by emailing us. This does not affect anything we did before you withdrew.
- Complain to a data protection authority, such as the one in the EU or UK country where you live. We would appreciate the chance to put things right first.
We give these rights to everyone who applies, wherever they live. To use them, email hello@kwaant.com from the address you applied with, so we can confirm the request is yours. We will reply within one month, or sooner if your local law requires. We will not treat you differently for using your rights.
California residents. We do not sell or share personal information, as those terms are defined under California law, and we do not use it for cross-context behavioural advertising. This policy describes the categories of personal information we collect (section 2), the categories of third parties we share it with (section 5), how you can review and request changes to it (this section), how we tell you about changes (section 12) and how we respond to "Do Not Track" signals (section 10).
9. How we protect it
- Applications are stored in a database that cannot be read from the website or from your browser. Only the people who run Kwaant can sign in to see them, using two-step sign-in.
- Information is encrypted in transit (HTTPS) and stored by providers that encrypt data at rest.
- We collect as little as we can and give access only to people who need it.
No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities where the law requires it.
10. Cookies, tracking and "Do Not Track"
Kwaant does not set cookies and does not store anything in your browser's storage. Our analytics are cookieless. The page's fonts are served from our own website, not a third party.
The spam check runs in a frame served by Cloudflare when you submit the application form. Cloudflare may use strictly necessary security cookies or similar storage within that frame to do its job; they are not used for advertising.
We do not track you across websites, so there is nothing for a "Do Not Track" signal or Global Privacy Control to switch off. Our website behaves the same whether or not your browser sends them.
11. Age
Kwaant is for adults. You must be 18 or older to apply. We do not knowingly collect information from anyone under 18, and if we learn that we have, we delete it.
12. Changes to this policy
If we change this policy, we will update the effective date above. If a change materially affects how we use information we already hold, we will email applicants before it takes effect.
13. Contact
Questions, requests or concerns: hello@kwaant.com