Privacy Policy
Effective 1 September 2026 · Last updated 1 September 2026 · Version 3 · Supersedes Version 2 of 17 August 2026
Operated by Avyren Inc., including its wholly-owned subsidiary Avyren (Pty) Ltd.
This Privacy Policy is incorporated by reference into the Quantorum Terms of Service and governs how Avyren Inc., including its wholly-owned subsidiary Avyren (Pty) Ltd, collects, uses, discloses, and protects personal information in connection with the Quantorum service.
1. Scope and Application
This Privacy Policy ("Policy") describes how Avyren Inc. ("Avyren," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with Quantorum (the "Service"). It applies to the Quantorum web application, the quantorum.ai website, and our waitlist and beta onboarding.
This Policy does not currently address the Strategy Marketplace, which is not part of the Service at this time. This Policy will be updated to address the Marketplace before that feature becomes available.
2. Identity of the Responsible Party
The responsible party for personal information processed through Quantorum is Avyren Inc. (Delaware C-Corp), including its wholly-owned subsidiary Avyren (Pty) Ltd. Where the term "controller" applies under other law, it refers to the same entity.
You may contact us regarding this Policy at founders@avyren.ai.
3. Information Officer
Avyren has designated an Information Officer in accordance with the Protection of Personal Information Act, 2013 ("POPIA"), registered with the Information Regulator of South Africa. The Information Officer can be contacted at founders@avyren.ai.
4. Categories of Personal Information We Collect
- Account and identity data — name, email address, authentication credentials
- Waitlist data — email address submitted before an account exists
- Brokerage connection data — via SnapTrade, or a direct broker connector where applicable
- User-submitted analysis inputs — trade ideas, strategy parameters, thesis notes, chat messages
- Billing data — processed by Stripe; card data is not stored by Avyren
- Usage, device, and log data
- Support correspondence
We collect this information directly from you, from your interaction with the Service, and from your connected brokerage account where you have authorised that connection. We do not purchase personal information from data brokers.
A note on financial data. Brokerage connection data and financial account information are treated as sensitive personal information under certain United States state laws. We collect them to transmit instructions to your own broker at your direction and, where you ask a question about your own account in the chat interface, to generate the answer you have requested. In that second case the relevant records are transmitted to the AI model provider that generates the answer, as described in Section 14. We do not use or disclose them to infer characteristics about you. See Section 15.
5. Purpose and Lawful Basis for Processing
| Category | Purpose | Lawful basis |
|---|---|---|
| Account and identity data | Account creation, authentication, service delivery | Performance of contract |
| Waitlist data | Notify you when beta access opens | Consent |
| Brokerage connection data | Transmit instructions to your connected broker at your direction | Performance of contract |
| User-submitted analysis inputs | Generate AI-assisted analysis of trade ideas | Performance of contract |
| Billing data | Process payment for compute credits or subscription | Performance of contract |
| Usage, device, log data | Security, fraud prevention, product improvement | Legitimate interests |
| Marketing contact (where applicable) | Send product updates | Consent |
Core delivery of the Service does not rely on consent as its lawful basis. Consent is used only for the waitlist and for optional marketing communications, either of which you may withdraw at any time without affecting your access to the Service.
6. Recipients and Sub-processors
We share categories of personal information with the following categories of recipients in order to operate the Service:
- AI model providers — process trade ideas, strategy parameters, thesis notes, and chat messages for the purpose of generating analysis, and, where a question you ask in chat requires it, the strategy, position, and audit records needed to answer it
- Hosting and infrastructure providers — process account and usage data for the purpose of running the Service
- Observability tooling — receives technical operational logs, which may include user-submitted content processed by the Service
- Broker-connectivity providers — process brokerage connection data to transmit instructions at your direction
- Payment processors — process billing data to process payment
- Video delivery providers — stream Learning section video content directly to your browser during playback
We require our service providers to handle personal information under data protection terms consistent with applicable law. A named list of specific sub-processors, the category of personal data each processes, and its country of processing is maintained in Annex A.
6.1 Changes to our sub-processors
When we add a new sub-processor that processes personal information, we will update Annex A and post the updated Annex before that provider begins processing personal information in production. Where you have an active account, we will notify you by email at least fourteen (14) days in advance of a new sub-processor that processes user-submitted analysis inputs or brokerage connection data. If you object to a new sub-processor, you may close your account and request deletion under Section 9.
We do not sell personal information to any third party, and we do not disclose personal information to third parties for their own independent purposes.
7. Cross-Border Transfer of Personal Information
Every user's data crosses from South Africa to a United States-based backend on each request, and a subset of technical log data is processed by a service provider in the European Union. South Africa has not issued a blanket adequacy determination in respect of either destination. These transfers are made subject to binding contractual protections under POPIA section 72.
Separately, and only in relation to serving users based in the United Kingdom or European Union, transfer mechanisms (Standard Contractual Clauses and the UK International Data Transfer Addendum) have been prepared and are held in reserve. They are not currently in force, as those markets are geofenced at this stage of launch. This is distinct from the EU-based processing described above, which relates to a service provider location rather than a served market.
8. Retention
Personal information is retained only for as long as necessary for the purpose for which it was collected, in accordance with the following schedule:
| Category | Retention period | Basis |
|---|---|---|
| Raw LLM traces (observability) | 60 days | Operational and debugging purposes only |
| Council decision / audit-trail records | 24 months | Matches the analysis record period in Section 19 of the Terms of Service, and covers the claims period in Section 15 with margin |
| Waitlist data | Until account creation, or 12 months from submission, whichever is earlier | Consent; deleted on withdrawal |
| Account and identity data | Active account, plus 2 years after closure | Supports dispute resolution following account closure |
| Billing and financial records | 7 years | South African Companies Act and applicable tax record-keeping requirements |
| Support correspondence | 2 years after resolution | Quality assurance and dispute resolution |
8.1 Interaction with your deletion right
Where you request deletion under Section 9, we will delete or de-identify the personal information we hold about you except where we are required or permitted by law to retain it — principally billing and financial records under the retention periods above. In those cases we retain only the specific records subject to the legal obligation, restrict them to that purpose, remove them from active use in the Service, and delete them at the end of the retention period. We will tell you which categories have been retained and why when we confirm the deletion.
9. Your Rights and How to Exercise Them
Subject to POPIA sections 23 to 25 and, where applicable, GDPR Articles 15 to 22, you have the right to access your personal information; request correction of inaccurate or incomplete information; request deletion of your personal information; object to processing; request portability of your data; withdraw consent where consent is the lawful basis; and lodge a complaint with the Information Regulator.
9.1 How to make a request
Email founders@avyren.ai from the address associated with your account, describing the right you wish to exercise. Under POPIA, a request to object to processing may be made on Form 1, and a request for correction or deletion of personal information may be made on Form 2, as prescribed under the POPIA Regulations; we also accept requests by plain email and will not refuse a request for failing to use a prescribed form.
9.2 Verification
So that we do not disclose your personal information to someone else, we verify requests before acting on them. Where the request comes from the email address on the account, we will send a confirmation link to that address. Where it does not, we will ask for information sufficient to match the request to an existing account. If we cannot verify a request to a reasonable degree of certainty, we will tell you why and will not action it. We do not create accounts or collect additional identity documents solely to verify a request.
9.3 Response times
| Stage | Timing |
|---|---|
| Acknowledgement of your request | Within 5 business days |
| Substantive response | Within 30 days of a verified request |
| Extension | Where a request is complex, we may extend once by a further 30 days and will tell you why before the first period expires |
| United States state law requests | Within 45 days, extendable once by a further 45 days — see Section 15 |
9.4 If we decline a request
If we decline a request in whole or in part, we will tell you which parts we declined, the reason, and how to challenge that decision. You may ask us to reconsider by replying to our response; a person who was not involved in the original decision will review it and respond within 30 days.
9.5 Complaints to the Information Regulator
You may lodge a complaint with the Information Regulator of South Africa at any time, whether or not you have contacted us first. Complaints are made in writing on POPIA Form 5, or through the Regulator's eServices portal.
| Information Regulator of South Africa | |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| General enquiries | enquiries@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Telephone | 010 023 5200 · Toll free 0800 017 160 |
| Online | inforegulator.org.za |
10. Security
We apply administrative, technical, and organisational measures designed to protect personal information, including encryption in transit and at rest, access controls, and authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10.1 Security compromises
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise, in accordance with POPIA section 22. Notification to you will be in writing to the email address on your account, and will describe the possible consequences of the compromise, the measures we intend to take or have taken to address it, what we recommend you do to mitigate the possible adverse effects, and the identity of the unauthorised person if known. We may delay notification only where a public body responsible for the prevention, detection, or investigation of offences tells us that notification would impede a criminal investigation.
You can report a suspected security issue to us at founders@avyren.ai.
11. Cookies and Local Storage
We do not set cookies to identify you, to store your session, or for analytics, advertising, or tracking of any kind. The Service itself sets no cookie.
The hosting, content delivery, and video providers that deliver the Service to your browser may set strictly necessary cookies on the requests they serve, for purposes such as bot detection, security challenges, and load balancing. These are set by the infrastructure that delivers the Service rather than by Quantorum, are limited to what is required to serve the page securely, and are not used to build a profile of you or to track you across websites. Where such a cookie is set it is short-lived and expires automatically. Because cookies of this kind are strictly necessary to deliver and secure the Service, they do not require your consent under applicable law, and we set no cookie that would require consent.
Authentication is instead handled through your browser's local storage, which holds your session token, its expiry, and your email address for as long as you remain signed in. Local storage is readable by scripts running on the page, which is a different security profile than a cookie marked inaccessible to scripts. We also use local storage for interface preferences, specifically your theme selection, whether the sidebar is collapsed, and which onboarding tips you have dismissed. None of these preference values are personal information.
We use session storage, which clears automatically when you close the browser tab, for two short-lived values with no personal content: resuming an in-progress chat message after navigation, and recording that you have joined the pilot waitlist.
We do not use analytics, advertising, or tracking tools of any kind. Because we operate no advertising or cross-site tracking technologies, there are no opt-out preference signals for us to act on; if that ever changes, we will honour the Global Privacy Control signal and will update this Policy before doing so. Any measurement we perform today is limited to first-party, aggregated analysis of our own service, as described in Section 14, and does not involve third-party analytics tools. If we adopt a third-party analytics tool in future, we will update this Policy to disclose it before that tool is put into use.
When you play a video in the Learning section, your browser connects directly to our video delivery provider, Cloudflare, to stream that content. This is a standard content-delivery connection, not tracking, though Cloudflare will receive the request on its end in the same way any content delivery network does, and may set a strictly necessary cookie in connection with delivering that video.
12. Children
The Service is intended for users aged 18 or older, or the age of majority in their jurisdiction, consistent with the Terms of Service. We do not knowingly collect personal information from anyone under this threshold. If we learn that we have collected personal information from someone under this threshold, we will delete it. We do not sell or share the personal information of minors, and we have no actual knowledge of collecting personal information from anyone under 16.
13. Automated Processing
Quantorum uses artificial intelligence to analyse market data and user-submitted inputs. No decision producing legal or similarly significant effects is made solely by automated means. Every trade instruction requires your explicit, separate human confirmation before it is transmitted to your broker, and this confirmation requirement is a permanent characteristic of the Service rather than a setting that can be disabled.
Council output is analysis presented for your evaluation. It is not a decision taken about you, and we do not use automated processing to evaluate your creditworthiness, employment, eligibility for services, or other personal characteristics.
14. AI Model Providers and Use of Your Content
Your submitted analysis inputs, being trade ideas, strategy parameters, thesis notes, and chat messages, are transmitted to the third-party AI model providers named in Annex A for the sole purpose of generating the analysis you have requested. Where you ask a question in the chat interface that can only be answered from your own account, the Service retrieves the records needed to answer it and includes them in that request. Those records can include your saved strategies, position and account data retrieved from your connected brokerage account, and your council audit records. This happens only in response to a question you have asked, and only for the provider generating that answer. Your inputs are not transmitted to any other recipient for any other purpose.
Our AI model providers process your inputs under commercial API terms which do not permit the use of those inputs to train or improve their models. We have additionally disabled, at organisation level, every optional setting offered by those providers that would allow inputs, outputs, evaluation data, or feedback to be shared for model improvement. Inputs may be retained by the provider for up to 30 days for abuse and misuse monitoring, after which they are deleted, except where the provider is required to retain them for longer to comply with law or to enforce its usage policy.
Avyren does not use your submitted analysis inputs, strategies, or thesis notes to train or fine-tune any model, and does not make them available to any third party for that purpose. We use aggregated, de-identified usage patterns, such as which features are used and where errors occur, to improve the Service. Your strategies remain yours, and Section 6 of the Terms of Service governs the ownership position.
15. United States State Privacy Rights
This Section applies to residents of United States states with comprehensive consumer privacy laws, including California, Virginia, Colorado, Connecticut, Texas, Oregon, and Montana, to the extent those laws apply to us. Some of these laws apply only above certain revenue or volume thresholds which we may not currently meet; we provide the disclosures and honour the rights below regardless.
15.1 What we do not do
- We do not sell personal information, and we have not sold personal information in the preceding twelve months.
- We do not share personal information for cross-context behavioural advertising.
- We do not use personal information for targeted advertising.
- We do not profile you in furtherance of decisions producing legal or similarly significant effects — see Section 13.
Because we do not sell or share personal information, there is no "Do Not Sell or Share My Personal Information" mechanism to offer. If that ever changes, we will provide one and update this Policy before doing so.
15.2 Sensitive personal information
Brokerage connection data and financial account information are sensitive personal information under California law. We collect and use them only for the purposes described in Section 5 — transmitting instructions to your own broker at your direction, providing the Service, and preventing fraud. Where you ask a question in the chat interface that can only be answered from this information, it is transmitted to the AI model provider that generates your answer, at your direction and solely to answer the question you asked, as described in Section 14. We do not use or disclose sensitive personal information to infer characteristics about you, which means the right to limit its use and disclosure does not restrict any processing we actually perform.
15.3 Your rights
| Right | What it means |
|---|---|
| Know and access | The categories and specific pieces of personal information we have collected, the categories of sources, the purposes, and the categories of third parties to whom we disclose it — all set out in Sections 4, 5 and 6 and available to you individually on request |
| Correct | Correction of inaccurate personal information |
| Delete | Deletion of personal information, subject to the legal retention carve-out in Section 8.1 |
| Portability | A copy of your personal information in a portable, machine-readable format |
| Opt out | Of sale, sharing, targeted advertising, and profiling — none of which we conduct |
| Limit sensitive information use | See Section 15.2 |
| Non-discrimination | We will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right |
| Appeal | If we decline a request, you may appeal under Section 9.4. If your appeal is denied, you may contact your state Attorney General. |
15.4 Authorised agents
You may use an authorised agent to submit a request on your behalf. We will ask the agent for written permission signed by you, and we may contact you directly to confirm that you gave permission and to verify your own identity.
15.5 How to exercise these rights
Email founders@avyren.ai. We will acknowledge within 10 business days and respond substantively within 45 days of a verified request, extendable once by a further 45 days where reasonably necessary, in which case we will tell you before the first period expires.
16. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email and by posting a notice within the Service before the changes take effect. The "Last updated" date at the top of this Policy reflects the most recent revision. Annex A is dated separately and may be updated without a change to the Policy body.
17. Contact
Avyren Inc. — founders@avyren.ai
Annex A — Sub-processors
This annex is dated independently of the Policy body above. When the vendor roster changes, only this date moves.
Annex last updated: 17 August 2026
| Provider | Category of recipient | Category of personal data processed | Country of processing |
|---|---|---|---|
| Anthropic | AI model provider | Trade ideas, strategy parameters, thesis notes, chat messages, and, where a chat question requires it, strategy, position, and audit records | United States |
| OpenAI | AI model provider | Trade ideas, strategy parameters, and derived analysis text | United States |
| Langfuse | Observability provider | Technical operational logs, which may include prompt content and user identifiers | European Union |
| Fly.io | Hosting (backend) | Account and usage data | United States |
| Vercel | Hosting (frontend) | Account and usage data | United States (US East) |
| SnapTrade | Broker-connectivity provider | Brokerage connection data | United States |
| Stripe | Payment processor | Billing data (card data not stored by Avyren) | United States |
| Cloudflare (Cloudflare Stream) | Video delivery provider | Device and network data (received directly by Cloudflare during video playback) | Global content delivery network |
NautilusTrader, ThetaData, yfinance, and the LangGraph orchestration layer do not appear in this annex, as they process no personal information and are not sub-processors under POPIA.
Maintaining this annex
Any new third-party service that touches user data must be flagged before it reaches production, and this annex updated at the same time, together with the advance notice to users required by Section 6.1. This applies without exception to everyone on the engineering team. This includes any new AI model provider or inference endpoint, whether reached directly or through an SDK, gateway, or OpenAI-compatible base URL override.