Privacy Policy

Effective October 4, 2026 · Operated by IRMA Corp, a New York corporation

1. Who we are and scope

This Privacy Policy describes how IRMA Corp, a New York corporation (“Quantamatica”, “we”, “us”), collects, uses and discloses personal information in connection with the Quantamatica website, web application and mobile application (the “Service”). It covers visitors, account holders and people who contact us. Our Terms of Service address use of the Service; this Policy explains our data practices and is referenced in Section 11 of those Terms.

This Policy replaces the privacy policy dated September 14, 2026, which is kept as an archived copy.

IRMA Corp, 1835 NE Miami Gardens Dr. #298, North Miami Beach, FL 33179. Email: support@quantamatica.com. Telephone: 305-523-9066.

2. Information we collect and its sources

Account and sign-in information

When you create an account you give us your first and last name, your email address, and your country and state or region. Sign-in is handled by our authentication provider, Supabase. Depending on how you sign in, Supabase processes your password, email login links and codes, your Google account identifier, and your multi-factor authentication settings. When you sign in with Google, Google tells us the basic profile information you authorize, such as your name and email address. Our servers do not store your password.

If you register a passkey, we store its public credential: an identifier, the public key, a usage counter, a device label, its transport types and whether it is backed up, together with your email address. The private key and any biometric data stay on your device; we do not receive them.

We also keep the time you were last active and, for your most recent sign-in, its time, IP address and approximate location (city, region and country).

Billing information

Subscription payments are handled by Stripe. You enter card details directly with Stripe, not on our servers, and we do not store full card numbers. We keep what we need to manage your subscription: your Stripe customer and subscription identifiers, your plan, its status, your trial and renewal dates, whether you have asked to cancel, and any discount code you used. Stripe creates a customer record for you using your email address.

Portfolio and research information

You may enter or import holdings, quantities, purchase prices and dates, options positions, portfolio names, watchlists and notes, and you may write investment theses with conditions for the Service to check. Files you import, such as CSV files, are read in your browser. Your portfolios and notes are saved in your browser's local storage and, when you are signed in, to your account in our database so that they are available on your other devices. Alerts you create in the mobile app (a ticker and the level you choose) are saved to your account.

Do not upload unnecessary identifiers, account credentials or information about other people. Some features send some of this information to AI providers; see Section 4.

Linked brokerage information (limited availability)

A connection to a Charles Schwab account is available to a limited number of invited users. If you connect, you authorize read-only access, and we receive your account positions and the authorization tokens needed to keep the connection working. We store those tokens in encrypted form. The connection cannot place trades or move money. You can disconnect at any time, which deletes the stored tokens; portfolios already imported stay in your account until you delete them or ask us to.

Usage and technical information

Our home page and our web application load Google Analytics. Google may use cookies and similar technologies and collect information such as pages viewed, interactions, approximate location, device and browser type, referral source and IP address, as described in Google's documentation. We have not added custom events or user identifiers to these tags, and we do not send your name, email address or portfolio information to Google Analytics.

Our servers and hosting provider process technical information needed to deliver the Service, such as your IP address, browser type and the pages and requests made, and keep it in server logs.

If you choose to stay signed in on the website, we set a cookie named qm_refresh that holds your sign-in token in encrypted form. It is HTTP-only, is sent only to our site, is marked secure in production, and expires after 10 days without activity. We also use your browser's local storage for preferences, recent searches, your last-viewed ticker and the saved portfolios and notes described above. Clearing it removes what is stored on that device.

The mobile app keeps your sign-in token in your device's secure storage. If you turn on Face ID or fingerprint unlock, your device handles it and we do not receive biometric data. The mobile app does not include advertising software or third-party analytics or crash-reporting software.

Communications, notifications and records

We keep the messages you send to support and our replies. We send service emails, such as sign-in links, billing and security messages, through our email provider, Resend. Marketing emails, if we send them, include an unsubscribe link, and we keep a list of addresses that have unsubscribed so that they are honored.

If you turn on alerts in the mobile app, we store a push token for your device and send notifications through Expo's push service and Apple or Google. A notification contains the ticker, the current implied-growth figure and the level you set.

Information from other sources

We receive information from Google when you sign in with it, from Stripe about the status of your payments and subscription, and from a brokerage if you connect one. Our servers request market data, news and filings from third-party providers using ticker symbols; those requests do not carry your name or email address.

3. Why we use information

We use information to:

• create and authenticate accounts and keep them secure;
• provide the portfolio and research tools, and save your portfolios, notes, theses and alerts;
• manage subscriptions, trials and payments;
• provide the analysis and notifications you request;
• answer support requests and send service messages, and send marketing emails to people who have not unsubscribed;
• understand how the Service is used, and maintain, troubleshoot and improve it;
• detect abuse, fraud and security incidents;
• comply with legal obligations, protect rights and enforce our agreements.

We use personal information only for the purposes in this Policy or otherwise disclosed when we collect it, subject to applicable law. A new incompatible purpose requires the notice and consent the law requires.

4. AI-assisted analysis

The Service uses AI-assisted analysis of market information and research inputs. Most AI features work on public information about a company or ticker. Two features also use information about you:

• The tax-loss tool. When you ask for tax-loss harvesting ideas, the positions with unrealized losses that you submit are sent to an AI provider: the portfolio name, ticker, number of shares, cost basis, current price, loss and the date you added the position.
• The mobile Today feed. To write the “Act on this” items, the tickers of the stocks you hold, together with public news and market signals about them, are sent to an AI provider. Quantities and values are not sent.

We do not include your name or email address in these requests, and we do not attach your account identifier. A portfolio name is something you choose, so avoid putting personal information in it. We use third-party AI providers, including Groq, and each handles requests under its own terms and privacy notice. AI output can be incomplete or wrong; the Terms explain the limits of the research tools.

5. How we disclose information

We disclose information as needed to service providers that support the Service. Our providers currently include: Supabase (authentication and database), Render (hosting), Stripe (payments), Resend (email), Google (sign-in and Google Analytics), AI providers (Section 4), Expo with Apple and Google (push notifications), and, for linked accounts, the brokerage you choose. To work out the approximate location of a sign-in we use the location details supplied by our network provider or, if they are missing, send the IP address to a geolocation service (ip-api.com). Web pages also load fonts and code libraries from Google Fonts and from content delivery networks (jsDelivr, unpkg and cdnjs), which see your IP address when you load a page.

Some providers also process information under their own privacy notices.

We may disclose information when required by law or legal process, to investigate fraud or security incidents, or to protect the rights and safety of users and others. Information may be transferred in a merger, acquisition, restructuring or sale of assets, subject to applicable law and appropriate notice. We may disclose information at your direction or with your consent. Public market data is different from your private portfolio or account information; we do not treat the latter as public.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising, as those terms are defined under applicable state privacy law. We have turned off Google Analytics advertising features, including Google signals and ads personalization, and we have no Google Ads link to our Google Analytics property. We do not knowingly sell or share the personal information of anyone under 18.

6. Cookies and choices

Cookies and similar technologies support account sessions and preferences; Google Analytics helps us understand use of our home page and web application. Browser settings can block or clear cookies and local storage, but doing so may affect sign-in or saved settings. Google offers a browser add-on to opt out of Google Analytics.

7. Retention and deletion

We keep information only for as long as reasonably needed for the purposes described above. Our retention periods are:

• Account and sign-in data: kept for as long as your account is open and deleted within 30 days after the account is deleted.
• Portfolios, notes and imports: kept until you delete them or your account is closed.
• Brokerage connection tokens: deleted when you disconnect.
• Billing and tax records: kept for 7 years.
• Support messages: kept for 3 years.
• Analytics data: kept for 14 months.
• Privacy-request records: kept for 5 years.

You can delete your account in the mobile app, or ask us to delete it by emailing support@quantamatica.com. We may keep information we are required or permitted by law to keep, including records of unsubscribe requests.

8. Security

We use administrative, technical and organizational safeguards appropriate to the information we process. Examples are that passwords are handled by our authentication provider and not stored by us, access to account data in our database is restricted to the signed-in account holder and to our servers, brokerage tokens are stored encrypted, and sign-in cookies are HTTP-only. No system or method of transmission is completely secure. Use strong account protections, and do not send passwords, brokerage credentials or full card details to support. We address security incidents and give the notices applicable law requires.

9. Access, correction, deletion and other choices

You can contact support@quantamatica.com to ask for access to, correction of, or deletion of personal information. Depending on where you live and applicable law, you may also have rights to obtain a portable copy, to restrict or object to certain processing, to withdraw consent, or to opt out of sale, advertising sharing, targeted advertising or certain profiling. These rights have legal conditions and exceptions, and listing them does not mean we engage in every activity listed.

We may verify your identity using information already associated with your account and ask only for what is reasonably needed to handle your request. Do not send a password or full financial-account details. An authorized agent may submit a request with evidence of authority, and we may verify both the authorization and your identity where the law allows. We respond as required by applicable law.

If applicable law gives you a right to appeal a denied request, reply to our response or email support@quantamatica.com with “Privacy appeal” in the subject. We will respond as required by applicable law.

You can unsubscribe from marketing emails using the link in them; we may still send necessary security, billing, legal and service messages. Your device settings control push notifications.

10. California and other U.S. state notices

If the California Consumer Privacy Act, as amended, applies to our processing, California residents have the applicable rights to know and access, correct and delete personal information, to opt out of sale or sharing, to limit certain uses of sensitive personal information, and to equal treatment. Use the methods in Section 9. Other state laws may give similar rights, including portability, opt-outs for targeted advertising or certain profiling, and appeals.

11. Children

The Service is intended for adults aged 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. Contact support@quantamatica.com if you believe a child has provided information.

12. International processing and third-party services

Information may be processed in the United States and other countries where we or our providers operate, which may have different privacy protections.

Our Service may link to third-party sites and connection flows. Those services have their own privacy policies. This Policy does not replace their notices or authorize access beyond the scope you approve.

13. Changes to this Policy

We will post an updated Policy with its effective date when our practices change. We will give additional notice of material changes, and obtain consent, when applicable law requires it. Changes do not override rights you already have under law.

14. Contact

IRMA Corp, 1835 NE Miami Gardens Dr. #298, North Miami Beach, FL 33179. Email: support@quantamatica.com. Telephone: 305-523-9066. Contact us with privacy questions, rights requests or concerns.