Privacy Notice

1. What we collect

• Your user account: display name, email address, a one-way hash of your password (we cannot read your password) and your two-factor data.
• Access data: the time, IP address and browser type when you sign in, fail to sign in (with the email address used) and sign out, and the IP address each account's Agent connects from on each day.
• The MT5 accounts you connect: login number, server and broker name, currency and the label you gave.
• Trading data sent by the Agent: balance, equity, margin, open positions, deal history (including deposits and withdrawals), magic numbers, and the list of charts and Expert Advisor names open in the terminal.
• Payments: the plan and period you subscribe to, the status and dates of your subscription, and the identifiers Stripe gives your customer record and subscription. Your card details are entered on Stripe's pages and never reach us. For a plan paid earlier by bank transfer: the amount, the decision on the request, and the slip image you attached, which usually shows the payer's name, bank, part of the account number and the transaction reference.
• Your settings: strategy names, alert thresholds, the Telegram chat you linked, and the settings of your share link.
• A record of significant actions: kill-switch commands, rejected codes, chart bindings, password resets and the version of the terms you accepted, with the time and IP address.
• The waiting list on quantrivance.com: the email address you entered, what you were interested in and the language of the page, used only to tell you when that becomes available.

2. What we do not collect

• The password of an MT5 account, neither the master nor the investor password.
• Card details: they go to Stripe and never reach us. Nor identity documents, or bank account numbers beyond what a transfer slip you attached shows.
• Usage data for advertising: the service has no third-party trackers and no advertisements.

3. What we use it for

• Providing the service under the Terms of Use: showing your portfolio, computing results and drawdown, sending alerts and delivering the kill-switch commands you give (performance of a contract).
• Payments: taking subscriptions through Stripe, giving refunds when you are entitled to them, and keeping evidence of money received (performance of a contract, and a legal obligation).
• Security: checking sign-ins, limiting abnormal requests and keeping records to look into incidents (legitimate interest).
• Keeping computer traffic data as Thailand's Computer Crime Act requires (a legal obligation).
• Establishing or defending legal claims, for example a complaint or a case about a kill-switch command, the Guard or a payment (legitimate interest).
• Running the system: administrators see the list of users, their email addresses, how many accounts they connected and when their Agent last reported, in order to manage invitations and the system's capacity.

We do not sell your data, we do not use your trading data to trade ourselves, and we do not send marketing messages you did not agree to.

4. Who receives it

• Cloudflare, Inc., the infrastructure provider that runs the service and stores its database, backups and slip images. Your data may therefore be processed on servers outside Thailand. This transfer abroad is necessary to provide the service under our contract with you.
• Stripe, our payment provider, which takes your payment and your card details under its own privacy policy and may process them outside Thailand. We give Stripe your email address and receive from it the state of your subscription and payments.
• Telegram, once you link a chat: alerts, which contain account names and portfolio figures, travel through Telegram to the chat you chose.
• Telegram, for administrators: when a transfer slip arrives, they receive a message with your email address, the plan and the amount (not the slip image).
• Anyone who has your share link, if you turn one on, and only what you chose to show.
• Public authorities, where the law requires disclosure.

5. How long it is kept

• Minute-by-minute account data is kept for 30 days. Hourly summaries, deal history and strategy results are kept for as long as that MT5 account stays connected.
• When you delete an MT5 account from the service, all of its data is removed from the database, which can take several days.
• Your user account is kept until you ask for it to be deleted. Deleting it removes the data tied to it.
• Slip images are kept for 365 days from the day they were attached and are then deleted automatically. Payment requests and plans bought are kept for as long as your user account exists.
• When your user account is deleted, we keep a copy of what is needed for legal claims for 10 years, then delete it: your email address, the versions of the terms you accepted with the time and IP address, the record of kill-switch commands and Guard settings, what the Agent reported back, the kill-switch and Guard alerts, and your payments and plans. It is used for that purpose only.
• The database is backed up every night and the backups are kept separately for 30 days, so deleted data may remain in a backup for up to 30 days.
• The access data in section 1 is computer traffic data. It is kept for 90 days and then deleted, even if your user account was deleted before that, and may be kept longer when an official orders it under the law (up to 2 years).

6. Cookies and browser storage

We use only cookies the service needs to work: a session cookie that keeps you signed in, a cookie that remembers a device when you choose "remember this device", and a cookie that remembers your language. Your choice of light or dark mode is kept in your own browser. There are no advertising cookies and no third-party analytics.

7. Security

Passwords, Agent tokens and the codes in our links are stored in a form that cannot be read back. All connections are encrypted, and risky actions require two-factor confirmation. No system is perfectly secure. If a breach puts you at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours of learning of it, and you without undue delay, as the law requires.

8. Your rights

You have the right to access and receive a copy of your data, to have it corrected, to have it deleted, to restrict or object to its use, to have it transferred, and to withdraw consent you gave, as well as to complain to the Office of the Personal Data Protection Committee. Much of this you can do yourself in the service: delete an MT5 account, unlink Telegram, turn off a share link. For the rest, write to admin@quantrivance.com; we answer within 30 days of receiving your request. Some requests may be refused where the law allows, such as deleting data still needed for legal claims under section 5, and we will tell you why.

9. Minors

The service is not intended for anyone under 20, and we do not knowingly collect the data of minors.

10. Changes to this notice

We may change this notice. The date at the top names the current version. We will announce a significant change in the service before it takes effect.