Effective Date: September 26, 2026 · Last updated: October 10, 2026
This policy explains what personal data quantumalex.com ("we", "our", "us") collects, why, on what
legal basis, how long we keep it, and what you can require us to do about it. It covers this
website and every service we run at *.quantumalex.com.
Important Disclaimers:
Not Professional Advice: Information on this website is not professional, legal, financial, or technical advice.
AI-Generated Content: Some content may be generated by artificial intelligence and may contain inaccuracies.
Product Offers: Offers on this website may include our own products or affiliate products from third parties.
1. Who is responsible for your data
The data controller is QuantumAlex, contactable at
admin@quantumalex.com. We have not appointed a Data Protection Officer; we are
not required to. Privacy requests of any kind go to that address and are handled by a person.
2. What we collect
Identity and contact data: name, email address, and the profile name and
avatar your sign-in provider gives us.
Account and role data: that an address may sign in, what it may do, and
when it last did.
Order and consent data: what you bought, the amount and currency, the
payment provider's reference, and — where you accepted terms or opted in — the wording you
accepted, the IP address you accepted it from, and the moment you did. We record the IP and
timestamp from the request itself, never from anything your browser tells us, because a
consent record you could edit is not evidence of anything.
Content you create: whatever you write into our services. Some of it is
personal in the ordinary sense rather than the legal one — entries, reflections, notes. We
treat it as yours.
Usage data: pages visited and actions taken, through Google Analytics,
only if you consent (see §5). Our analytics events carry identifiers,
counts and category values — never your name, email, message text, search terms or amounts.
Affiliate data: clicks on affiliate links and the purchases attributed to them.
Third-party integration data: where you connect an account (Google,
Meta, LinkedIn, X, GitHub), the tokens and the data that integration returns, for as long as
the connection exists.
We do not knowingly collect data from children under 16. If you believe a child has given us
data, write to us and we will delete it.
3. Why we use it, and on what legal basis
Under the UK/EU GDPR every use of your data needs a lawful basis. Ours, in full:
What we do
Why
Legal basis
Create and run your account; sign you in
You cannot use the services otherwise
Contract (Art. 6(1)(b))
Take payment, deliver what you bought, answer support
To perform the sale
Contract (Art. 6(1)(b))
Keep invoices, orders and consent records
Tax and consumer law require it
Legal obligation (Art. 6(1)(c))
Send marketing email
You asked for it and confirmed by email
Consent (Art. 6(1)(a)), withdrawable at any time
Analytics and affiliate attribution cookies
To see what works
Consent (Art. 6(1)(a)), and ePrivacy consent for storage on your device
Keep the services secure; prevent abuse and fraud
They would not survive otherwise
Legitimate interests (Art. 6(1)(f))
Where we rely on legitimate interests you may object (§7), and we will stop unless we can show
grounds that override yours. Where we rely on consent you may withdraw it at any time, and doing
so does not affect anything we did before you withdrew it.
Email marketing, and what "opt-in" means here
We send marketing email only to addresses that asked for it and then confirmed by
clicking a link in an email sent to that address. Typing an address into a form does not
subscribe it; until the link is clicked nothing is mailable. Every marketing email carries a
one-click unsubscribe link, which takes effect immediately and needs no explanation.
4. Who we share it with
We do not sell your personal data, and we do not share your contact details with third
parties for their own marketing. That is a flat statement with no exception below it.
We share data only with:
Processors acting on our instructions — hosting and infrastructure
(Amazon Web Services), email delivery, payment providers (Stripe, Paddle or Mercado Pago,
where enabled), and analytics (Google), each under a data-processing agreement and none of
them free to use your data for their own purposes.
Affiliate partners, when you click an affiliate link — the fact of the
click and of any resulting purchase, so a commission can be attributed. Never your name or
email address.
Legal authorities, where we are legally required to.
5. Cookies, and the choice you get
We set two kinds of thing on your device and they are not treated the same:
Strictly necessary — your session, your language and your light/dark
preference. These are set without asking, because the service does not work without them
and no consent is required for them.
Analytics and affiliate attribution — Google Analytics and referral
tracking. These are not set unless you accept them. Nothing is loaded and
no identifier is stored until you choose, declining is as easy as accepting, and you can
change your mind at any time from the link at the bottom of any page.
"Turn cookies off in your browser" is not the choice we offer you; it was the only thing this
page used to say, and it was not good enough.
6. How long we keep it
Data
Kept for
Account and role records
While the account exists, then 30 days
Orders, invoices and payment references
7 years from the transaction — tax law, and we cannot delete these on request
Consent and opt-in records
While the consent stands, then 3 years, as evidence it was given
Content you create
Until you delete it, or 30 days after the account closes
Marketing contact records
Until you unsubscribe, then a suppression entry so we do not re-add you
Analytics data
14 months (Google Analytics retention setting)
Integration tokens
Until you disconnect the integration
Operational logs
1 day
7. Your rights
Wherever you live, you may ask us to do any of the following, and we answer within
30 days, free of charge:
Access — a copy of the personal data we hold about you.
Rectification — correct anything inaccurate or incomplete.
Erasure ("right to be forgotten") — delete it, except records we are
legally required to keep (see §6), which we will name rather than quietly retain.
Restriction — stop using it while a dispute about it is resolved.
Portability — receive the data you gave us in a structured,
machine-readable format, or have us send it to another provider.
Objection — object to processing based on legitimate interests, and to
direct marketing at any time, which we always honour.
Withdraw consent — at any time, without giving a reason.
Not be subject to automated decision-making — we make no decisions with
legal or similarly significant effects about you by automated means.
Write to admin@quantumalex.com. We may ask you to confirm you control the
address in question, which is a protection for you rather than an obstacle.
If you are unhappy with how we handled a request you may complain to your data protection
authority. In the EU that is your national supervisory authority
(list here); in the UK it is
the Information Commissioner's Office (ico.org.uk);
in Argentina it is the Agencia de Acceso a la Información Pública. You do not have to come to us
first, though we would rather you did.
8. Where your data is processed
We run on Amazon Web Services and our data is stored in the United States.
If you are in the EEA or the UK, that is a transfer outside your jurisdiction. It is covered by
the European Commission's Standard Contractual Clauses (and the UK Addendum),
which our providers are signed up to, together with their technical measures. The same applies
to Google Analytics, our email delivery provider, and any payment provider we use.
9. Security
Data is encrypted in transit and at rest, access is limited to the accounts that need it,
secrets are held in a managed vault rather than in code, and no storage bucket of ours is
publicly readable. No system is perfectly secure; if a breach affects your rights we will tell
our supervisory authority within 72 hours and tell you without undue delay where the risk to you
is high.
10. Accounts you connect: Google, YouTube, Meta and X
Our tools let the account owner connect their own social and analytics accounts through the
provider's sign-in (OAuth). This section applies only to the person who connects an account; a
buyer or a visitor never grants us access to theirs.
What we access. For a YouTube channel: the channel's name, handle and
picture, its videos and their statistics, its comments, and its YouTube Analytics reports
(views, watch time, subscribers gained and lost, and viewers by age and gender in aggregate).
For Instagram, Facebook Pages, WhatsApp and X: the account's profile, its posts and their
insights, and the messages and comments sent to it.
What we do with it. Publish the videos and posts the owner prepares,
answer comments and messages on the owner's behalf, and show the owner their own analytics.
Nothing else.
What we never do. We do not sell this data, use it for advertising,
share it with anyone except the processors in §4 that host it, or let a person read it
except the account owner and, where needed for security or the law, us.
Google user data. Our use and transfer of information received from
Google APIs adheres to the
Google API
Services User Data Policy, including the Limited Use requirements. Our YouTube features
use the YouTube API Services: by connecting a channel you agree to the
YouTube Terms of Service, and Google's handling
of your data is described in the
Google Privacy Policy.
Storage and deletion. Access tokens are stored encrypted on Amazon Web
Services. Disconnecting an account in our tools deletes its tokens at once; ask us (§12)
and we also delete the reports and posts read through it. You can also revoke our access at any time from your
Google account or the provider's own
settings.
11. Changes to this policy
We will post any change here and update the date at the top. If a change materially affects
your rights we will tell subscribed users by email before it takes effect. The version that
applies to a purchase is the one published on the day you bought.