1. Who we are (data controller)

QuantCapitol is operated from the Netherlands by its independent operator, who is the "data controller" responsible for the personal data described in this notice.

For any privacy question or to exercise your rights, contact us through our contact page. The operator's full business registration details — the registered legal entity, its address, and its Chamber of Commerce (KvK) and VAT numbers — are available on request by email via that page.

2. The data we publish about public officials

The core of this platform is a record of the securities transactions of members of the US Congress, compiled from mandatory public disclosures filed with the US House Clerk and the US Senate under the STOCK Act. This record contains personal data relating to those public officials (their name, chamber, party, and the trades they are legally required to report).

We process this data on the basis of our legitimate interest — and the public's legitimate interest — in the transparency and accountability of elected representatives (Art. 6(1)(f) GDPR), and in reliance on the freedom of expression and information / journalistic and public-interest exemption (Art. 85 GDPR and the Dutch implementation thereof). The underlying information is already lawfully public, published by the US government itself.

We take reasonable steps to reproduce these filings faithfully and every record links back to its original source document. If a public official believes a record we display is inaccurate, they may request correction through our contact page; we will review and, where warranted, correct or annotate it.

3. Personal data we collect about you

When you register, subscribe, contact us, or simply use the site, we may process:

• Account data — your name and email address, and your account credentials. Passwords are stored only as salted one-way cryptographic hashes; we never store or have access to your plain-text password.
• Subscription & billing data — your plan, status and billing history. Card and payment details are handled entirely by our payment processors (see §5); we do not receive or store your full card number.
• Preferences — watchlists, alert settings and other options you configure.
• Support & contact data — the content of messages you send us through the contact form or by email.
• Technical data — standard server logs (IP address, browser type, timestamps and pages requested), kept for security and to keep the service running.

We do not build advertising profiles, we do not sell personal data, and we do not show third-party targeted advertising.

4. Why we process it, and our legal basis

• To provide your account and the paid service — basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To send account and service-related email you request, and marketing only if you opt in — basis: your consent, which you can withdraw at any time (Art. 6(1)(a)).
• To keep the site secure, prevent abuse and operate reliably — basis: our legitimate interest (Art. 6(1)(f)).
• To meet legal obligations, such as retaining invoices for tax purposes — basis: legal obligation (Art. 6(1)(c)).

5. Who we share data with (processors & recipients)

We use a small number of trusted service providers who process data on our behalf, under contract and only on our instructions:

• Payment processing — Polar and/or Lemon Squeezy, which act as merchant of record and handle your payment details and invoicing.
• Hosting — our website and database are hosted on servers located in the European Union.
• Email delivery — the provider that sends account and (if you opt in) digest email.

International transfers: some of these providers may process data outside the European Economic Area (for example in the United States). Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses. We share personal data with public authorities only where we are legally required to do so.

6. How long we keep it

We keep your account data for as long as your account is active. When you delete your account, we delete the associated personal data without undue delay, with two exceptions: (a) invoices and payment records, which we are legally required to retain for seven years under Dutch tax law, and (b) limited data we must keep to resolve disputes or enforce our terms. Routine technical logs are rotated and overwritten in the normal course of operation.

7. Cookies & local storage

We use only what the site needs to function: a session cookie to keep you logged in, and your browser's local storage to remember preferences (such as a dismissed notice). We do not use advertising cookies or third-party tracking analytics. Because we set no non-essential tracking, no consent banner is required; if that ever changes, we will ask for your consent first.

8. Your data-protection rights

Under the GDPR you have the right to:

• Access — obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted (subject to the legal-retention exceptions in §6).
• Restriction & objection — restrict or object to certain processing, including processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, where processing is based on consent, without affecting prior processing.

You can exercise these rights through your account dashboard or our contact page. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.

9. Security

All traffic between your browser and our servers is encrypted over HTTPS/TLS. We apply appropriate technical and organizational measures — including access controls and modern password hashing — to protect personal data against unauthorized access, loss or alteration. No system is perfectly secure, but we work to keep risk low and to respond quickly if an incident occurs.

10. Children

This service is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this notice

We may update this notice as the service or the law evolves. The "last updated" date above always reflects the current version; material changes will be highlighted on the site.