Privacy Policy
This policy explains what personal data Unquant ("we", "us") collects when you use unquant.io and the Unquant API, why, who we share it with, and your rights.
The short version
- We don't store your prompts or completions. They're processed in memory to generate a response and are not logged or written to any database, and we never use them for training.
- We keep only what we need to run your account and the Service: your name, email, application details, billing status, API key records and operational metadata such as request times and token counts.
- We don't sell your data or use it for advertising.
1. What we collect
1.1. When you apply for access: your name, email address, the plan you're interested in, and what you intend to use the Service for (if you tell us). Applications made through our earlier sign-up form (before 17 September 2026) also recorded your browser type and country.
1.1a. When you create an account during our open beta: your name, email address, a securely hashed password and the plan you choose. We email you a link to confirm your email address before you can start a free demo.
1.2. Your account: name, email, a securely hashed password, your plan and subscription status, invitation and demo history, and settings. API keys are stored only in hashed form; we can't see your full key after it's created.
1.3. Billing: payments are handled by Stripe. We receive and store your Stripe customer and subscription identifiers, plan, amounts and payment status. We never see or store your full card details.
1.4. Using the API: your prompts and completions pass through our gateway and serving infrastructure only in memory, to produce your response. We do not log, store or inspect them. To make repeated requests faster, our serving engines may briefly keep the processed form of recent context in GPU memory; it is never written to disk and is overwritten as the memory is reused. We do record operational metadata for each request: timestamps, the model and API key used, token counts, speed and timing figures, the shape of the request (for example how many messages it contained, and whether it used tools or images), and errors. We use this to run, secure and improve the Service, enforce plan limits, and show you your usage.
1.5. Security and abuse prevention: your IP address is processed when you use the website or API to protect against fraud, abuse and attacks: for rate limiting (kept only as a one-way hash, for about a minute) and for bot checks by Cloudflare Turnstile. We don't store IP addresses with your API requests. So that each person gets one free demo, when you apply, sign up or start a demo we keep one-way keyed hashes (never the original values) of your email address, a random identifier your browser keeps for our site, your IP address and your network, with your application or account, for 90 days. A match with another account may be reviewed by us before a demo is allowed.
1.6. Website analytics: only if you agree, we use PostHog to understand how the website and dashboard are used: pages visited, clicks, device and browser type, approximate location, and session recordings of how the pages are used. Recordings never capture what you type, the contents of requests and responses, or secrets shown on the page such as API keys. If you're signed in, we link this to your account (your name and email) so we can help you with problems you run into. You can change your choice at any time (section 7).
1.7. Communications: if you email us or talk to us on Discord, we keep that correspondence to help you.
1.8. Our ad links: if you reach us through one of our ads, we count the visit by the link’s campaign tags (no cookie is set and nothing identifies you), and if you then apply or create an account we record which ad brought you with your application or account.
2. Why we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Reviewing applications, sending invitations, creating and running your account, providing the API | Contract (or steps before entering one) |
| Billing, refunds and keeping financial records | Contract; legal obligation (tax and accounting) |
| Service emails (invitations, activation reminders, billing and account notices) | Contract; legitimate interests |
| Security, fraud and abuse prevention, enforcing our Terms | Legitimate interests (keeping the Service and customers safe) |
| Operational metadata to run, troubleshoot and improve performance and capacity | Legitimate interests |
| Website analytics | Consent |
| Responding to you; occasional product news to customers (you can opt out) | Legitimate interests |
| Complying with the law and responding to lawful requests | Legal obligation |
4. International transfers
Some of our providers process data outside the UK, including in the United States and, for model serving, in other countries where our compute providers operate (for example Singapore; GPU servers may be located in various countries). Where personal data is transferred outside the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
5. How long we keep it
- Applications that don't lead to an account: up to 12 months after our last contact, then deleted.
- Account data: while your account is open, then up to 24 months after closure in case of disputes, unless you ask us to delete it sooner.
- Billing and financial records: 6 years, as required for UK tax.
- Operational request metadata: detailed per-request records for 35 days; hourly usage totals for as long as your account is open.
- Sign-in sessions: 8 hours. Password reset links: 30 minutes. Rate-limiting records: about a minute.
- Prompts and completions: not stored.
6. Your rights
You have the right to access your personal data, to have it corrected, to have it deleted, to restrict or object to how we use it, to data portability, and to withdraw consent at any time where we rely on consent. To use any of these rights, email contact@unquant.io. We'll respond within one month.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
7. Cookies and similar technologies
- Essential: a session cookie keeps you signed in and protects your account (
uq_session, expires after 8 hours), and Cloudflare may set cookies needed for security and bot protection. These are needed for the Service to work. - Preferences: your browser stores your chosen theme, currency and analytics choice locally on your device; this never leaves your browser.
- Analytics: PostHog cookies or local storage, used only if you consent. You can change your choice at any time using Cookie settings in the website footer.
8. Security
We protect your data with measures including encrypted connections (HTTPS), hashed passwords and API keys, encrypted storage of invitation links, access controls, and the design choice not to store prompts or completions at all. No system is perfectly secure; if a breach affecting your data occurs, we'll notify you and the ICO where the law requires.
9. Children
The Service is for people aged 18 and over. We don't knowingly collect data from anyone under 18; if we learn that we have, we'll delete it.
10. Changes to this policy
We'll update this policy when our practices change and show the date at the top. We'll tell you about significant changes by email or in your dashboard.
11. Contact
Unquant. Email: contact@unquant.io.