This Privacy Policy explains how Jaime Manuel Iglesias Calle Jr., an individual, doing business as "ScalarQuant" (“ScalarQuant,” “we,” “us,” or “our”) collects, uses, discloses, stores, and protects personal information when you use the ScalarQuant website, application, beta features, communications, and related services (collectively, the “Service”).
ScalarQuant is a stock-research application. Visitors may browse market information and keep temporary guest watchlists or portfolios without creating a permanent account. An email-backed or Google account is required for AI-assisted research, cross-device persistence, and subscription features.
This Policy applies to information that identifies, relates to, describes, can reasonably be linked with, or could reasonably be associated with an individual or household. It does not apply to information that cannot reasonably be linked to an individual, or to third-party websites and services governed by their own privacy notices.
If our practices change, we will update this Policy and provide any notice or choice required by law before using personal information for a materially different purpose.
The information we collect depends on how you use the Service.
Guest visitors receive an anonymous Supabase account identifier. Creating a permanent account is required for AI and cross-device persistence. Guest records remain tied to that browser session unless the visitor chooses to migrate them after signing in.
Portfolio and watchlist information may reveal your financial interests or investment activity. Do not enter brokerage credentials, account numbers, tax information, or other information that the applicable field does not request.
Do not submit sensitive personal information, confidential information, nonpublic financial information, trade secrets, or personal information about another person unless you are authorized to provide it for this processing.
The current application uses IP-based limits in server memory. Our hosting and infrastructure providers may also create logs according to their configured retention settings.
See Section 8 for more information.
ScalarQuant obtains company, securities, market, filing, and news information from public or commercial sources such as Financial Modeling Prep, SEC EDGAR, and Yahoo Finance RSS. This information generally concerns public companies and securities rather than ScalarQuant users. Public news or filings may, however, mention executives, employees, investors, or other individuals.
ScalarQuant does not intentionally collect sensitive personal information such as precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric identifiers, sexual orientation, citizenship or immigration status, Social Security numbers, government identification numbers, private account credentials, or contents of private communications unrelated to the Service.
Please do not submit sensitive personal information through portfolio notes, AI inputs, feature requests, or support messages. If we learn that we received sensitive personal information that is not needed to provide the Service, we may delete or restrict it. Where consent is legally required, we will obtain consent before processing sensitive personal information and provide a way to withdraw that consent.
Where laws such as the GDPR apply, our legal bases may include:
We do not use ScalarQuant's stock scores or AI research to make solely automated decisions about a user that produce legal or similarly significant effects. The Service analyzes public-company and securities information; it does not determine a user's eligibility for employment, housing, education, credit, insurance, healthcare, or another legally significant service.
Some information is necessary to provide a feature. For example, the Service needs an account identifier to isolate saved records, a ticker to return company research, and source text to analyze a pasted document. If you do not provide required information, the relevant feature may not work. Portfolio entries, pasted documents, feature requests, and most other content are optional.
ScalarQuant uses OpenAI's API to help extract reported facts from source material and produce a structured research analysis.
Under OpenAI's published API data controls, API content is not used to train or improve OpenAI models by default unless the API customer expressly opts in. Under OpenAI's default API controls, it may retain API inputs, outputs, and related abuse-monitoring data for up to 30 days. Retention may be shorter under approved data controls or longer when legally required.
OpenAI acts as a service provider or processor for this use. Its processing is also governed by its applicable business terms, data-processing terms, and security controls.
Only submit content you have the right to provide. Do not submit personal information about another individual, confidential employer information, brokerage statements, credentials, health information, government identifiers, or other sensitive or regulated data. AI output can be incomplete or inaccurate; review the source citations and do not treat the output as a determination about any person.
We may disclose personal information to the following categories of recipients for the purposes described below:
We require service providers to process personal information only for contracted purposes and to protect it as required by applicable law and our agreements.
We may disclose information to courts, regulators, law enforcement, government authorities, or other parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, property, users, or the integrity of the Service.
We may disclose information to attorneys, accountants, auditors, insurers, and other advisers subject to appropriate confidentiality obligations.
Information may be disclosed in connection with due diligence, financing, a merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business. Any recipient will be subject to applicable confidentiality and notice requirements.
We may disclose information when you direct us to do so or give valid consent.
ScalarQuant does not sell personal information for money. On ad-supported free experiences, Google and its advertising partners may use identifiers, device and network activity, page context, consent signals, and ad interactions to select, deliver, and measure personalized advertising where your choices and applicable law allow. Some jurisdictions may define this activity as sale, sharing, targeted advertising, or cross-context behavioral advertising even when no money is exchanged for the information.
You may use the consent and privacy-choice controls described in Sections 8, 11, and 12 to reject or withdraw consent and opt out where applicable. ScalarQuant does not intentionally send portfolio entries, watchlists, AI source text, or AI output to Google for ad selection. We do not knowingly sell or share the personal information of consumers under 16.
The current beta uses essential browser storage for Supabase authentication, session storage to remember the current application view, and local storage to remember dismissed notices, on-device review status, and an optional guest-data migration snapshot for up to 30 days. That snapshot may contain watchlist symbols, portfolio tickers, shares, average costs, purchase dates, thesis notes, and cash balance so you can choose whether to copy them into a permanent account after signing in. These technologies are necessary to keep you signed in, isolate user data, maintain security, and operate the interface.
When advertising is enabled, ScalarQuant uses Google AdSense on guest and signed-in free pages. Google and participating advertising providers may use scripts, cookies, pixels, local storage, IP-derived general location, device information, page context, consent signals, and ad-interaction data for ad delivery, fraud prevention, frequency control, personalization where permitted, measurement, and reporting. ScalarQuant does not currently use a separate analytics or customer-support tracking integration. Our hosting, authentication, payment, consent, and advertising providers may process technical data as described in this Policy.
Google's certified consent-management flow is used for eligible visitors in the EEA, United Kingdom, and Switzerland. US state privacy messaging provides applicable opt-out choices. Google may show personalized, non-personalized, or limited ads based on region, consent, opt-out status, and ad availability. Plus subscribers remain ad-free within ScalarQuant's controlled placements.
You can clear cookies and site storage through your browser settings, but doing so may sign you out or require you to sign in again.
Some browsers offer a “Do Not Track” (“DNT”) signal. Because there is no uniform industry standard for interpreting DNT, the Service does not currently alter its necessary processing in response to DNT. Use the advertising privacy controls presented by Google, a recognized opt-out preference signal where applicable, or your browser controls instead.
Global Privacy Control (“GPC”) and similar legally recognized opt-out preference signals concern sale, sharing, or targeted-advertising activity. Google's US state privacy messaging supports GPC signals in covered jurisdictions. You may also use the Google privacy message or browser controls to withdraw or change advertising choices.
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security and records, resolving disputes, enforcing agreements, and complying with law. Retention depends on the data and context:
We may retain information longer when required by law, needed to establish or defend legal claims, or necessary for security. Backup deletion may occur on a delayed schedule controlled by the applicable service provider. When retention ends, we delete, de-identify, or aggregate the information.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. Current controls include authenticated sessions, server-side token verification, user-scoped database access controls, rate limiting, access restrictions, secret-management practices, security headers, and testing of key isolation boundaries.
No system is completely secure. You are responsible for protecting your device, email account, password, and active sessions. Contact us promptly if you believe your account or information has been compromised.
Depending on where you live and subject to legal exceptions, thresholds, and verification requirements, you may have the right to:
Send a request to [email protected]. Describe the right you want to exercise and the account or browser session involved. Do not send a password, full authentication token, government identifier, or other unnecessary sensitive information.
We will use reasonable methods to verify the request. Verification may include confirming control of the account email or asking you to make the request while signed in. We will not require account creation solely to submit an opt-out request.
We will respond within the period required by applicable law. For covered U.S. state requests, this is generally within 45 days, subject to a permitted extension. Where the GDPR applies, we generally respond within one month, subject to a permitted extension. If we decline a request, we will explain why and provide appeal instructions where required. Submit an appeal to [email protected] with “Privacy Appeal” in the subject line. We will respond to a covered appeal within the legally required period.
An authorized agent must provide proof of authority, and we may separately verify your identity or authority as allowed by law. We may deny or limit a request where we cannot reasonably verify it, an exception applies, fulfillment would adversely affect another person's rights, or the request is manifestly unfounded, excessive, or repetitive.
Residents of states with comprehensive privacy laws may have some or all of the rights described above, subject to each law's scope, thresholds, exceptions, and verification rules. Eligible visitors may use the US state privacy message to opt out of sale, sharing, or targeted advertising. We honor legally recognized universal opt-out signals where applicable and provide an appeal process through the privacy contact listed above.
California residents may have rights to know, access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, access information about covered automated decisionmaking, and receive equal service. The categories collected, sources, purposes, disclosures, and retention criteria are described in Sections 2, 3, 4, 7, and 9. ScalarQuant does not sell personal information for money. AdSense activity may be considered sharing or cross-context behavioral advertising under California law; eligible visitors can opt out through the advertising privacy controls and legally recognized preference signals described above.
ScalarQuant designates Jaime Manuel Iglesias Calle Jr., an individual, doing business as "ScalarQuant" as controller. The categories of personal data collected are described in Section 2, the purposes are described in Section 4, the categories of recipients are described in Section 7, and the request mechanism is described in this Section 12. Rhode Island residents may have rights to access, correct, delete, obtain a portable copy, opt out of qualifying processing, use an authorized agent, and appeal as provided by applicable law.
If the GDPR or comparable law applies, you may have rights of access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority. You may also have a right not to be subject to a qualifying solely automated decision with legal or similarly significant effects. ScalarQuant does not use personal information for such decisions.
You may complain to the supervisory authority where you live, work, or believe a violation occurred. United Kingdom residents may contact the Information Commissioner's Office. Contact us first if you are comfortable doing so, and we will try to resolve the issue.
ScalarQuant is operated from Rhode Island in the United States. If you use the Service from another country, your information may be transferred to and processed in the United States and in other countries where our service providers operate. Those countries may have data-protection rules that differ from those where you live.
Where legally required, we rely on provider contractual protections, adequacy decisions, Standard Contractual Clauses, the applicable United Kingdom addendum, or another approved transfer mechanism.
The Service is intended for adults and is not directed to children under 18. By creating an account, you represent that you are at least 18 and agree to the Terms of Service.
We do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13 without legally valid parental consent, we will delete it. A parent or guardian who believes a child provided information may contact [email protected].
The Service may link to or display content from third-party websites, public filings, news publishers, and market-data sources. We do not control those parties' privacy, security, accuracy, or content practices. Review their policies before providing information directly to them.
We may update this Policy as the beta changes. We will revise the “Last updated” date and provide additional notice when required, such as an in-product notice or email for a material change. If a change requires consent, we will request consent before applying it to affected information.
For privacy rights requests, use the subject line “Privacy Request.” For appeals, use “Privacy Appeal.”