Legal

Privacy Policy

Last updated: 2026-05-21

This Privacy Policy explains what personal data we collect when you use the Service, why we collect it, and how we handle it. We comply with the EU General Data Protection Regulation (GDPR, Regulation 2016/679).

1. Data controller

The data controller is [OPERATOR NAME — e.g. Abdelkader Bousabaa, individual entrepreneur registered in France], reachable at privacy@quantum-actuarial-science.com.

2. What we collect

2.1 Account data

• Email address (login identifier).
• Hashed password (bcrypt — we never store passwords in clear text).
• Plan (Free or Pro) and Pro expiration date.
• Account creation timestamp.

2.2 Usage data

• Calculations performed: timestamp, application key, ISO week — used to enforce the Free-plan weekly quota.
• Saved calculations: parameters and results stored when you explicitly save them; never automatically.

2.3 Billing data

• Stripe customer ID and subscription ID. Card numbers and full payment details are processed and stored solely by Stripe Payments Europe Ltd.; we never receive them.

2.4 Analytics

We use Google Analytics 4 with IP anonymisation enabled, to measure page views in aggregate. No personal identifiers are transmitted.

3. Legal basis

We process personal data on the following bases:

• Contract (Art. 6(1)(b) GDPR) for account, subscription, billing.
• Legitimate interests (Art. 6(1)(f)) for security, fraud prevention and aggregate analytics.
• Legal obligation (Art. 6(1)(c)) for accounting records (kept ten years).

4. Recipients

• Stripe Payments Europe Ltd. — payment processing.
• TB-Hosting — hosting of the platform (servers located in [REGION — confirm with provider]).
• Google Ireland Ltd. — anonymised analytics (Google Analytics 4).

We do not sell personal data to third parties.

5. Retention

• Account data: as long as your account exists. Deleted within 30 days after account closure.
• Usage events: deleted after 12 months.
• Invoices: 10 years (French accounting obligation).
• Analytics: 14 months (Google Analytics default).

6. Your rights

Under GDPR you have the right to:

• Access your data (Art. 15).
• Request rectification (Art. 16).
• Request erasure / “right to be forgotten” (Art. 17).
• Restrict processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Lodge a complaint with the French data-protection authority, the CNIL.

To exercise any of these rights, write to privacy@quantum-actuarial-science.com. We respond within one month.

7. Cookies

We set the following cookies:

• qas_session — strictly necessary, holds your login session (HTTP-only, SameSite=Lax). Deleted when you log out.
• _ga, _ga_* — Google Analytics, anonymous, 14-month lifetime.

8. International transfers

Stripe and Google may transfer data to the United States under Standard Contractual Clauses approved by the European Commission. Hosting is performed [confirm with TB-Hosting — typically EU data centres].

9. Changes

We may update this policy from time to time. Material changes are announced on the platform with at least 30 days’ notice.