Privacy Policy

An account holds your email address, hashed credentials, multi-factor settings, and session records. A purchase adds your subscription state: which tier, when the license term ends, and references to the payment. Card numbers never touch our servers; they go directly to Stripe.

We also keep a security audit trail, a timestamped record of actions such as sign-ins, purchases, and administrative operations, each entry recorded with the network address it came from. And we keep messages you send through the contact form or to support.

That is the full list. We build no browsing profiles, use no advertising identifiers, and hold nothing collected for marketing. We do not sell or share personal information, for marketing or anything else.

We use your email address to run your account, to deliver the daily publication if you hold a license, and to tell you before your license ends. Pick emails carry an unsubscribe link. Account and security notices do not, because you need them; that includes the two license notices, 30 days before your term ends and once it has ended.

Six services process data on our behalf, each seeing only what its job requires: Stripe handles payments and holds card details we never see. Supabase hosts the database and authentication. Vercel hosts the site. Resend delivers our email. Upstash backs the rate limiting that protects sign-in and the forms, and for that purpose it briefly holds request counters keyed by network address. Google processes sign-ins made through Google and hosts our support mailbox, so email sent to support passes through it.

One more sees form submissions before we do: Cloudflare Turnstile screens the contact and account-recovery forms for bots.

The site runs no advertising trackers and loads no ad-tech. Any traffic measurement we use is cookieless and aggregate, with no individual profiles.

Signing in sets session cookies. They are httpOnly, so scripts cannot read them, and they exist to keep you signed in. Every visit also sets one security cookie: a random token that protects our forms against cross-site request forgery. It is readable by the page's own scripts because that is how the protection works, and it identifies nobody. A short-lived cookie also guards emailed sign-in links while they are in flight.

That is every cookie we set. None of them track you, none are advertising, and all are strictly necessary, which is why there is no cookie banner: there is nothing optional to consent to.

Email support@quantsightanalytics.com from your account address and ask us to delete your account. We verify the request is really yours, then delete the account within 30 days: email, credentials, sessions, and support history.

Two records outlive deletion, because the law and the defense of the business require them. Billing and transaction records are retained for seven years to satisfy tax and payment regulations. The security audit trail, which records actions rather than a profile, is retained for seven years and then deleted. Both exist to resolve payment disputes and investigate abuse; neither is ever used for marketing.

You can ask what we hold about you, ask us to correct it, or ask us to delete it, all at the same address: support@quantsightanalytics.com. We reply within one business day and complete the request within 30 days. Written requests can go to QuantSight Analytics LLC, 2389 Main St. Ste 100, Glastonbury, CT 06033.

Credentials are stored hashed, transport is encrypted, sessions live in httpOnly cookies, and administrative access requires multi-factor authentication. No system is perfect; if an incident affects your data, we tell you promptly and plainly.

The service is for adults 21 and over. We do not knowingly hold data on anyone under 21, and we delete it if we find it.

We may update this policy. The date at the top is the version, and material changes are emailed to account holders before they take effect.