Privacy Policy

1. Who we are and what this covers

Quant Mec Technologies is a company registered in Malaysia (SSM 202603082822 / 003836548-H), with its registered office in Selangor, Malaysia. We build AI business software sold to businesses. You can reach us about anything in this notice at support@quantmec.com.

This notice covers personal data we handle as a controller — information about you as our customer, and about people who contact us.

It does not cover the business content you put into the products. For that we act as your processor, you decide what happens to it, and the terms are in the Data Processing Agreement.

We do not currently offer the service in the European Economic Area, Switzerland or the United Kingdom, and clause 3 of our Terms of Service says so. We expect to open those territories later and will update this notice before we do. Where the EU or UK GDPR nevertheless applies to you, the protections set out in sections 3, 6 and 9 are written to meet it.

2. What we collect

We do not take payment card details. Stripe collects and holds them on our behalf. We never see a card number. Stripe is also a controller in its own right for fraud prevention and for the transaction records it must keep under financial-services law; what it does in that capacity is set out in its privacy policy.

We use no analytics service, no advertising tags and no tracking pixels. We set only the cookies needed to keep you signed in and to remember that you accepted our terms.

Do Not Track. Browsers can send a “Do Not Track” signal. There is still no agreed standard for what a site must do when it receives one, and we do not respond to it — but there is nothing for it to switch off. We run no analytics, no advertising and no cross-site tracking, which is the behaviour the signal exists to stop. California law requires us to tell you how we treat the signal, so that is the answer.

What we do not collect. We do not ask for, and have no use for, the categories privacy law treats as special or sensitive: health data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, and criminal records. If you place data of that kind into the products as part of your own business content, you do so as its controller and the Data Processing Agreement governs it, not this notice.

3. Why we may lawfully use it

Under Malaysia’s Personal Data Protection Act 2010, we rely on your consent and on the necessity of processing to perform the contract with you.

Where the EU or UK GDPR applies to you despite the territorial restriction above, we rely on:

We do not use your personal data for marketing profiling or automated decision-making that produces legal or similarly significant effects.

Where you believe our legitimate interests do not outweigh your rights in your particular situation, you may object — see section 9.

4. Your business content, and AI

The figures, documents and questions you put into the products are yours. The rule the platform is built on:

The AI agent does not own the data. You own and control your data, and the agent receives only the minimum authorised context necessary to perform its task.

What that means here:

• Your content is never used to train an AI model. Not by us, and not by Anthropic, whose Claude models we use. Anthropic’s commercial terms bar it from training on content submitted through its services. It is a contractual prohibition, not a setting, so it cannot be switched on by accident.
• Your content is sent to the AI provider only to answer your request, and only the part needed for that request.
• An agent cannot reach another customer’s data. Accounts are separated at the database layer, not only in the interface.
• Processing is not training. Using your figures to answer your question is not permission to learn from them.

How long the AI provider holds it. Anthropic deletes the content of a request, and the answer it produced, within 30 days. There is one exception we want you to know about rather than discover: where Anthropic’s automated systems flag content as a possible breach of its usage policy, it may keep that content for up to two years, and the classification scores for longer, so that it can investigate and prevent misuse. That retention is Anthropic’s, under its own terms, and it applies to a small minority of requests. Nothing in it permits training.

5. Who else handles it

We use a small number of service providers. Each is listed, with what it does, where it operates and the transfer mechanism that covers it, on our Sub-processors page. That page is the authoritative list and we keep it current.

We do not sell personal data. We do not share it for anyone else’s marketing. We receive no payment from any third-party vendor named in any report our products produce.

6. Where your data goes

Your data leaves Malaysia. It has to — we hold no infrastructure in Malaysia. Malaysia is where our company is registered, not where anything is stored or processed.

For transfers out of Malaysia we rely on section 129(3)(f) of the Personal Data Protection Act 2010 — we have taken reasonable steps and exercised due diligence to satisfy ourselves that each recipient will not treat the data in a way that breaches the Act. The evidence is the contractual data protection terms we hold with every provider on that list.

For personal data protected by the EU or UK GDPR, a transfer outside the EEA or the UK is covered by one of the following, named per recipient on our Sub-processors page:

• the EU Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK data is involved, for recipients in countries without adequacy — this covers our processing in Malaysia, our database and backends in Singapore, and any United States provider not certified under the EU–US Data Privacy Framework;
• the EU–US Data Privacy Framework and its UK Extension, for United States providers that are certified under it.

You can ask us for a copy of the safeguards that apply to a particular transfer. We keep a register of these transfers recording, for each recipient, its name, registration number, data protection contact, the data transferred, the purpose and the mechanism relied on.

7. How long we keep it

We do not keep data indefinitely because storage is cheap.

8. Deleting your account

You can ask us to delete your account and its data by writing to support@quantmec.com.

When you do:

1. We close the account immediately. You can no longer sign in, and we cancel your subscription so no further charge is taken.
2. We hold the data for 30 days, so you can change your mind. Tell us within that window and we restore the account. The subscription does not come back — you would resubscribe.
3. After 30 days we delete it permanently — the account, your content across every product, the chat history, and the stored reports.
4. What survives: our record that the account existed and when it was deleted, so a replayed payment event cannot resurrect it; invoices we must keep by law; and, at the AI provider, any request content already covered by the retention described in section 4, which runs on its own clock and which we cannot shorten.

How the deletion actually happens

Deletion is a scheduled job, not a manual clean-up, and it does not depend on anyone remembering:

• Your account record is the parent of everything else you own. Removing it cascades through the database to your submitted content, generated analyses, chat history, stored reports and any derived copies — these are deleted together, in one transaction, not marked hidden.
• Records held by a product backend outside the main database are deleted in the same run.
• Files held in object storage are deleted by the same job, by reference to your account identifier.
• Backups are not edited. They expire on their own cycle, which is no longer than 30 days, so a deleted account is gone from backups within that period too.
• Where a sub-processor holds a copy incidental to its function — a sign-in record, a billing record — we instruct its deletion, except where that provider must keep it by law as a controller in its own right. Stripe retains transaction and dispute records under its own financial-services and anti-fraud obligations, which we cannot shorten, and we must keep our own invoices for seven years under Malaysian tax law.
• The AI provider works differently: it deletes request content automatically on its own 30-day cycle rather than on our instruction, so content from your account ages out rather than being deleted on request. The exception in section 4 applies.

We do not confirm deletion before it has run. If you ask, we will tell you the date the job completed.

9. Your rights

You may ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it;
• limit how we use it;
• stop using it for a particular purpose.

Where the EU or UK GDPR applies to you, you also have the right to receive the personal data you gave us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible (portability), and the right to object at any time to processing we base on our legitimate interests. Where you object, we will stop unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend a legal claim.

If you are in the United States. A number of states now have their own privacy statutes. Nearly all of them, California’s included, apply only above a threshold set by revenue or by the number of residents whose data a business handles, and we are below every one of those thresholds. We would rather tell you that than publish a section implying duties we do not currently carry. If we grow past them, this notice will be rewritten before the obligation arrives rather than after.

Meanwhile we do not want your location to decide what you can ask us for, so the rights listed above are open to you wherever you are. Three further points those statutes put in writing, and which are true of us in any event:

• We do not sell personal data, and we do not share it for cross-context behavioural advertising. We have no advertising relationships of any kind, and we have disclosed none of your personal data for a commercial purpose.
• We will not treat you worse for asking. No change of price, no reduction in service, no closed account.
• You can appeal a refusal. If we decline a request, reply and say you are appealing it. We will reconsider and give you our reasons in writing within 45 days. You may also complain to the attorney general of your state.

Write to support@quantmec.com. We will reply within 21 days, and in any event within one month where the EU or UK GDPR applies. There is no charge unless a request is excessive or repetitive, and we will tell you before charging anything.

On deletion requests: if you are asking us to delete your account and the business content in it, section 8 above is what happens, on the timetable set out there. If you are asking us to delete personal data about you as our customer — your name, email or contact history — but to keep the account open, tell us so, and we will delete what we can without preventing us from running the account, and tell you what we must keep and why.

If the data you want removed sits inside another business’s account — because you are that business’s employee, contractor or contact — we are a processor for it and cannot act on your request directly. We will pass it to that business promptly, because the request is theirs to answer.

Complaints. You may complain to the Personal Data Protection Commissioner in Malaysia. If you are in the EEA you may complain to the supervisory authority in your country of residence, place of work, or where you think the problem happened. If you are in the United Kingdom you may complain to the Information Commissioner’s Office. We would rather you told us first, but you do not have to.

10. Security

We encrypt data in transit and at rest. Access to production systems is limited, authenticated and logged. Accounts are separated at the database layer. Our staff do not browse customer content, and access for support requires a reason and is recorded.

No system is perfectly secure. If a breach affects your personal data and is likely to cause you harm, we will tell you and the relevant authority as the law requires — within 72 hours of becoming aware where the EU or UK GDPR applies — and we will tell you what happened and what we did.

11. Children

The service is for businesses. It is not for anyone under 18, and we do not knowingly collect their data.

12. Changes

We may update this notice. The revision date at the top always shows when. For a material change we will email you at least 30 days beforehand.

13. Contact

Quant Mec Technologies, Selangor, Malaysia — support@quantmec.com