Quant Mec Technologies · SSM 202603082822 003836548H · Selangor, Malaysia
Effective 28 October 2026
These are the companies that help us run the products. Each one may handle customer data in the course of doing its job. This page is the authoritative list, referred to by our Privacy Policy and our Data Processing Agreement.
We give 30 days’ notice by email before adding or replacing any of them.
The transfer mechanism column states what covers a transfer of personal data protected by the EU or UK GDPR to that recipient. For transfers out of Malaysia we rely on section 129(3)(f) of the Personal Data Protection Act 2010 in every case — see the final section.
| Provider | What it does | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | the database holding all customer content | everything you put into the products, plus account records | Singapore | SCCs + UK Addendum |
| Vercel | hosts the web applications and runs their server functions | requests in transit, account identifiers | United States | SCCs + UK Addendum |
| Railway | hosts the product backends that do the analysis | data in transit during a request | Singapore | SCCs + UK Addendum |
| Provider | What it does | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Anthropic | Claude — the models behind every product’s analysis and chat | the content of your request and the context sent with it | United States | Standard Contractual Clauses, incorporated and executed through Anthropic’s own Data Processing Addendum |
Anthropic does not train on your content. Its commercial terms prohibit training on content submitted through its services — a contractual bar, not a setting either of us could change.
Anthropic deletes request content within 30 days. Where its automated systems flag content as a possible breach of its usage policy, it may hold that content for up to two years under its own terms in order to investigate misuse. Our Privacy Policy explains this in full.
Anthropic engages sub-processors of its own. Its current list is published at anthropic.com/subprocessors, and its terms bind each of them to obligations substantially as protective as those Anthropic owes us.
| Provider | What it does | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Clerk | sign-in and account security | name, email address, session records | United States | DPF where certified, otherwise SCCs + UK Addendum |
| Stripe | payment processing, the billing portal, card storage, invoices | name, email, billing address, card details, tax identifiers | United States and India | DPF where certified, otherwise SCCs + UK Addendum |
We are the seller. Stripe processes payments on our behalf and holds the card details, so we never see a card number. Stripe is our processor for taking payment, and a controller in its own right for fraud prevention and for the records it must keep under financial-services law. What it does in that second capacity is set out in its own privacy policy.
| Provider | What it does | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Tavily | web search used by the products that research public sources — the provider currently in use | the search terms derived from your request | United States | DPF where certified, otherwise SCCs + UK Addendum |
| Serper | an alternative search provider the products can be configured to use instead of Tavily | the search terms derived from your request | United States | DPF where certified, otherwise SCCs + UK Addendum |
These receive a search query, not your stored data. They return publicly available results; they are not told who you are.
Both are listed because the products can call either. Tavily is the provider in use; Serper remains available as an alternative and we would update this page before switching to it.
| Provider | What it does | Data it may handle | Location | Transfer mechanism |
|---|---|---|---|---|
| Resend | sends the notices our agreements require — price changes, changes to these documents, changes to this page | your account contact's name and email address, and the content of the notice | United States | DPF where certified, otherwise SCCs + UK Addendum |
This is for contractual notices only. There is no marketing list, no newsletter and no unsubscribe, because you cannot opt out of being told that your price is changing. Emails about your billing — payment receipts, failed payments, expiring cards — come from Stripe, not from here.
For the avoidance of doubt, these do not handle customer data:
Some products research publicly available information and report what they find about third-party tools and services. Those vendors are not sub-processors. We send them nothing, we receive nothing from them, and they have no relationship with us.
We receive no compensation of any kind from any vendor named in any output. Placement cannot be bought. See clause 7.4 of the Terms of Service.
Customer data leaves Malaysia. We hold no infrastructure in Malaysia — it is where the company is registered, not where anything is stored or processed.
Under Malaysia’s Personal Data Protection Act 2010, for each recipient above we rely on section 129(3)(f): we have taken reasonable steps and exercised due diligence to satisfy ourselves that the recipient will not treat the data in a manner that would breach the Act. The evidence is the written data protection terms we hold with each one.
Under the EU GDPR and UK GDPR, where they apply, each transfer is covered by the mechanism named in the table above:
Our own processing in Malaysia is covered by the Standard Contractual Clauses incorporated at clause 17 of the Data Processing Agreement.
We maintain an internal transfer register recording, for each recipient, its registered name, company registration number, data protection contact, the categories of data transferred, the purpose, and the safeguards relied on. Customers may request it.
This is the one document on the site that goes stale by itself. Every change of provider starts the 30 days’ notice promised in clause 9 of the Data Processing Agreement, and because both the Privacy Policy and that Agreement point here, an out-of-date entry on this page makes all three inaccurate.
Alongside this page we maintain an internal register, available to customers on request, recording for each provider its registered name, company registration number, data protection contact, the categories of data transferred, the purpose, and the safeguard relied on.