Privacy Policy

1. Controller

Orion Quant Technologies GmbH, Ober-Roden-Straße 3, 5760 Saalfelden am Steinernen Meer, Austria. Managing director: Felix Trauner. Commercial register number FN 674111 s. Telephone +43 676 5423969, e-mail info@orionquant.com.

We decide on the purposes and means of the processing described here. It concerns the OrionQuant Backtesting Engine as a desktop and browser application and the website engine.orionquant.com with its waitlist, documentation and tools. The website orionquant.com is a different offering with its own privacy policy.

We have not appointed a data protection officer and are not required to do so. Please send data protection enquiries to info@orionquant.com.

The service is intended for persons of legal age.

2. What we process

We process the information you provide, the data that arises when the service is used, and certain information from third parties that you involve.

• Your e-mail address, a display name and a username if you set them, and a password if you create one. Sections 10 and 19.
• A profile picture and a country if you set them. Both are public. Section 19.
• Strategies that you save: source code, files, configuration, notebook, results, trades and equity curve. In addition, indicators and plugins in your library. Section 9.
• Key figures of backtests that you run on your own computer, without code, parameter values and trades, for as long as you do not switch this off. Section 22.
• Key figures of completed backtests on our servers in an internal ranking. Section 26.
• Copies of audits graded A or B, for as long as you do not object. Section 18.
• Sign-in data and sessions with IP address and user agent. Section 10.
• API keys for AI providers and data providers, in encrypted form. Section 12.
• Access tokens for a cTrader demo account, in encrypted form, if you keep the connection on our server, and the log of the orders a Live-Deployment sent. Section 30.
• What you publish in the community: forum posts, marketplace entries, ratings, shared strategies, whom you follow. Section 25.
• Your linked GitHub account. Section 20.
• What an AI application you connect to your account, such as Claude, ChatGPT, Le Chat or Cursor, fetches through that connection, and a record of each connection. Section 23.
• Subscription, purchases and billing data. Section 28.
• Information from the waitlist, including the survey. Section 24.
• Live-Deployments with source code, parameters and signals. Section 30.
• Who referred you or whom you referred, rewards and, as a partner, commissions, payouts and credit notes. Section 34.
• Server logs and security events. Sections 6 and 13.
• Crash reports from the desktop application, after you have responded to the prompt that follows the first sign-in. Section 15.
• Page statistics on engine.orionquant.com after you have agreed in the cookie banner, and a record of that response. Section 7.

We do not process your real trading or your account balances. The engine calculates against historical prices or, in the case of Live-Deployments, against a live price data stream. Access tokens for a broker demo account are stored in encrypted form on your own device and not on our servers (section 30). Card data is collected by Stripe and does not reach us.

3. Purposes and legal bases

• Providing and administering the service, your account, your plan and your purchases. Art. 6(1)(b) GDPR, performance of a contract.
• Displaying the username and display name and the content that you publish. Art. 6(1)(b) GDPR. Displaying the profile picture and country. Art. 6(1)(a) GDPR, your consent. Sections 19 and 25.
• Synchronising strategies with the GitHub repositories that you choose. Art. 6(1)(b) GDPR. Section 20.
• Handing over what an AI application you have connected fetches on your instruction, and starting the server runs you allow it to start. Art. 6(1)(b) GDPR, and for the transfer Art. 49(1)(a) GDPR. Section 23.
• Answering support requests and pre-contractual enquiries. Art. 6(1)(b) GDPR.
• Waitlist and sending the founding code. Art. 6(1)(a) GDPR, your consent. Section 24.
• Understanding and improving the product on the basis of the key figures of local backtests, the internal ranking of server runs and the copies of audits graded A or B. Art. 6(1)(f) GDPR, our legitimate interest. Sections 18, 22 and 26.
• Security of the service: sessions, sign-in history, audit log, rate limiting, bot check, investigation of misuse, protection of the free trial. Art. 6(1)(f) GDPR, our legitimate interest in a service that is not broken into and not exploited.
• Moderating the community and handling reports. Art. 6(1)(f) GDPR and, to the extent that Regulation (EU) 2022/2065 (Digital Services Act) requires it, Art. 6(1)(c) GDPR. Section 25.
• Account mail that helps you with onboarding and with continued use, and offers of our own similar services to customers. Art. 6(1)(f) GDPR and section 174(4) TKG 2021 (Austrian Telecommunications Act 2021). Section 21.
• Newsletter, crash reports and page statistics. Art. 6(1)(a) GDPR, your consent. Nothing is sent before you consent.
• AI requests through our server to DeepSeek and OpenRouter. Art. 49(1)(a) GDPR, your explicit consent. Sections 5 and 12.
• Proof of your consents. Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR.
• Automatic updating of the desktop application, invitations to teams, internal notes and blocks. Art. 6(1)(f) GDPR. Sections 27, 31 and 32.
• Records under tax and commercial law. Art. 6(1)(c) GDPR.

An e-mail address is required for an account because you sign in with it. Without it we cannot perform the contract. For a paid plan and for the free trial, a name, a billing address and a means of payment are also required, which you enter at Stripe. Without them, neither a paid contract nor a free trial comes into being. Everything above that is based on consent is voluntary, and the product works without restriction if you leave it out.

4. Recipients

Processors. We have agreements with them under Art. 28 GDPR.

• Hetzner Online GmbH, Germany. Hosting and database in the data centre in Helsinki, Finland. Your account and your content are stored there. What is held by the other recipients is stated under the respective recipient.
• Cloudflare. Delivery of market data, program packages and installers via data.orionquant.com, storage of the audit copies under section 18 in the EU jurisdiction, forwarding of the page statistics via relay.orionquant.com, and the Turnstile bot check for sign-in in the browser. Cloudflare processes the data from Turnstile as a controller in its own right in order to improve its bot detection. Sections 7, 10 and 27.
• Resend. Sending sign-in codes, password reset links, team invitations, the confirmation and receipt for the waitlist, the welcome mail and the mandatory notices about changes to the Terms and to this Policy.
• Brevo (Sendinblue SAS, Paris, France). Account mail after the welcome mail, the newsletter and the waitlist list. Section 21.
• Stripe. Payment processing, invoices and tax calculation. Section 28.
• PostHog, EU cloud in Frankfurt. Crash reports from the desktop application and page statistics on engine.orionquant.com, in each case only with your consent. Sections 7 and 15.
• Google. The documentation assistant, limited to the question asked and the documentation page currently open. Section 12.
• Migadu. The mailboxes at orionquant.com, meaning the messages that you send us by e-mail.

Independent recipients. They are not processors and process the data under their own terms.

• Google and GitHub, if you sign in through them. Section 11.
• GitHub, Inc., USA, for what you transfer to your repositories. Section 20.
• The AI providers OpenAI, Anthropic, Google AI Studio, DeepSeek and OpenRouter, if you use the strategy assistant with your key through our server. Section 12.
• The provider of an AI application you connect to your account, for example Anthropic for Claude, OpenAI for ChatGPT, Mistral AI for Le Chat, Google for Gemini, Microsoft for GitHub Copilot or Anysphere for Cursor. It receives only what section 23 describes.
• Spotware Systems (cTrader), if you connect a demo account. Section 30.
• Stripe, to the extent that it processes payments as a controller in its own right, for example for fraud prevention and for its own legal obligations.
• Stripe Connect for payouts to partners. Stripe collects the identity and bank account details itself. Section 34.
• Your company's identity provider when you sign in through single sign-on. Section 32.
• Our tax adviser for invoice and accounting data, including the credit notes to partners (section 34).

Within a team, owners and administrators see certain information about the members (section 32). What you publish is seen by other users and, in part, by anyone (sections 19 and 25).

Nothing goes to advertisers or data brokers.

5. Transfers to countries outside the EU

The database with your account and your content is held by Hetzner in Finland, and the audit copies under section 18 are held by Cloudflare in the EU. With Cloudflare, Stripe, Google, PostHog, Resend and GitHub, data can reach the USA.

To the extent that the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, and for all other cases, the standard contractual clauses of the European Commission apply (Art. 46(2)(c) GDPR), which are included in the agreement with the respective recipient. You can obtain a copy from info@orionquant.com.

You trigger four transfers yourself:

• AI requests through our server to OpenAI, Anthropic or Google AI Studio in the USA. If the provider is certified under the EU-US Data Privacy Framework, the transfer is based on Art. 45 GDPR. Otherwise it is based on Art. 49(1)(b) GDPR, because it is necessary in order to carry out what you request with your own key.
• AI requests through our server to DeepSeek (China) or OpenRouter (country depending on the model chosen). Before the first such request, the application asks once for your explicit consent under Art. 49(1)(a) GDPR. These countries may not have a level of data protection equivalent to that of the EU, and you may not be able to enforce your rights there. You can withdraw your consent in the same place. Our server then rejects these providers.
• Transfer of a strategy to GitHub in the USA. It is based on Art. 45 GDPR to the extent that GitHub is certified under the EU-US Data Privacy Framework, and otherwise on Art. 49(1)(b) GDPR. Section 20.
• Connected AI applications. If the provider of a connected application is based outside the EU or processes data there, in the USA for example, what it fetches goes there because you ask for it. The consent screen asks on every connection for your explicit consent under Art. 49(1)(a) GDPR. Section 23.

6. Retention and deletion

We store personal data only for as long as the purpose requires or the law demands.

You can request the deletion of your data at any time. We delete it unless a legal obligation prevents this.

7. Cookies and local storage

engine.orionquant.com sets technically necessary cookies for sign-in and your session, for protection against misuse by other sites, and for access to the browser application through the waitlist. They last no more than 10 hours, and the cookie for access through the waitlist up to 180 days.

For the page statistics, PostHog sets a further cookie and entries in the local storage of your browser, and does so only if you agree in the cookie banner. Nothing is loaded for this before you respond. You can change your response via "Cookie settings" in the footer of every page. The statistics pass through our address relay.orionquant.com to PostHog in Frankfurt. IP addresses are not stored there, and session recording, automatic click capture, heatmaps and surveys are switched off.

We store your response in the cookie banner with a random identifier, the version of the banner, the language and the time, without the IP address or the user agent. We use this to prove consent (Art. 7(1) GDPR). The legal basis is Art. 6(1)(f) GDPR.

When you request a sign-in code in the browser, the page loads the Turnstile bot check from Cloudflare (challenges.cloudflare.com). It is needed to protect sign-in against automated requests. In the process, Cloudflare receives your IP address and technical characteristics of your browser. It processes them for the bot check on our behalf and, as a controller in its own right, to improve its bot detection.

The browser application stores working data in the local storage of your browser (section 29). There are no advertising cookies.

The Cookie Policy describes the cookies by kind, purpose and duration and names the entries in local storage. The desktop application does not set any cookies.

8. Your rights

You have the right of access to your data, to rectification, to erasure, to restriction of processing and to receive your data in a commonly used format. You can withdraw a consent at any time. Withdrawal of consent takes effect from that time and does not make earlier processing unlawful.

Right to object (Art. 21 GDPR). To the extent that we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation. We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object at any time, without giving reasons, to the use of your data for direct marketing, for example for the mail under section 21. Write to info@orionquant.com or use the switches in the settings under Privacy.

To exercise your rights, write to info@orionquant.com. We reply within one month. On request, we compile a copy of your data and an export of your strategies and results in a machine-readable format. You can also see much of this directly in the account: profile, sessions and devices, sign-in history, linked accounts, strategies and results. Access also covers internal notes on your account (section 31).

You can lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority at your place of residence or work.

We do not make automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR. The following checks run automatically: an exhausted allowance refuses an action, the check under section 16 can refuse a free trial, the name check can refuse a username, and too many failed attempts temporarily block sign-in. For account mail, we group accounts by plan, subscription status, usage and last sign-in (section 21). To the extent that this serves direct marketing, your right to object applies to it as well. In each of these cases you can write to us, and a member of staff reviews the case.

9. Strategies, source code and results

Signed-in users can store strategies and results on our servers: source code, files, block diagram, notebook, configuration, key figures, trades and equity curve, and in addition indicators and plugins in the library. For a run on our servers, we also store the configuration of the run, which can contain the code, and the economic calendar that your application loaded for it. The legal basis is Art. 6(1)(b) GDPR, because the feature does not exist without this data.

Staff with the relevant role can read strategy source code for support, for reviewing published strategies, for investigating misuse and for the review under section 18. Every access is logged. This is section 19 of the Terms.

You can also use the desktop application without signing in. The strategies are then stored locally, and the source code does not reach us.

To bill the allowances, we count the server minutes, audits and AI tokens used per account, and for AI requests we record the provider and model. Art. 6(1)(b) GDPR.

10. Sign-in and sessions

Sign-in by e-mail. We process your e-mail address and a one-time code with a link, both valid for 15 minutes. The code is stored only as a hash. The mail with the code states the IP address, user agent and time of the request so that you can recognise a request you did not make.

Password. If you create a password, we store only a hash of it (scrypt). You set a password via a link that we mail to you and that is valid for 60 minutes. After ten incorrect passwords, sign-in with a password is blocked for that e-mail address for 15 minutes. For this purpose we store the address for one day, even if no account exists for it, so that the block does not reveal whether an account exists.

Two-factor sign-in. If you switch it on, we store the TOTP secret in encrypted form and your recovery codes as hashes.

Sessions. For every sign-in we store a session with device name, IP address, user agent and times. In the account settings you can see your sessions and devices and end them. No more than ten sessions are possible at the same time.

Sign-in history. We log sign-in attempts with time and outcome and show them to you in the account settings.

Bot check and rate limiting. For sign-in in the browser, Cloudflare Turnstile checks whether the request comes from a human (section 7). For rate limiting, we count requests per IP address, e-mail address and account.

The legal basis is Art. 6(1)(b) GDPR for sign-in itself, and Art. 6(1)(f) GDPR, our legitimate interest in the security of the accounts, for the history, block, bot check and rate limiting.

11. Linked accounts

When you sign in through Google or GitHub, we store an e-mail address, a display name and an identifier from what the provider transmits. We do not store other information from your profile there, such as a profile picture. We do not receive a password or permanent access to the account there.

The name that the provider transmits becomes your display name. It is visible to others as long as you have not set a username (section 19).

Linking GitHub for synchronising strategies is a separate step (section 20). Sign-in through your company's identity provider is described in section 32. You can remove a link in the account settings.

12. Your own API keys and the assistants

Keys. You can store your own API keys for AI providers and for data providers, for example for Databento. On your device they are stored in encrypted form. If you are signed in, we also store each key entered in your account, encrypted with AES-256-GCM, so that it is available on your other devices and in the browser application. Only the last four characters are displayed. If a key from your account is missing on one of your devices, the desktop application downloads it automatically after sign-in and stores it there in encrypted form. We log each such retrieval.

Strategy assistant. We do not supply a key or a preset provider for it. You decide with your key which provider your input reaches. Your input usually contains your strategy source code, the conversation history and information about the run, because that is what you ask about. It leaves your device by one of two routes:

• Directly from the desktop application, if the key is on the device. The request goes from your computer to the provider and does not touch our servers. With a local model such as Ollama or LM Studio, the input does not leave your device.
• Through our server, if the key is stored only in the account, for example in the browser application. Our server decrypts the key and makes the request on your behalf. The destination never comes from the request. It comes from a fixed list in our code.

On the route through our server, we store neither your input nor the response. The audit log records the provider, the model and a token count, and the request counts against the AI allowance of your plan.

Our server relays to OpenAI, Anthropic, Google AI Studio, DeepSeek and OpenRouter. For DeepSeek and OpenRouter, the application obtains your explicit consent beforehand (section 5). Where your input goes at the provider, how long it stays there and whether it is used for training is determined by the provider. For strategy source code, it is worth reading this before you choose.

The application stores the conversation history with the assistant only on your device (section 29).

Documentation assistant. It is the only AI feature with a key from us. When you ask it a question, the application sends your question and the title and content of the documentation page currently open from your device directly to Google (Gemini). Google sees your IP address in the process. Google processes the question and the page as our processor and, under its terms for paid services, does not use them to improve its products. The processing can take place in the USA (section 5). The assistant never sees your strategies. The legal basis is Art. 6(1)(b) GDPR.

Connected AI applications. Connecting an AI application to your account (section 23) is a separate route. There the application calls us, with its own model and under your agreement with its provider. No key of yours is held by us for it.

13. Audit log

We log security-relevant events: sign-ins, changes to account and plan, staff access to strategy source code, audit copies and the internal ranking, administrative actions, relayed AI requests (provider, model, token count) and transfers to GitHub (repository, branch, commit). Connections of AI applications are logged with each approval and refusal, their start and end with the reason, and signs that a token was used twice (section 23). In addition, we log the display of a stored key, consents given and withdrawn, mandatory notices sent and exports by staff. Entries can contain e-mail addresses, including those of persons without an account, and entries about triggered rate limiting can contain an IP address.

The log serves as evidence and for the investigation of misuse. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the security of the service. The periods are set out in section 6.

Separately, our web server writes an access log with IP address, time and the address requested. It serves troubleshooting and defence against attacks (Art. 6(1)(f) GDPR) and is deleted after the period stated in section 6.

14. Deleting your account

You can delete your account in the account settings. Deletion takes effect immediately. Before that, you confirm your identity with your two-factor code or your password.

The following are deleted:

• sign-in data, sessions, linked accounts and stored keys,
• username, display name, profile picture and country,
• strategies, results, library, Live-Deployments, leaderboard entries, the internal ranking and the audit copies,
• your forum posts and the topics you opened, including other users' replies,
• your marketplace entries, including their installations and ratings, your shared strategies, your notifications and whom you follow,
• a team of which you are the owner, and your memberships,
• your contact at Brevo with all lists,
• the GitHub link. If the OrionQuant GitHub App is installed in your own GitHub account, it is uninstalled there.
• the access of connected AI applications. They lose it immediately (section 23).

A current subscription is ended immediately in the process, and unused packs and a perpetual licence are forfeited.

The following are not deleted:

• invoices and accounting records, including the customer record at Stripe, for the statutory retention period,
• entries in the audit log for the periods stated in section 6, including the entry recording the deletion, which serves as evidence. In that entry and in older entries we replace your e-mail address with a keyed hash,
• the hash under section 16,
• founding seat and founding code, and reports that you submitted, in each case without any link to your account,
• the released username for 30 days,
• your entry on the waitlist until the period stated in section 6 expires,
• sign-in codes, sign-in records, rate limiting counters, blocks after incorrect passwords and server logs, which can contain your e-mail address or IP address, until the periods stated in section 6 expire.

We do not use this data for anything else, and we delete it when the periods expire.

You can also delete only your content. This removes strategies, runs, results, leaderboard entries, the internal ranking and the audit copies. Marketplace entries and forum posts remain in place and can be removed individually.

15. Crash reports and the prompt in the desktop application

The desktop application sends crash reports only after you have responded to a prompt that appears after the first sign-in. The prompt shows three switches, which you can set individually and change at any time in the settings under Privacy: crash reports, usage statistics and marketing. Crash reports and usage statistics are switched on there as a suggestion, and marketing is switched off. The prompt has two buttons of equal weight: one sends nothing, the other sends what is switched on. If you close the application without responding, nothing is sent, and the prompt appears again at the next start.

At present the application collects crash reports only: the error message with stack trace, the version of the application and the operating system. They do not contain strategy source code, results or file contents. Paths from your user directory are removed before sending. No events are currently collected for usage statistics or marketing. Should we change this, we will describe it here beforehand.

The reports go to PostHog in Frankfurt under a random identifier that is not linked to your account. The IP address is not stored.

The legal basis is your consent, Art. 6(1)(a) GDPR and section 165(3) TKG 2021. Withdrawal of consent is the same switch and takes effect immediately for everything that would be sent afterwards.

Sections 9, 12, 18, 21, 22 and 27 describe what the application sends to us independently of this prompt.

16. Protection against repeated free trials

The free trial corresponds to several days of a paid plan, and a new e-mail address costs nothing. The free trial is therefore limited by the means of payment.

When a free trial starts, Stripe derives a fingerprint from the means of payment that is the same for the same card on every account. We do not store this fingerprint. We store an HMAC of it under a secret known only to our server, together with the type of the means of payment. A copy of this table alone does not lead to any card.

Prepaid cards and individual card series can be rejected for the free trial.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in the free trial not being exploited repeatedly. We have weighed this against your interests. That is why we store a keyed hash instead of the fingerprint, and why it expires.

• The link between the hash and the account is removed after 12 months. It exists so that we can answer you if you ask why a free trial was refused.
• The entry itself is deleted after 24 months.

Deleting your account does not delete this entry. It only removes the link to the account. Otherwise the limit could be circumvented by deleting the account and registering again. The entry remains necessary for this purpose (Art. 17(1)(a) GDPR), and our interest in protection against misuse prevails for the duration of the periods stated (Art. 21(1) GDPR). If you object, we review your case individually.

17. Changes to this Policy

We update this Policy when the legal situation, the technology or the product changes. The current version is available at engine.orionquant.com/privacy, with the date of the last change. We inform account holders of material changes in advance by e-mail.

18. Audits graded A or B for review

If you audit a backtest while signed in and the audit awards the grade A or B, we store a copy: all key figures of the audit, the configuration of the run, the version of the engine, the trades, the source code and the name of the strategy, together with the account and the time. Audits graded C, D or F are not transmitted, and nothing is transmitted without sign-in.

Our staff review these copies in order to assess and improve the audit and the product. They read them in a read-only view, and every opening of source code is recorded in the audit log (section 13). The legal basis is our legitimate interest in the quality of the audit, Art. 6(1)(f) GDPR.

The copies are held in private storage at Cloudflare (R2) in the EU jurisdiction, which only our server can reach. The copy itself does not name an account. Which account produced it is recorded in our database in Finland.

They remain stored until you delete your account or your stored content, or until you object. You can object at any time in the settings under Privacy or by e-mail to info@orionquant.com (Art. 21 GDPR). An objection ends the review of your audits and deletes the existing copies.

19. Public profile: username, display name, profile picture and country

Username and display name. The username is the name under which others see you on the leaderboard, in the forum, in profiles and on the marketplace. If you have not set one, your display name appears there. That can be the name that Google or GitHub transmitted when you signed in. Set a username if you do not want your real name to appear. When you choose a name, we check it automatically against lists of names that are not permitted.

Profile picture and country. Both are voluntary. Before uploading, the application reduces the picture to 256 by 256 pixels, which also removes embedded information such as the location where it was taken. We store the picture at no more than 1 MB and the country as a country code. The address of the picture is calculated from its content and does not contain an account ID.

Who sees what.

• Anyone, including without signing in: your leaderboard entries with username or display name, profile picture, country, verified mark, number of followers, and the name, language, instrument, timeframe, period, key figures and equity curve of the published strategy. The profile picture can be retrieved via its address.
• Signed-in users: your profile with username, joining date, profile picture, country, verified mark, follower counts and follower lists, your marketplace entries, up to ten leaderboard entries, the number of your forum posts and excerpts from the last five.
• No one except us: your e-mail address. We never show it to other users. Section 32 applies to teams.

The leaderboard shows only what you expressly publish. Private strategies never appear there.

The legal basis is Art. 6(1)(b) GDPR for the name in the community features that you use, and your consent under Art. 6(1)(a) GDPR for the profile picture and country. You withdraw your consent by removing the information.

You can remove the picture and country at any time in the settings under Profile. The picture is then deleted from our servers immediately. We cannot reach copies in the cache of other people's browsers. Do not upload pictures of other persons without their consent.

20. GitHub and the notebook

Linking with GitHub is voluntary. You use it to synchronise strategies between the application and repositories that you choose on GitHub: you authorise the OrionQuant GitHub App, install it in your GitHub account and specify there which repositories it may access.

We store the number and username of your GitHub account, the number of the installation, the name and type of the account in which it is installed, whether it covers all or selected repositories, and the time of linking. We do not store a GitHub password or a token. To recognise your GitHub account, we use a token from GitHub once when linking and revoke it immediately. Every synchronisation uses a token that GitHub issues to the app for one hour and one repository and that we do not keep.

A transfer sends the files of the strategy, its notebook if you tick the box, and a small description file. They pass through our servers to GitHub, and we do not keep them. The same applies in the opposite direction when retrieving from GitHub. Commits carry the sender address that GitHub provides for your account and not your e-mail address. The audit log records that a transfer took place, to which repository and branch, and the commit, but no content.

GitHub, Inc. is based in the USA. What you transfer is stored there in your repository, under GitHub's terms and privacy statement. Anyone can read a public repository. The legal basis is Art. 6(1)(b) GDPR, and section 5 applies to the transfer.

The notebook of a strategy belongs to the strategy. It is not part of a run and is not sent with a run. It reaches our servers when you store the strategy in the account, transfer it to GitHub or publish it with a marketplace entry. On the marketplace it is as visible as the entry.

You can disconnect the link at any time in the settings under Security. We then uninstall the app from your GitHub account and delete the link. Your repositories and everything that was transferred remain on GitHub.

21. Account mail and newsletter through Brevo

When you create an account, we add your e-mail address to our account list at Brevo. Added to this are your account ID, your name if you have given one, your plan, the status of your subscription (free trial, active, cancelled, payment outstanding), the renewal date, the share of server minutes used, the language of your application, the day of registration, the end of the free trial, the day of your last sign-in and the day of your first completed backtest. If you give a reason when cancelling, it also goes to Brevo.

The day of the first completed backtest is the only thing the application reports about a run for this purpose, once per device. Nothing about the strategy, market or result is sent in the process.

Brevo uses this to send three kinds of mail:

• Mail about the contract. Reminder before the end of the free trial, notice before the renewal of an annual subscription, notice of an exhausted allowance, notices about payment. Art. 6(1)(b) GDPR. You receive this mail in every case. It does not contain advertising.
• Onboarding mail and offers. A short series in the first two weeks, a reminder after 30 days without a sign-in, a question about the reason after a cancellation and, later, an offer to return. Art. 6(1)(f) GDPR and section 174(4) TKG 2021. You can object via the link in each of these mails and by e-mail to info@orionquant.com (Art. 21 GDPR).
• Newsletter. Only if you subscribe to it, in the settings or with the checkbox on registration, and confirm your address (double opt-in). It is held at Brevo on a separate list together with the language. Art. 6(1)(a) GDPR. You withdraw your consent in the settings or via the link in every issue.

Brevo uses a small image and the links to measure whether a mail was opened and what was clicked. This shows us which mails help. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. You can object to this at any time by e-mail to info@orionquant.com. A mail program that does not load images does not report an open.

We send sign-in codes, the welcome mail and notices about changes to the Terms and to this Policy through Resend (section 4).

If you delete the account, we delete your contact at Brevo completely, with all information and from every list.

22. Key figures of backtests on your own computer

If a backtest in the desktop application ends with a positive result, meaning a return per month above 0%, and you are signed in, the application sends its key figures to us: return, return per month, drawdown, number of trades, period, instrument, timeframe, accuracy level, name and language of the strategy and a technical run ID. It does not send code, parameter values or trades. Nothing is sent without sign-in.

We use these key figures to understand how the product is used and to improve it. They are not published. They are stored with the account and the time in our database in Finland, and only our staff see them. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR.

You can switch this off at any time in the settings under Privacy or object by e-mail to info@orionquant.com (Art. 21 GDPR). Switching it off also deletes the key figures sent up to that point.

23. Connected AI applications

Connecting. You can connect an AI application to your account through "AI apps in the cloud", for example Claude by Anthropic, ChatGPT by OpenAI, Le Chat by Mistral AI, Gemini by Google, GitHub Copilot in Visual Studio Code by Microsoft, Cursor by Anysphere, or another application that supports the Model Context Protocol. You do this yourself in that application and approve it on a consent screen of ours. The screen shows the application, whether we have verified it, the exact address it sends you back to and what it asks for. An application we have not verified can connect as well. The consent screen then warns you, and you should only approve if you started the connection yourself and know the application. Nothing is connected without your approval. Staff accounts cannot connect.

What the application fetches. On your instruction the application fetches what its tools return: your account's strategies stored on our servers, including their source code, the indicators, plugins and custom blocks in your account library, your server runs and their results, your plan, usage and limits, the public leaderboard, the documentation and the indicator catalogue. If you allowed it on the consent screen, it can also start and cancel server runs. Runs it starts use your server minutes. It cannot change or delete strategies or settings. It does not receive your e-mail address, nor anything that other users keep private. The leaderboard entries it can read are public anyway.

Where it goes. What the application fetches goes to its provider and is processed there under that provider's terms and privacy policy, not ours. That provider may be based or process data outside the EU, in the USA for example. Whether it keeps the data, for how long and whether it uses it for training is decided by the provider and your agreement with it. For strategy source code it is worth reading this before you connect.

Legal basis. For handing over what you ask for, it is Art. 6(1)(b) GDPR, because that is the service you requested. Because the provider may be based in a country without an adequacy decision, the consent screen asks on every connection for your explicit consent to the transfer under Art. 49(1)(a) GDPR (section 5). We record that consent with each connection, together with the date and the version of this policy. You withdraw it by revoking the connection in the application under Settings, Advanced, Connect AI apps, using "Manage". The connected application loses access with its next request. What it fetched before stays with its provider.

What we store. For each connection we store

• the application's name as it registered and the host it sends you back to,
• what you allowed: the scopes, whether it may start runs, and a monthly minute ceiling if you set one,
• a hash of its refresh token, never the token itself,
• when the connection was created and last used, with the IP address and user agent of its last use,
• when you consented and to which version of this policy,
• how the approving session was signed in, for example with an e-mail code or through single sign-on, so that a team's single sign-on rule can apply,
• when and why the connection ended.

We need this to show you your connections, to end them and to notice if someone else uses a token. The legal basis is Art. 6(1)(b) GDPR, and for the IP address, the user agent and the token records our legitimate interest in the security of your account under Art. 6(1)(f) GDPR.

Duration. A connection lasts until you revoke it, 90 days at most, and ends sooner after 30 days without use. We keep its record for 30 days after it ends, to investigate misuse, and then delete it. A server run started through a connection records which connection started it for as long as the run itself is kept (section 6).

Security. When a new connection is created, we send you an e-mail so that a connection you did not create yourself does not go unnoticed. The audit log records connections (section 13). We can switch the feature off or end connections for the security of the service (section 30 of the Terms).

24. Waitlist

If you join the waitlist on engine.orionquant.com, we process your e-mail address, your name, your language and the origin of the entry. We send a mail with which you confirm the address (double opt-in).

After that, you can voluntarily answer a survey: how you heard about us, your trading experience and your level of knowledge, whether and in which languages you have programmed strategies, which platforms and which AI tools you use, which markets you trade and what you would like from the product. You can reserve a username in the process.

We use this information to inform you about the launch, to send you your founding code, to give your browser early access (section 7), to give you the longer free trial for the waitlist when you register with the same address, and to align the product with what the answers show. Our staff see the e-mail address, name and survey answers. For this purpose we keep a separate list at Brevo with e-mail address, name and founding code.

The legal basis is your consent, Art. 6(1)(a) GDPR. You withdraw it via the unsubscribe link in every mail or by e-mail to info@orionquant.com. After you unsubscribe, we send you nothing further. We delete the entry, including the survey, no later than 12 months after the public launch of the product, or immediately at your request. We keep evaluations of the survey only in a form that no longer allows any person to be identified.

25. Community: forum, marketplace, sharing, following and reports

What we store. Forum topics and posts, including earlier versions after an edit and your votes. Marketplace entries with title, description, tags, source code, files, parameters and, if you tick the box, the notebook. Installations and ratings. Shared strategies as a snapshot of the source code with your note. Whom you follow and what you watch. Notifications in the application, which can contain names and titles.

Who sees it. The forum, marketplace and profiles are visible to signed-in users. The source code of a marketplace entry is visible only to you and to those who have installed it. A shared strategy is visible only to the person to whom you send it. The leaderboard is public (section 19).

Deletion. If you delete one of your own forum posts, it is hidden from others. The text and earlier versions remain stored with us until you delete the account, so that moderation decisions remain traceable. If you withdraw a marketplace entry or a shared strategy, it is no longer visible to others but likewise remains stored with us until you delete the account. Copies that others have already downloaded to their device remain with them. Section 14 sets out what happens when an account is deleted.

Reports and moderation. If you report content, we store your report with the reason and comment. Our staff see who made the report. As a rule, we do not disclose your identity to the person reported. Staff can hide, lock or remove content and store the reason for doing so. The rules are set out in section 36 of the Terms.

The legal basis is Art. 6(1)(b) GDPR for the community features and Art. 6(1)(f) and (c) GDPR for reports and moderation.

26. Internal ranking of runs on our servers

From every completed backtest on our servers that does not end with a loss, we take the key figures, the name of the strategy and your account into an internal ranking. This also applies to strategies that you keep private. The key figures under section 22 flow into the same ranking.

Only our staff see the ranking, with your e-mail address and your name. Every time it is opened, this is recorded in the audit log. It is not published and not passed on. It does not contain the source code.

We use it to understand which kinds of strategies work on the engine and to improve the engine and the audit. The legal basis is Art. 6(1)(f) GDPR.

You can object at any time by e-mail to info@orionquant.com (Art. 21 GDPR). We then delete your entries and do not add any new ones. They are also deleted when you delete your stored content or your account.

27. Licence check, market data and updates

Licence check. At start, after sleep mode and before expiry, the desktop application asks our servers which plan your account has. For this it sends the session token and the label "Desktop App". It does not send a device identifier or a computer name. The response is a signed licence token with account ID, e-mail address and plan, which is stored in encrypted form on your device. Art. 6(1)(b) GDPR.

Market data. The application loads historical market data from our archive at data.orionquant.com, which Cloudflare operates for us. For each retrieval, the application identifies itself with the licence token. In the process, Cloudflare processes your IP address, the account ID and e-mail address from the token, and the plan, instrument and period. Art. 6(1)(b) GDPR.

Updates. 30 seconds after start and every six hours after that, the application checks at data.orionquant.com whether there is a new version, and downloads it. This happens without a token and without any link to your account. Cloudflare sees your IP address in the process. You can switch off automatic updating. Art. 6(1)(f) GDPR, our interest in up-to-date and secure software.

28. Payments

Payments are processed by Stripe. When you buy something or start a free trial, we pass Stripe your e-mail address, your account ID and information about the purchase (plan, billing period, founding price, promo code, pack). You enter your name, billing address and means of payment on Stripe's page. Card data does not reach us.

We store the identifiers of the customer and of the subscription at Stripe, the status, the dates of the free trial and of the payments, credits from packs, and a register of the invoices with number, product, amounts and period.

The legal basis is Art. 6(1)(b) GDPR for processing the payment and Art. 6(1)(c) GDPR for retention under tax and commercial law. Stripe processes part of the data as a controller in its own right, for example for fraud prevention. Stripe's privacy policy applies to that.

29. What stays on your device, and retrievals from third parties from your device

Local data. The application stores the following on your device or, in the browser application, in the storage of your browser: session and licence tokens, API keys and access tokens for the broker demo account (encrypted in the desktop application), settings, your local strategy library with code, runs and audits, presets, the last 40 messages of the conversation with the assistant, downloaded market data and the e-mail address last used to sign in. This data reaches us only in the cases named in this Policy. "Reset this device" in the settings deletes the application's entries in local storage. Files of the application such as tokens, keys and downloaded market data are not affected by this. On Windows, the uninstaller asks whether data and settings should be removed.

MCP. If you switch on the MCP server, the application places on your device a copy of your stored strategies and of all your runs, which your own MCP client can read. The server runs locally and does not open a network connection. What your MCP client does with what it reads is determined by its provider.

Retrievals from third parties. Some features retrieve data from third parties directly from your device. Our servers are not involved in this. In the process, the third party sees your IP address and, where necessary, your key with that third party.

• The economic calendar from ForexFactory, if a strategy uses news windows.
• Data sources that you switch on in a strategy: Alpha Vantage, Twelve Data, Finnhub, FRED, Econdb, Yahoo Finance and your own addresses. This feature is off by default.
• Databento for order book data with your own key. Databento bills you.
• The AI provider, if the key is on the device, and Google for the documentation assistant (section 12).
• Your browser for Stripe, for sign-in through Google, GitHub or your company, for the GitHub App and for cTrader.

The privacy policies of the respective providers apply to these retrievals.

30. Live-Deployments and broker connection

Live-Deployments. For a Live-Deployment on our servers, we store the source code, files and parameters of the strategy, the signals generated and, if you assign a broker demo account, its account ID. The code runs in an isolated environment without network access. Art. 6(1)(b) GDPR.

Broker connection. If you connect a cTrader demo account, you sign in to cTrader in your browser. Our server exchanges the code that cTrader returns for access tokens at Spotware and passes them on to your application. They are stored in encrypted form on your device, together with the account number and account type. Only demo accounts are permitted. If you disconnect, the tokens on your device are deleted. Art. 6(1)(b) GDPR.

Orders from our servers. If you switch on "Keep this connection on our server", your application passes these tokens to our server. It keeps them in encrypted form, together with the account ID, the account number and the broker's name of each demo account they open; live accounts are not kept. A Live-Deployment that you arm with one of these accounts sends its orders to it through Spotware's Open API, and we keep a log of every order sent, closed, skipped or refused with the Live-Deployment. If you switch it off, disconnect or delete your account, we delete the tokens. Art. 6(1)(b) GDPR.

Spotware and the broker process your data under their own terms.

31. Support, staff access and blocks

When you write to us, we process your message and your contact details in order to reply. Art. 6(1)(b) GDPR.

In the administration interface, staff with the relevant role see your account with e-mail address, name, username, linked sign-in providers, plan, customer ID at Stripe, credits and your most recent runs with configuration but without code. They see source code and the internal ranking only through logged access. For audit copies, every opening of source code is logged (sections 9, 18 and 26). Staff can export a list of all accounts with name, username and e-mail address. This is also logged.

Staff can create an internal note on an account. If we block an account, we store the internal reason and the message that you see. A block ends all sessions. Staff can also mark an account as verified, change a username, add credits and send a password reset link. These actions are recorded in the audit log.

The legal basis is Art. 6(1)(b) GDPR for operation and Art. 6(1)(f) GDPR for notes and blocks. Notes and reasons for blocks are part of the information provided under section 8.

32. Teams and Enterprise

What the team sees. Owners and administrators of a team see the e-mail address, role, status and joining date of each member. This does not let them see your strategies and results.

Invitations. If a team invites a person, we store that person's e-mail address, even if they do not yet have an account, and send them an invitation. Removed members remain recorded with the status "removed" until the team is deleted.

Single sign-on. A team can set up sign-in through its own identity provider. For this we store the provider's address and credentials, in encrypted form, and the team's domains. On sign-in we receive an e-mail address, a name and an identifier from the identity provider. If a team makes sign-in through single sign-on mandatory, the other sign-in methods are closed for addresses at its domains. The account and the seat in the team are created on the first sign-in.

Roles. We are the controller for the accounts and for what this Policy describes. The company that runs a team decides on its own responsibility whom it invites, which identity provider it uses and whether it makes sign-in through that provider mandatory. To the extent that we process data on behalf of an Enterprise customer, we conclude an agreement with that customer under Art. 28 GDPR. Members should address questions about invitation and sign-in to their company.

The legal basis is Art. 6(1)(b) GDPR if you yourself are our contracting party. For members whose company is the contracting party, and for invitees without an account, it is Art. 6(1)(f) GDPR, the interest in providing the team features.

33. Security

Connections to our servers are encrypted (TLS). We store API keys, TOTP secrets and credentials for single sign-on encrypted with AES-256-GCM. We store passwords as scrypt hashes, and codes and tokens as hashes. Users' code runs on our servers in isolated environments without network access. The role of staff is checked on every request, and their access to source code is logged. Strategy source code, notebooks and community content are not additionally encrypted at application level in the database.

34. Referral and partner programme

Anyone who uses a referral link or a code is attributed to the account that shared it. For this attribution, for rewards and for commissions we process the following data.

The link. When you open an address with ?ref=, our website and the application store the code and the time of the click in your browser's local storage (oq.ref.v1, 7 days, see cookie policy section 3). When you sign up, the application sends both to our server. A code you type is sent without a time.

The attribution. We store which account referred you, the code, the route (link, typed, at checkout or through the waitlist), the time and a running number. An account has at most one referral, and it is final.

What the referring account sees. It sees only the running number, the country, the plan, the billing period, the net amount of your payments and the state of its reward or commission. It does not see your name, your e-mail address, your username or how you use the software.

Protection against referring oneself. To recognise whether someone refers themselves, we compare the e-mail addresses of both accounts without additions such as “+name”, the IP address of your sign up with the IP addresses of the referring account's sessions and, at your first payment, the fingerprint of your payment method that Stripe supplies with that of the referring account. We store the IP address and the fingerprint with the referral only as an HMAC under a secret that only our server knows. Nobody gets to see them. If we recognise a self-referral, there is no reward, and we note the reason (e-mail, IP address or payment method).

Rewards. The referring account receives bonus days once your first payment has stood for 14 days without a refund or a chargeback. If it pays itself, we credit the value of the days to its balance at Stripe; otherwise it receives the days as a gift. At 3, 10 and 25 such referrals it can choose one pack each. You receive a trial of 14 instead of 7 days and, through a partner code, a discount that Stripe applies as a coupon.

Partners. Anyone who wants to become a partner applies with the details in the form: platforms with address and reach, language, country and the acceptance of the partner terms. A staff member decides on every application, and we store the decision with its reason. For the commissions we store the name and address, the tax status, where applicable the VAT identification number or tax number and the country of taxation, the commission per paid invoice of the attributed accounts, the payouts and the credit notes. Payouts are made through Stripe Connect Express. Stripe collects the identity and bank account details itself and under its own responsibility. We store only the identifier of the Connect account and its status. A month's credit notes go to our tax adviser with an accounting file.

Legal bases. Rewards, commissions and payouts are based on the contract with the referring account or the partner (Art. 6(1)(b) GDPR). The attribution of your account and the details the referring account sees are based on our legitimate interest in running the programme (Art. 6(1)(f) GDPR). That is why the referring account sees nothing that identifies you. The protection against self-referral is based on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). We keep credit notes and accounting records because the law requires it (Art. 6(1)(c) GDPR, § 132 BAO).

Storage period.

• The code in local storage: 7 days.
• The attribution with the two HMAC values: until your account is deleted. If the referring account deletes itself, only the link to it is removed.
• Partner application, code and rewards: until the account is deleted.
• Credit notes, payouts, the commissions they are based on and the details a credit note has to carry: 7 years from the end of the year of the last payout, also after the account is deleted.