Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this platform is:

2. Scope of Data Processing

Q72 is a portfolio optimisation software tool for professional wealth managers. We process the following categories of data:

• Account data: Email address, full name, professional credentials (firm name, regulatory licence number, country), and password (stored as a salted hash).
• Portfolio data: Ticker symbols, capital amounts, and risk profile selections submitted for optimisation. We do not process client names, account numbers, or personal financial data belonging to your end-clients.
• Technical and operational data: Infrastructure logs, IP addresses, browser/device information, timestamps, normalised route groups, coarse device class, page-load duration and technical error classes may be processed for security, abuse prevention, availability and reliability monitoring. On public pages, separate cookieless operational journey telemetry may also record route sequence, approximate visit duration, referring domain and campaign parameters. It uses only a random transient in-memory session identifier for the active page visit; the server stores only a one-way hash of that identifier.
• Email engagement data: Where Q72 sends a recipient-specific website or booking link, we may record that the link was used, the time of the interaction, booking-page visits, selected meeting slots, and completed bookings. The tracking URL contains an opaque token rather than the recipient's email address. These events are used for CRM follow-up and conversion measurement.
• Payment data: Billing information is processed exclusively by Stripe, Inc. Q72 does not store full payment card details.

3. Legal Basis (GDPR)

• Art. 6(1)(b) GDPR — processing necessary for the performance of the contract (platform access, subscription management).
• Art. 6(1)(c) GDPR — processing necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR — legitimate interests (platform security, fraud prevention, service improvement).
• Art. 6(1)(a) GDPR — consent, where explicitly obtained (e.g. marketing communications).

4. Third-Party Service Providers

We use the following third-party services which may process your data:

5. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), in particular in the United States. Such transfers take place on the basis of adequacy decisions by the European Commission or on the basis of appropriate safeguards (standard contractual clauses pursuant to Art. 46(2) GDPR).

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law. Account data is deleted within 30 days of account termination upon request. Certain billing and compliance records may be retained for up to 10 years in accordance with German commercial law (§ 257 HGB, § 147 AO).

7. Your Rights (GDPR Art. 15–22)

You have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time without affecting the lawfulness of prior processing

To exercise your rights, contact us at contact@q72.capital. You also have the right to lodge a complaint with the competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, www.baden-wuerttemberg.datenschutz.de.

8. Cookies

We use technically necessary cookies and session tokens required for the operation of the platform. Independently of optional analytics consent, Q72 records narrowly scoped cookieless operational and public-site journey telemetry to monitor availability, compatibility, failures and whether core public user flows work as intended. This may include normalised page paths, timestamps, approximate visit duration, coarse device class, referring domain and campaign attribution. To connect page changes within one active browser visit, Q72 uses a random transient in-memory session identifier; only a one-way hash is stored server-side. This operational layer does not use analytics cookies, Local Storage or Session Storage, and the transient identifier is recreated after a full page reload or new browser visit. It does not record form contents, keystrokes, portfolio inputs, clicks, heatmaps or replay data. We do not use tracking or advertising cookies without your prior consent. Google tags are not loaded before consent to the corresponding category. Usage analytics and Google Ads measurement can be selected separately. Interaction replays of public pages are also optional; replay data excludes keystrokes, form values and IP addresses and is kept for 48 hours. Consented analytics can include technical errors, page interactions and pseudonymous visit identifiers. Known Q72 links or supplied contact details may associate a consented visit with a CRM contact; this is not anonymous processing. Google page measurement excludes signed-in accounts and uses page paths without query strings or form data. You can change or withdraw your choices here at any time.

9. Changes to This Policy

We reserve the right to update this Privacy Policy. The current version is always available at this URL. Material changes will be communicated to registered users by email.