Privacy Policy

WatchQuant, operated by Lucca Levaggi (sole proprietor, Florida, USA), is committed to protecting your privacy globally. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding that data. This policy applies to all users of watchquant.com worldwide, including those in the European Union, California, and other jurisdictions with specific privacy protections.

1. Introduction and Scope

This Privacy Policy covers all data collected when you visit watchquant.com, create an account, subscribe to a paid plan, or otherwise interact with our platform. It applies regardless of your location. By using WatchQuant, you acknowledge and accept the practices described in this policy.

If you have questions or concerns about this policy, contact us at [email protected] before using the platform.

2. Data Controller (GDPR)

For purposes of the General Data Protection Regulation (GDPR) and applicable EU privacy law, the data controller is:

3. Information We Collect

We collect the following categories of personal information:

• Account Information: Name, email address, and profile details when you register or authenticate via Google OAuth.
• Usage Data: Pages visited, features used, actions taken on the platform, session duration, and click patterns.
• Payment Information: Billing details processed and stored by Stripe. WatchQuant does not store your full card number, CVV, or complete payment credentials on our servers.
• Watchlist and Portfolio Data: Watches you save, price alerts you set, portfolio entries, and related preferences.
• Device and Log Data: IP address, browser type and version, operating system, referral URLs, and access timestamps.
• Analytics Data: Aggregated, anonymized platform usage data collected via Vercel Analytics and Google Search Console. This data does not identify you personally.
• Affiliate Interaction Data: When you click eBay affiliate links, eBay may collect interaction data pursuant to eBay's own privacy policy. WatchQuant receives only aggregated commission data.

4. Lawful Basis for Processing (GDPR)

For users in the European Union, we process your personal data under the following lawful bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the subscription service you have requested, including account management, payment processing, and feature delivery.
• Legitimate Interests (Art. 6(1)(f)): Platform security, fraud prevention, abuse detection, and product improvement — where our interests do not override your fundamental rights.
• Consent (Art. 6(1)(a)): Analytics cookies and non-essential tracking technologies. You may withdraw consent at any time via your cookie preferences.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws including tax and accounting record-keeping requirements.

5. How We Use Your Information

• To provide, operate, maintain, and improve the WatchQuant platform
• To authenticate your account and manage your subscription
• To send transactional emails via Resend, including account confirmations, price alert notifications, and billing notices
• To process payments and manage billing via Stripe
• To analyze platform usage patterns and improve features
• To detect and prevent fraud, abuse, or security incidents
• To comply with applicable legal obligations
• Future use: if advertising is introduced, to serve relevant advertisements through advertising partners. You will be notified before this takes effect, and this policy will be updated accordingly.

6. Third-Party Data Processors

We share your data only with third-party processors necessary to operate the platform. All processors are contractually bound to handle your data securely and only as directed by WatchQuant.

• Supabase — database, authentication, and real-time data infrastructure (supabase.com/privacy)
• Stripe — payment processing and billing management (stripe.com/privacy)
• Google — OAuth authentication and Search Console analytics (policies.google.com/privacy). WatchQuant uses Google Consent Mode v2 to ensure Google tags respect your consent choices. Google advertising cookies and data collection are disabled by default and only activated with your explicit consent.
• Vercel — hosting, deployment, and edge analytics (vercel.com/legal/privacy-policy)
• Resend — transactional email delivery (resend.com/privacy)
• Cloudflare — DNS, CDN, and email routing (cloudflare.com/privacypolicy)
• eBay Partner Network — affiliate program commission tracking (eBay Privacy Centre)
• Google AdSense — advertising platform (pending activation). The AdSense script may collect anonymized usage data for ad serving purposes. Subject to Google's Privacy Policy at policies.google.com/privacy. Users can opt out via Google's ad settings at adssettings.google.com.

We do not sell your personal data to any third party.

7. International Data Transfers

WatchQuant is based in the United States. If you access our platform from the European Union, United Kingdom, or other regions with data transfer restrictions, your personal data may be transferred to and processed in the United States.

For EU users, data transfers to the US are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) where applicable and where required by our third-party processors. By using WatchQuant, you acknowledge that your data may be transferred to the United States.

If you have questions about international data transfers, contact [email protected].

8. Data Retention

• Account Data: Retained for as long as your account is active and for a reasonable period thereafter to resolve disputes or comply with legal obligations.
• Deletion Requests: Upon account deletion, personal data is removed within 30 days, except where retention is required by applicable law.
• Payment Records: Retained for 7 years for tax, accounting, and legal compliance purposes.
• Anonymized Usage Data: Aggregated, non-personally-identifiable usage data may be retained indefinitely for product analytics.

9. Your Privacy Rights

All users have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data ("right to be forgotten")
• Receive a portable copy of your data

EU users (GDPR) additionally have the right to:

• Restrict processing of your data
• Object to processing based on legitimate interests
• Withdraw consent at any time (for consent-based processing)
• Lodge a complaint with your local data protection supervisory authority

California users (CCPA/CPRA) additionally have the right to:

• Know what personal information is collected, used, shared, or sold
• Opt out of the sale of personal information (note: WatchQuant does not sell personal information)
• Non-discrimination for exercising your privacy rights
• Limit use and disclosure of sensitive personal information

To exercise any of these rights, contact [email protected]. We will respond within 30 days. For complex requests, we may require identity verification before processing.

10. Cookies

We use cookies and similar tracking technologies to maintain your session, remember preferences, and analyze platform usage. EU users will be presented with a cookie consent banner before non-essential cookies are set. For complete details on the cookies we use and how to manage them, see our Cookie Policy.

11. Security

We implement industry-standard security measures to protect your personal data, including:

• HTTPS encryption for all data in transit
• Supabase row-level security for database access controls
• Secure authentication via Google OAuth
• Regular security reviews and vulnerability assessments

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users in accordance with applicable law.

12. Children's Privacy

WatchQuant is not directed at, and does not knowingly collect personal information from, users under the age of 18. If you believe that a minor has provided us with personal information, contact us immediately at [email protected] and we will promptly delete such information.

13. Advertising

WatchQuant does not currently serve third-party advertisements. If advertising is introduced in the future, this Privacy Policy will be updated, and registered users will be notified before any advertising-related data collection begins. You will have the opportunity to manage your preferences before such changes take effect.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated to registered users via email or a prominent notice on the platform at least 14 days before taking effect. Continued use of WatchQuant after changes take effect constitutes acceptance of the revised policy.

15. Contact and Complaints

For questions, concerns, or to exercise your privacy rights:

EU users who are unsatisfied with our response may contact their local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.