Privacy Policy

Last updated: October 7, 2026

1. Who we are and what this policy covers

SeasonalQuant is a web platform for quantitative analysis of seasonal spreads in exchange-traded commodity futures (grains, softs, meats, energy and metals). It includes a screener, a spread builder, a window optimizer, backtesting, a Monte Carlo trade forecaster, and historical performance views. We offer Free, Basic and Professional plans, billed monthly or annually.

This policy explains what personal data we collect when you visit our website or use the SeasonalQuant app (both are served from the same address), why we collect it, who we share it with, and the choices and rights you have. In this policy, "SeasonalQuant", "we" and "us" mean the operator of the SeasonalQuant service, and "you" means anyone who visits the site or uses the app.

Not investment advice. SeasonalQuant provides analytical tools and historical data. Nothing on the website or in the app, including screener results, backtests, forecasts, or optimizer output, is investment, trading, tax or legal advice, or a recommendation to buy or sell any futures contract. Past seasonal patterns do not guarantee future results, and trading futures involves substantial risk of loss. You are responsible for your own trading decisions.

2. Data we collect

Account data

• Email address and password. Your email is your username. Passwords are stored only as salted hashes, never in plain text. We also record when you last changed your password.
• Name. Your full name, if you provide it or if it comes from Google.
• Google Sign-In. If you choose "Sign in with Google", Google sends us your email address, your name and a Google account identifier. We use these to create or link your account. We do not receive your Google password.
• Account status. Whether your email is confirmed, your role (regular user or administrator) and the security data that our account system keeps, such as failed sign-in counters and lockout status.

Subscription and billing data

• We store your plan (Free, Basic or Professional), billing period (monthly or annual), start and end dates, next payment date and whether the subscription is active.
• Payments are handled by our payment processor, Stripe. When you subscribe, you enter your card or other payment details directly on Stripe's checkout page, and you manage your subscription in Stripe's customer portal. We never see or store your full card number. We share your email address with Stripe so it can link your payments to your SeasonalQuant account, and Stripe tells us when a payment succeeds or fails or a subscription starts, changes, is cancelled or ends.

Usage and saved settings

• Feature usage counts. For plans with limits, we count how many times you run the window optimizer and the trade forecaster in each billing period.
• Saved configurations. Table layouts, filters and other views you save in the app, and preferences such as your date format.
• Analysis requests. The parameters you submit (for example contracts, spreads, date windows and direction) are processed on our servers to produce results. Results tied to your account are stored only where a feature needs to keep them.

Technical and log data

• IP address. We record the IP address used when a sign-in session is created and use IP addresses to limit request rates and protect against abuse.
• Server logs. Like most web services, our servers log requests and errors, which can include your IP address, the time of the request, the page or API called and browser information.
• Session tokens. When you sign in we issue a short-lived access token and a longer-lived refresh token (see Section 9).

Emails and support

• We send transactional emails: email confirmation, password reset, and notices when a subscription starts, renews, fails to renew, is cancelled or ends. We keep a record of when the last confirmation or reset email was sent to an address, so we can stop repeated sends.
• If you email us for support, we keep your message, your email address and our reply so we can help you.

What we do not collect

We do not use advertising trackers or third-party analytics tools, we do not sell your data, and we do not ask for or store your brokerage account details or trading positions.

3. How we use your data and our legal bases

If you are in the European Economic Area, the UK or Switzerland, data protection law requires a legal basis for each use of your data. Here is what we do and why:

• To provide the service: creating and securing your account, signing you in, running your analyses, saving your settings, and applying plan limits. Basis: performance of our contract with you.
• To process payments and manage subscriptions through Stripe. Basis: performance of a contract, and our legal obligations for tax and accounting records.
• To send transactional emails about your account and subscription. Basis: performance of a contract.
• To keep the service secure and reliable: rate limiting, preventing fraud and abuse, fixing errors and keeping backups. Basis: our legitimate interest in running a safe, working service.
• To answer support requests. Basis: performance of a contract, or our legitimate interest in responding to people who contact us.
• To comply with the law and respond to lawful requests from authorities. Basis: legal obligation.

We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not send marketing emails unless you have agreed to receive them, and you can unsubscribe at any time.

4. Who we share data with

We share personal data only with the service providers that help us run SeasonalQuant, and only as far as each one needs. They process the data on our behalf, under contract terms that require them to protect it.

• Stripe (payments and subscription billing). Receives your email address and the payment details you enter at checkout. Stripe also acts as an independent controller for some data, for example for fraud prevention and its legal obligations, under its own privacy policy.
• Resend (email delivery). Receives your email address and the content of the transactional emails we send you.
• Google:
  • Google Sign-In, if you choose to use it.
  • Google Fonts, which the app loads from Google's servers. Your browser therefore sends your IP address to Google when it downloads the fonts.
• Hetzner Online (hosting). Our application, database and backups run on a server operated by Hetzner. Hetzner provides the infrastructure but does not use your data for its own purposes.

We get commodity futures price data from a market data provider. This is a one-way flow of public market data into SeasonalQuant: we do not send your personal data to the market data provider.

We may also disclose data when the law requires it, to protect the safety and rights of SeasonalQuant, our users or others, or as part of a merger or sale of the business. In that case we will tell you before your data becomes subject to a different policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA), as amended by the CPRA.

5. International transfers

Our servers and database are hosted by Hetzner in the European Union. Some of our service providers, including Stripe, Resend and Google, are based in or may process data in the United States or other countries outside your own. Where we transfer personal data from the EEA, UK or Switzerland to a country that has not been found to offer adequate protection, we rely on appropriate safeguards, such as the provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.

6. How long we keep data

• Account data, saved settings and subscription records: for as long as your account exists. When your account is deleted, we delete or anonymize this data, except records we must keep for legal reasons (see below).
• Sign-in sessions: access tokens expire after 30 minutes. Refresh tokens, together with the IP address recorded when they were created, expire after 14 days, and expired tokens are deleted automatically every day.
• Feature usage counts: kept for the billing period they relate to, and for as long as your account exists.
• Email send records (used to limit repeated confirmation and reset emails): short-lived, kept only as long as they are needed for that purpose.
• Database backups: we take nightly backups and keep each one for 14 days. Data you delete may stay in a backup until that backup expires.
• Billing and tax records: kept for as long as tax and accounting laws require, which may continue after your account is closed. Stripe keeps its own records under its own retention policy.
• Support emails: kept for as long as needed to resolve your request and handle any follow-up.

7. Security

We protect your data with measures suited to a service of our size, including:

• passwords stored as salted hashes;
• session tokens kept in HttpOnly, SameSite=Strict cookies that page scripts cannot read, plus protection against cross-site request forgery;
• short-lived access tokens, and refresh tokens that are rotated and can be revoked;
• rate limiting on sign-in and other sensitive endpoints;
• a database that is not reachable from the internet, with only the web front end exposed;
• restricted administrative access to the server and to background-job tools.

No system is completely secure. If a breach affects your personal data in a way that puts you at risk, we will notify you and the relevant authorities as the law requires.

8. Your rights and how to use them

Everyone

Whatever country you live in, you can ask us to tell you what data we hold about you, correct it, or delete your account. You can update some account details and your preferences yourself in the app. You can cancel your subscription at any time through the billing portal linked from your profile.

EEA, UK and Swiss residents (GDPR)

You have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing that is based on our legitimate interests;
• receive data you provided to us in a portable, machine-readable format;
• withdraw any consent you have given, without affecting processing done before you withdrew it;
• complain to your local data protection authority. We would appreciate the chance to address your concern first.

California residents (CCPA/CPRA)

You have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; and to opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. We will not discriminate against you for exercising any of these rights. You may use an authorized agent to make a request on your behalf.

How to make a request

Email support@seasonal-quant.com from the email address on your account and tell us what you are asking for. To protect your account, we may need to confirm your identity before acting on a request. We will respond within one month (GDPR) or 45 days (CCPA). We will tell you if we need more time, as the law allows.

9. Cookies and local storage

We use only what the service needs to work. We do not use advertising or analytics cookies, so we do not show a cookie consent banner for them.

Cookies

• access_token: keeps you signed in. HttpOnly, SameSite=Strict, expires after 30 minutes.
• refresh_token: renews your session without making you sign in again. HttpOnly, SameSite=Strict, expires after 14 days or when you sign out.

Browser storage

• Local storage: your theme (light or dark), and your date format.
• Session storage: temporary data used during sign-up email confirmation and password reset, which is cleared when you close the tab.

If you choose Google Sign-In, Google may set its own cookies while you sign in, under Google's privacy policy. You can clear cookies and site data in your browser at any time, but you will then be signed out and your browser-level preferences will be reset.

10. Children

SeasonalQuant is intended for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from people under 18. If you believe a minor has created an account, please contact us and we will delete it.

11. Changes to this policy

We may update this policy when our service, our providers or the law change. We will change the "Last updated" date at the top of this page. If a change is significant, for example a new category of data or a new kind of recipient, we will also tell you by email or in the app before it takes effect.

12. Contact us

If you have questions about this policy or how we handle your data, or you want to exercise your rights, email us at support@seasonal-quant.com.