Data handling

The strongest protection for your data is not holding it. At the founding stage we ask for the minimum needed to review an application and return a decision — and we delete what we no longer need.

1 · What we collect

One email address and five application answers: your trading background, the instruments and timeframe you trade, why systematic research interests you, and how you found us. That is the entire record. There are no tracking pixels, no session-recording on the forms, no device fingerprinting, and no third-party advertising tags anywhere on this site.

2 · In transit and at rest

Every request is served over TLS; there is no unencrypted path to the site or the API. Credentials and keys live in the server environment, never in source control. Application records sit on servers we operate directly — not in shared cloud functions or third-party form services — and access is limited to the people who run the review.

3 · Subprocessors

QuantRhino runs on dedicated, single-tenant infrastructure under our control. Applications are read by a person through a private internal channel; the only data shared there is the answers you submitted. Decision messages are delivered by a transactional email provider. This list is short on purpose and kept current — material changes are recorded in the changelog.

4 · Retention and your rights

Declined applications are erased after 90 days. You can request deletion of your record at any time, before or after a decision, and it is removed — there is no retention we are unwilling to reverse. We do not sell, rent, or share application data with anyone outside the review.

5 · Reporting a vulnerability

Responsible disclosure is welcome. Write to security@quantrhino.com with enough detail to reproduce the issue. We acknowledge reports and will not pursue good-faith research that respects user privacy and avoids service disruption.

Trading involves substantial risk of loss. Past performance does not guarantee future results.