Privacy Policy
This Privacy Policy explains how we process the personal data of users of the QuantumCalc service available at quantumcalcgpt.com (the “Service”), including people who buy QuantumCalc calculators, use the subscription and AI assistant, or deliver files to a Device. It fulfils the information duty under Articles 13 and 14 of the GDPR.
1. Data controller
The controller of your personal data is Jan Rudowski, conducting unregistered business activity (działalność nierejestrowana under Polish law), address: ul. Karola Szymanowskiego 5/74, 03-477 Warszawa, Poland (the “Controller”, “we”).
For all data-protection matters, contact us at [email protected]. We have not appointed a Data Protection Officer; please use the address above.
2. What data we process
- Account data — first and last name, email, password (stored only as an encrypted hash — we never see your password), optionally phone number, preferred language and currency.
- Order and delivery data — name, delivery address, phone, email and order history, needed to fulfil and ship your order.
- Payment data — payments are handled by an external provider (Stripe). We do not store your card details; we keep only the transaction and subscription identifiers needed for billing.
- Device data — a hash of the device hardware fingerprint, serial number, the device name you choose, and last-seen timestamp, used to securely pair the device with your account.
- AI assistant data — the content of your prompts and the assistant's responses, conversation titles, images or files submitted as part of an AI-assistant prompt, and token counts, used to operate the AI features and meter subscription limits.
- Device-delivery data — the uploaded file content, filename, type, size and checksum, identifiers of the target Device and upload session, transfer status, and timestamps, used only to prepare, secure and deliver the file to the confirmed Device.
- Review data — rating, title, review text, displayed reviewer name, optional images, product and account identifiers, moderation status, accepted Review Terms version, and timestamps.
- Technical and log data — IP address, browser/device type, security events, error reports and diagnostics (including device firmware crash reports).
- Analytics data — usage information collected only with your consent (see Cookie Policy).
- Campaign-attribution data — the approved campaign source and name, referring domain, landing path, approximate country, language, broad device class, operating system and browser family, and whether the visit led to a cart and paid order. We do not store the raw IP address or a persistent device fingerprint for this purpose; the IP is used transiently to make a rotating daily hash.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, fulfilling orders, delivery, providing the subscription and AI service, and delivering files to a Device | Art. 6(1)(b) — performance of a contract |
| Receiving, moderating, and publishing product reviews and handling appeals | Art. 6(1)(b) — providing the user-requested service; Art. 6(1)(f) — legitimate interest in presenting genuine reviews and moderating content |
| Handling complaints and the right of withdrawal | Art. 6(1)(b) and (c) — contract and legal obligation |
| Keeping billing and tax records | Art. 6(1)(c) — legal obligation |
| Security and abuse prevention (bot protection, device pairing), error monitoring, support chat, content reports, and establishing or defending legal claims | Art. 6(1)(f) — legitimate interest |
| Usage statistics and analytics | Art. 6(1)(a) — consent |
| Cookieless measurement of our campaign effectiveness and sales sources | Art. 6(1)(f) — legitimate interest in measuring marketing effectiveness |
| Marketing (e.g. newsletter), if you sign up | Art. 6(1)(a) — consent |
4. Recipients and processors
To provide the Service we rely on trusted providers who process data on our behalf or as independent controllers. The main ones are:
| Provider | Purpose |
|---|---|
| Google (Gemini AI) | processing AI prompts and images |
| Stripe | payments and subscriptions |
| InPost | parcel-locker / courier delivery in Poland |
| Crisp | live support chat |
| Resend | sending emails (confirmations, notifications) |
| Sentry | error monitoring and diagnostics |
| PostHog | usage analytics (consent only) |
| Cloudflare, GeoJS | security, bot protection, country detection for delivery |
| Hosting / server provider | data storage and Service operation |
Data may also be disclosed to authorities entitled to receive it under applicable law.
5. Transfers outside the EEA
Some providers (including Google, Stripe, Sentry, PostHog, Resend, Cloudflare) are based in or process data in the United States or other countries outside the European Economic Area. Such transfers rely on appropriate safeguards under the GDPR — in particular the European Commission's Standard Contractual Clauses or an adequacy decision (e.g. the EU–U.S. Data Privacy Framework). You can request a copy of these safeguards by contacting us.
6. AI assistant — important notice
The content of your prompts and images submitted as part of an AI-assistant prompt are sent to the AI model provider (Google) to generate a response. Please do not include special-category data or information you do not wish to share with third parties. AI responses may be inaccurate and do not replace professional advice — always verify important results.
7. File delivery to a Device
A file selected on the upload page is sent to our infrastructure only to deliver it to the Device confirmed for that session. Images and PDFs are processed transiently by an internal conversion service into a Device-compatible format; the original image or PDF is not intentionally persisted in file storage. For text files, their content is stored. Converted chunks or text content are temporarily held by the hosting / object-storage provider until the Device downloads them.
This transfer does not send the file to Google or another AI-model provider. That occurs only if you separately use a file or image with the AI-assistant feature as described in section 6.
8. Data retention
- Account and AI conversation data — for as long as you keep your account; after deletion the data is erased or anonymised, except where we must retain it longer.
- Content of files delivered to a Device — deleted from object storage after the Device acknowledges receipt. If immediate deletion fails or delivery is not completed, an automated process retries deletion of any remaining file content after 24 hours.
- Device-delivery metadata — filename, type and size, checksum, Device and session identifiers, status, and timestamps may remain in the database after content deletion. We retain it only as long as necessary to operate the transfer, maintain security, handle reports, and establish or defend legal claims.
- Order and billing data — for the period required by tax law and until any related claims become time-barred.
- Other temporary files (e.g. images pending linking to an AI conversation) — deleted automatically after a short time.
- Reviews and review images — approved content remains public until it is removed or the account is deleted, subject to legal retention needs. Rejected content is retained only for the limited period reasonably needed for moderation, appeals, security, and legal claims.
- Consent-based data — until you withdraw consent.
- Logs and security data — for a limited, necessary period.
- Campaign-attribution data — for a limited period needed to evaluate campaigns; aggregate data may be retained longer where it can no longer identify a person.
9. Your rights
You have the right to access your data and obtain a copy, to rectification, erasure (“right to be forgotten”), restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting processing carried out before withdrawal).
To exercise these rights, email [email protected]. Some actions (e.g. account deletion) are available directly in your dashboard.
You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland).
10. Is providing data mandatory?
Providing data is voluntary but necessary to create an account and to enter into and perform the contract (purchasing the device, subscription, using the AI assistant, or delivering a file to the Device). Without the required data we cannot provide these services.
11. Profiling and automated decisions
We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.
12. Children
The Service is not directed at persons under 16. If you are a minor, use the Service only with the consent of a parent or guardian.
13. Cookies
How we use cookies and similar technologies is described separately — see the Cookie Policy.
14. Changes to this Policy
We may update this Policy. We will announce material changes in the Service or by email. The current date appears at the top of this document.