Quorant (“Quorant”, “we”, “us” and “our”) treats the private
nature of your personal information seriously. This policy (the “Policy”) describes how we collect,
use, store, disclose and delete information when you visit
www.quorant.io (the “Site”) or register to use our data
analytics platform and related services (the “Services”).
Quorant is operated from the City of Toronto, Ontario, Canada, and serves researchers and organisations in many
countries. This Policy describes what we actually do. Where a practice is still developing, we say so rather
than describing an intention as though it were already in place.
Please read this Policy carefully. If you do not agree with it, your only option is not to access the
Site or the Services and not to provide us with personal information.
The short version. We do not use cookies. We do not run analytics or advertising trackers. Card numbers
never reach our systems. We do not use your research data to train models and we do not sell it. You can ask us
to delete your account, your uploads and your outputs at any time, and we will.
1. Information We Collect
1.1 Information you provide to us
- Account information. Your name and email address when you create an account, and the plan you
select. If you sign in with Google, we receive your name, email address and profile picture from Google under
the permissions you grant.
- Billing information. Your subscription tier, billing period, invoices and payment status.
Institutional customers may also provide an organisation name and billing contact.
- Communications. The content of messages you send through our contact page or by email,
including the name, email address and any details you choose to include.
- Programme applications. Information you submit when applying to the Academic Ambassador
programme, the Global Equity Program, QCAP certification, or a role at Quorant. Some of these applications are
hosted on a third-party form service and are governed by that provider's privacy policy in addition to this
one.
- Verification information. Where you claim an academic or institutional discount, the evidence
you supply to establish eligibility.
1.2 Research data you upload
When you run an analysis you upload a dataset. That file, the methodology you select, the parameters you set
and the outputs generated from it are together referred to in this Policy as Research Data. Research Data
is processed on your instructions and for the sole purpose of producing the analysis you requested.
Research Data may contain personal information about third parties, for example survey respondents or
study participants. Where that is the case, you are the controller of that information and Quorant acts on your
behalf. Section 4.3 sets out what we ask of you before you upload.
1.3 Information collected automatically
When you use the Services, our hosting and storage providers record standard operational information such as
server requests, timestamps, IP address, browser type and error logs. We use this to operate the platform and
diagnose faults. It is not combined with your datasets and is not used to build a profile of you.
1.4 What we do not collect
- No analytics or advertising trackers. The Site does not run Google Analytics, tag managers,
advertising pixels, session recorders or heat-mapping tools.
- No card numbers. Payments are completed on Stripe's own checkout pages. Card details are entered
there and never pass through our systems.
- No cross-site profiling. We do not build advertising profiles and we do not track you across other
websites.
2. Cookies and Local Storage
Quorant does not set cookies. To keep the Site working across page loads we store a small number of
values in your browser's local storage. These are first-party, are readable only by quorant.io, and are not
transmitted to advertisers or any third party.
| Stored value | Purpose | Duration |
| quorant-lang | Remembers whether you chose the English or Korean interface | Until you clear it |
| quorant-user | Keeps you signed in between page loads | Until you sign out |
| quorant-runs | Displays your recent analysis history in your account | Until you sign out |
| quorant-promo | Holds a discount code you entered until checkout completes | Until you clear it |
| quorant-inapp-tried | Prevents the in-app browser notice from repeating | Until the browser tab closes |
All of these are strictly necessary to deliver functions you have asked for, which is why the Site does not
present a consent banner. You can delete them at any time through your browser's settings; if you do, you will
be signed out and your language choice will reset.
The Site also loads two categories of resource from third parties: web fonts, and Google's sign-in library.
These providers receive your IP address as a normal consequence of serving the request. They do not set cookies
on quorant.io.
Do Not Track. We do not track users across websites or over time, so a browser “Do Not
Track” signal has no effect on what we collect, because there is nothing for it to switch off.
If we introduce analytics or advertising technologies in future, we will update this Policy and, where consent
is required, obtain it before those technologies load.
3. How We Use Information and Our Legal Bases
We use the information described above to provide and secure the Services, to process payments, to respond to
you, to meet our legal obligations and, where you have opted in, to send you occasional product news. Where the
GDPR or UK GDPR applies, we rely on the following lawful bases.
| Purpose | Information used | Lawful basis |
| Creating and maintaining your account | Account information | Performance of a contract |
| Running the analysis you requested and delivering the outputs | Research Data | Performance of a contract |
| Expert review of a report by an assigned methodologist | Research Data | Performance of a contract |
| Processing subscriptions, invoices and refunds | Billing information | Performance of a contract; legal obligation |
| Responding to your questions and support requests | Communications | Legitimate interests; performance of a contract |
| Keeping the platform secure and preventing abuse | Operational information | Legitimate interests |
| Assessing applications to our programmes | Programme applications | Steps prior to a contract; consent |
| Sending product news and updates | Email address | Consent (withdrawable at any time) |
| Retaining accounting records | Billing information | Legal obligation |
Our legitimate interests are the secure and reliable operation of a paid research service. We do not rely on
legitimate interests for marketing.
4. Research Data
4.1 What we will not do with it
- We do not use your data to train models. Research Data is used to run the analysis you requested and
for nothing else.
- We do not sell your data and we do not share it with other customers or with advertisers.
- We do not publish it. Uploads are held in a private storage bucket that is not publicly listed or
browsable.
4.2 Who can see it
Access to uploaded files is limited to the people who need it to deliver your analysis: Quorant personnel
operating the platform, and, where an expert-verified report is included in your plan, the methodologist
assigned to your run. Everyone with access is bound by confidentiality obligations.
4.3 What we ask of you before you upload
- Remove direct identifiers. Names, contact details, identification numbers and addresses are not
needed for statistical analysis. Replace them with anonymous codes.
- Check your own approvals. If your data involves human participants, confirm that your ethics approval
and participant consent permit processing by a third-party service.
- Tell us about special category data. Health, genetic, biometric, racial or ethnic origin, political,
religious, sexual orientation and criminal offence data may require additional safeguards. Contact us before
uploading rather than after.
4.4 Deleting it
We do not currently run an automatic deletion schedule for uploaded datasets. A file you upload remains
in our storage until you or we delete it. You can ask us to delete a specific dataset, all of your uploads, or
your entire account at any time by writing to
contact@quorant.io, and we will act on that request as described in
Section 9. If you are working under an ethics approval that requires deletion by a particular date, tell us and
we will delete on that schedule.
We intend to introduce automatic deletion of raw uploads after delivery. When that is in place, this Policy
will be updated to state the schedule, and registered users will be notified.
If you are an institutional customer and need a written data processing agreement, contact us and we will
arrange one.
5. Disclosure of Your Information
We do not sell personal information. We disclose it only in the circumstances below.
5.1 Service providers
We rely on a small number of providers to operate the Services.
| Provider | What it handles | Primary location |
| Supabase | Database and file storage for uploaded datasets | United States |
| Netlify | Website hosting and serverless functions | United States |
| Stripe | Subscription billing, checkout and the customer billing portal | United States |
| Google | Google Sign-In, and web fonts served to your browser | United States |
| Notion | Hosted application forms for our programmes | United States |
| Contracted methodologists | Expert review of reports, where included in your plan | Canada and other countries |
This list is current as of the Effective Date. If you need it confirmed for a procurement or ethics review,
contact us and we will provide it in writing.
5.2 Other disclosures
- Legal process. To comply with a court order, law or governmental or regulatory request, and to
establish, exercise or defend legal claims.
- Protection of rights. Where we believe disclosure is necessary to protect the rights, property
or safety of Quorant, our users or others, including to prevent fraud or abuse.
- Business transfer. To a buyer or successor in a merger, acquisition, reorganisation or sale of
assets. We will notify affected users before their personal information becomes subject to a different privacy
policy.
- Aggregated information. We may publish statistics that do not identify any individual,
organisation or dataset.
- With your consent. For any other purpose you agree to.
6. International Transfers
Quorant operates from Canada and the providers listed in Section 5.1 are located primarily in the United
States. If you use the Services from elsewhere, your information will be transferred to and stored in those
countries, whose data protection laws may differ from those of your own.
We choose providers that offer data processing terms covering international transfers, and we are willing to
enter into transfer safeguards required by your jurisdiction, including the European Commission's
Standard Contractual Clauses or the UK International Data Transfer Addendum, on request. For users in the
Republic of Korea, this Section together with Sections 1 and 5 constitutes notice of overseas transfer: the
recipients, the purposes, the items transferred and the retention position are those described there.
7. How Long We Keep Information
We keep personal information for as long as it is needed for the purposes described in this Policy, and then
delete it or irreversibly anonymise it.
- Account information. Kept while your account is open. When you close your account we delete
the account record and its associated data, other than what we must retain by law.
- Research Data. Kept until you or we delete it. See Section 4.4.
- Billing and invoice records. Retained for the period required by Canadian tax and accounting
law, which is longer than the life of your account.
- Communications and programme applications. Kept while they remain relevant to our relationship
with you, and deleted on request.
- Operational logs. Kept for the period applied by our hosting and storage providers.
Where we are required to retain a record for legal reasons, we restrict it so that it is no longer used for any
operational purpose.
8. Security
- Encrypted in transit. Every connection is served over HTTPS. HTTP requests are redirected to HTTPS
and HTTP Strict Transport Security is enabled, so a browser will not downgrade the connection.
- Encrypted at rest. Uploaded files are stored on infrastructure operated by Supabase, which applies
server-side encryption to data at rest.
- Private storage. Uploads are held in a private bucket rather than on the public web.
- Payment isolation. Card data is handled entirely by Stripe, which is certified to the Payment Card
Industry Data Security Standard. We never receive it.
- Limited access. Access to uploaded files is restricted to the people described in Section 4.2.
Quorant is not certified against ISO/IEC 27001, SOC 2 or any comparable standard, and we do not claim to be.
We describe the measures we actually apply so you can assess them yourself. No security control is completely
effective, and we cannot guarantee the security of information transmitted to us. You are responsible for
keeping your account credentials confidential.
8.1 If something goes wrong
If we become aware of a breach affecting your personal information, we will contain it, notify affected users
by email without undue delay, and notify supervisory authorities where the law requires it, within 72 hours of
becoming aware where the GDPR applies. We will provide a written summary of cause, impact and
corrective action on request.
9. Your Rights
Subject to the applicable law in your jurisdiction, you may ask us to:
- Access. Receive a copy of the personal information we hold about you.
- Correct. Fix anything inaccurate or incomplete in your account.
- Delete. Remove your account, your uploads and your outputs.
- Port. Export your outputs and account data in open, machine-readable formats.
- Restrict or object. Ask us to stop or limit a particular use of your information, including
any processing based on legitimate interests.
- Withdraw consent. Unsubscribe from product emails, or disconnect Google Sign-In, at any time.
Withdrawal does not affect processing carried out before you withdrew.
To exercise any of these, email contact@quorant.io with
“Privacy Inquiry” in the subject line, or use our contact page. We respond
within 30 days. We may need to verify your identity before acting, and we may retain information where the law
requires or permits us to.
Exercising a right never results in discriminatory treatment: we will not deny you the Services, charge a
different price or provide a different quality of service because you made a request.
10. Regional Information
10.1 European Economic Area and United Kingdom
Quorant is the controller of the personal information described in this Policy, except for Research Data, where
you are the controller and we act on your behalf. You have the right to lodge a complaint with your local
supervisory authority, or with the Information Commissioner's Office in the United Kingdom. We do not use your
information for automated decision-making that produces legal or similarly significant effects.
10.2 Canada
The Personal Information Protection and Electronic Documents Act applies to our handling of personal
information. If you are not satisfied with our response to a privacy concern, you may complain to the Office of
the Privacy Commissioner of Canada.
10.3 Republic of Korea
Where the Personal Information Protection Act applies, personal information is collected only for the purposes
stated in this Policy. Section 6 constitutes notice of overseas transfer. Our designated privacy contact is:
| Privacy contact | Minkyu Kim, Founder & CEO |
| Email | contact@quorant.io |
| Location | City of Toronto, Ontario, Canada |
You may also report privacy concerns to the Personal Information Dispute Mediation Committee, the Korea
Internet & Security Agency Privacy Complaint Centre, or the Personal Information Protection Commission.
10.4 California
We do not sell or share personal information as those terms are defined by the California Consumer
Privacy Act as amended by the CPRA, and we have not done so in the preceding twelve months. We do not use or
disclose sensitive personal information for purposes other than providing the Services. California residents may
exercise the rights to know, delete, correct and limit by contacting us as described in Section 9. California
Civil Code § 1798.83 additionally permits residents to request information about disclosures to third
parties for direct marketing purposes; we make no such disclosures.
11. Children
The Services are intended for researchers and professionals. They are not directed to children, and we do not
knowingly collect personal information from anyone under 13. You must be at least 18 to enter into a paid
subscription. Where the law of your country sets a higher minimum age for consenting to an online service, or
requires the consent of a parent or legal guardian below a certain age, that higher standard applies instead of
the ages stated here. If we learn that we have collected information from a child under 13 without appropriate
consent, we will delete it. If you believe a child has provided us with information, contact
contact@quorant.io.
12. Third-Party Links
The Site links to third-party services, including Stripe for checkout and billing, Google for sign-in, and
hosted forms for programme applications. Your use of those services is governed by their own privacy policies,
not by this one. We are not responsible for their practices, and we encourage you to read them.
13. Changes to This Policy
This Policy is current as of the Effective Date stated at the top. We may update it as the Services change or
as the law requires. Material changes will be announced on this page and, where they affect how we handle
information you have already given us, by email to registered users before the change takes effect. Continued
use of the Site or the Services after a change takes effect constitutes acceptance of the updated Policy.
14. Contact Us
We welcome questions and comments about this Policy or our privacy practices.
| Entity | Quorant |
| Privacy contact | contact@quorant.io (subject line “Privacy Inquiry”) |
| Responsible person | Minkyu Kim, Founder & CEO |
| Location | City of Toronto, Ontario, Canada |
| Response time | Within 30 days of a verified request |