Review date: October 12, 2026
Scope: EyeQuant platform, website, APIs, communications, MCP integrations, and third-party applications.
PRIVACY OVERVIEW
Controller: Quantum Software Systems SpA (trade name “Quantsoft”), Chilean tax ID (RUT) 77.634.586-5, with its registered domicile in Santiago, Chile. Mailing address: Medio Oriente 831, office 701, Viña del Mar, Chile. Email: gestion@quantsoft.cl. If a contract expressly identifies another group entity as the service provider or controller, its details must be provided to the user before their data is processed.
Privacy and rights contact: gestion@quantsoft.cl
Website: https://www.eyequant.ai
Integration: You decide whether to connect EyeQuant to ChatGPT or another compatible client. A connection may allow the client to read information from your account and, if you authorize write permissions, change your watchlists. EyeQuant does not execute financial orders or transfers.
This Policy explains what data we process, why and for how long we process it, whom we share it with, and how to exercise your rights. It applies to features that are actually available. A future integration will be subject to the applicable notice and authorization before it is enabled.
1. Controller, scope, and definitions
Quantum Software Systems SpA, operating under the trade name Quantsoft (“Quantsoft”), provides EyeQuant. It is incorporated in Chile, has RUT 77.634.586-5, and has its registered domicile in Santiago. It receives mail at Medio Oriente 831, office 701, Viña del Mar, Chile, and electronic requests at gestion@quantsoft.cl. For this Policy, “EyeQuant” includes www.eyequant.ai, applications identified with the same provider, communications related to the service, APIs, and servers compatible with the Model Context Protocol (“MCP”).
“Personal data” means information that identifies or makes a person identifiable. An “MCP client” is a third-party service—such as ChatGPT, when you connect it—that requests operations from EyeQuant through authorized tools. That third party's own policy also governs its collection and processing of conversations and results.
2. Nature and limits of the service
EyeQuant provides quantitative information, statistical models, and analytical tools concerning financial assets. Its signals, cards, statistics, and visualizations are informational and do not guarantee results. EyeQuant does not manage users' funds or execute buy or sell orders. The legal classification of an activity depends on how it actually works, not solely on this statement; features that constitute regulated financial services will be subject to the required authorizations.
3. Categories of personal data
Identity and account. Email address, name if you provide it, internal account identifiers, and information needed to sign in and verify account ownership. If you use an EyeQuant password, secure verification mechanisms such as cryptographic hash storage are used; you do not need to provide your password through MCP tools. If you choose federated sign-in (for example, Google), we may receive your email address and attributes authorized by the identity provider.
Subscription and billing. Your plan, its term, access rights, usage limits, payment status, and transaction references. Where applicable, the payment provider processes the full card number; it should not be requested in a chat or through MCP tools.
User-created data. Watchlist names, tickers you add or remove, preferences, and records needed to maintain your settings. We do not deliberately request personal financial information such as net worth, income, bank accounts, or individual risk tolerance to operate the MCP tools currently described.
Market queries and MCP responses. Symbols, filters, date ranges, signal queries, history, and tool parameters. To fulfill an authenticated request, certain responses may include your account email and plan (for example, get_profile), watchlist names and contents, tickers, signals, or requested historical data. Market data is not personal data by itself, but it may become associated with an account when it forms part of your preferences.
Technical authorizations. Connection status, granted permissions, technical identifiers and session metadata, and securely managed OAuth tokens. We do not ask the model to capture or send us passwords, one-time codes, private keys, full card numbers, or other authentication secrets in tool requests.
Technical and security data. IP address, user agent or device/browser data, session identifiers, connection and query timestamps, and authentication, tool usage, and error logs needed to detect incidents and operate the platform. We do not deliberately include this data in conversational MCP responses unless an authorized function requires it. Measurement tools may process events, cookies, and browsing identifiers according to their actual configuration and applicable controls.
Support and communications. Inquiries you send to the team, content you provide voluntarily, follow-up information, and preferences for operational or marketing emails.
4. Purposes and grounds for processing
Performance of the service contract. Registering and authenticating users; applying plans and quotas; maintaining watchlists; retrieving signals and historical data; delivering requested notifications; and handling requests initiated by MCP clients.
Consent and user choice. Connecting optional integrations, granting write permissions, receiving marketing campaigns where the law requires consent, and using nonessential tracking technologies where applicable. You may withdraw consent through the available means without affecting lawful processing carried out before withdrawal.
Legitimate interests or another permitted ground. System security, abuse detection, fraud prevention, continuity, diagnostics, and strictly necessary internal statistics, with an assessment of individuals' rights where this ground is required by law.
Legal obligation. Keeping accounting or tax records, responding to valid requests from authorities, and complying with data protection duties.
The legal grounds above apply to the extent they are recognized by the law of your jurisdiction. If a different ground or additional information is required, it will be provided before the relevant processing.
5. How ChatGPT and MCP clients work
Connecting is optional. Through an authentication and authorization flow, you authorize EyeQuant to respond to requests from tools enabled for your account. Read tools may access your profile, plan, signals, historical data, and watchlists. Write tools, when available and authorized, may create and rename lists, add or remove tickers, and delete lists. Read and write permissions can be distinguished when the server and client offer them (for example, eyequant:read and eyequant:watchlist.write).
What is transmitted. The MCP client may send EyeQuant a tool name and the parameters strictly needed for the request. EyeQuant returns results relevant to that request. Depending on the tool, the client may display those responses in your conversation or through cards and visualizations. EyeQuant does not need your entire conversation history or data unrelated to the requested action.
What each party controls. Quantsoft processes data under its control to provide EyeQuant. OpenAI or another client provider processes messages, results, and content displayed in its environment under its own terms, policies, and account options. Those policies may allow processing outside Quantsoft's control, including storage of responses already generated. Disconnecting EyeQuant does not automatically delete messages or responses already retained on third-party platforms.
Security of actions. Write operations must be authorized by the authenticated account and allowed under its plan. Deleting watchlists and making other destructive changes require precise identification of what will be changed and user confirmation where applicable. Describing permissions in this Policy does not replace effective technical controls.
Disconnection and revocation. You can disconnect EyeQuant through the third-party client's connection controls, when available, and request help at gestion@quantsoft.cl. Disconnecting the client prevents it from making further requests to EyeQuant through that connection, but previously issued technical tokens may remain valid until they expire or are effectively invalidated. If you need to block access earlier, contact EyeQuant support. Disconnecting does not delete responses already added to the third party's conversations or files.
6. Providers, recipients, and disclosures
We share data only as needed for the purposes explained, using appropriate contracts, controls, or other safeguards where applicable:
- Infrastructure and operational email: Amazon Web Services (including enabled computing, database, storage, or email services), to host account information, watchlists, application logs, and notifications.
- Payments and billing: PayPal or other processors actually offered at checkout, for payer identity, amount, transaction identifiers, and subscription status. EyeQuant does not need to receive full card details through ChatGPT.
- Analytics, measurement, and diagnostics: Mixpanel and, depending on the active configuration, Contentsquare, Hotjar, and Google Tag Manager. They may process browsing events, technical identifiers, cookies, IP addresses, or other data strictly related to metrics and diagnostics. Nonessential technologies must be activated in accordance with the notice and consent requirements of each jurisdiction.
- Identity and external connectors: Google when you choose federated sign-in; OpenAI when you connect EyeQuant to ChatGPT; and other MCP clients you expressly select. They receive only the data categories needed for authentication or the response from the authorized tool.
- Legal obligations and security: competent authorities and advisers bound by confidentiality duties where there is a legal obligation, a need to defend rights, or a legitimate and proportionate need.
We do not sell personal data to data brokers or exchange it for commercial consideration. If applicable law regards certain advertising or analytics activities as “sharing,” the corresponding notices and rights will be made available before they are carried out. On our own initiative, we do not use your private queries to train third-party AI models without the required legal ground and authorizations; independent processing by external platforms is governed by those third parties' policies.
7. International transfers
EyeQuant's operations or those of its providers may involve infrastructure, technical assistance, or recipients outside Chile. When an international transfer of personal data is subject to special requirements, Quantsoft will use the legally appropriate mechanism—for example, suitable contractual clauses, adequacy decisions, or another valid safeguard—and provide individuals with the required details. Transfers to an MCP platform selected by you also depend on your relationship with that platform's operator.
8. Retention, deletion, and backups
The following retention rules apply from the effective date of this Policy. Data subject to legal retention requirements, documented incidents, or pending claims may be kept for the additional period necessary and permitted by law:
| Category | Retention period or criterion |
|---|---|
| Account, plan, and profile | While the account is active. After a verified closure request, operational data not subject to a legal exception is deleted or anonymized within a maximum of 30 days. |
| Watchlists and preferences | While the account is active and you keep them. When a list is deleted, it is no longer available in the account; residual copies remain only until replaced through the ordinary backup cycle. |
| OAuth authorizations | Technical tokens have their own expiry. No new tokens are issued through a disconnected connection; previously issued tokens are retained until they expire or are effectively invalidated. Associated technical logs follow the security-log period in this table. |
| Technical and security logs | Ordinary maximum of 90 days from creation. Specific logs may be preserved longer if needed to investigate an incident, defend rights, or meet an identifiable legal obligation. |
| Support cases | Up to 24 months after the request is closed, unless a longer mandatory period or pending dispute requires proportionate retention. |
| Payment, contract, and tax records | For the retention period required under applicable tax, accounting, commercial, or consumer protection laws. |
| Security backups | Only for the technical rotation and replacement cycle used for incident recovery. Deleted data is not reused from backups; if a backup is restored, applicable deletion requests must be carried out again. |
Retention by OpenAI, Google, or another independent platform is described in each provider's policies and is outside Quantsoft's control.
9. Security, confidentiality, and incidents
We apply reasonable and proportionate measures for access control, account segregation, communications protected by TLS/HTTPS, authentication, permission management, and security event monitoring. EyeQuant passwords must not be stored or disclosed in plain text. Technical tokens and secrets require protected custody and minimum necessary access. No computer system offers absolute security.
If an incident affects personal data, we will take steps to contain and investigate it and notify affected individuals or authorities in the circumstances and timeframes required by applicable law.
10. Cookies, measurement, and communications
The website uses or may use cookies strictly necessary for access, security, and operation and, when enabled, analytics and diagnostic technologies from the providers named in section 6. The latter may collect browsing events, technical identifiers, IP addresses, and preferences. Where a jurisdiction requires prior consent or a way to reject nonessential technologies, EyeQuant must provide those controls before enabling the technologies for those users. You can also manage cookies in your browser and exercise your rights through the contact email.
Essential emails about security, account recovery, billing, and operation are not advertising. Marketing emails are managed separately. You may unsubscribe or withdraw consent through the included link where applicable, or by writing to gestion@quantsoft.cl.
11. Rights and requests
Depending on applicable law, you may request access to and a copy of your data, correction, deletion, restriction, objection, portability, information about recipients and transfers, and withdrawal of consent. You may also complain to the competent authority. These rights and their exceptions depend on your jurisdiction and the grounds for processing.
Send requests to gestion@quantsoft.cl. We will ask only for the evidence needed to verify your identity and avoid disclosing data to third parties. We will respond within the timeframes set by applicable law and, where relevant, explain if a request cannot be fully honored because of a legal retention duty or an overriding right.
12. Children, adolescents, and sensitive data
EyeQuant is not designed to collect data from children under 13 or to request sensitive personal data, passwords, credentials, government documents, health information, or full card numbers through MCP. Availability to adolescents depends on the platform's age and capacity rules, applicable law, and authorization from legal representatives where required. If we detect data collected improperly, we will take steps to stop processing it and address its deletion in accordance with the law.
13. Geographic scope and local obligations
This Policy was drafted with regard to the principles of Chilean Law No. 19,628, the amendment under Law No. 21,719 scheduled to take effect on December 1, 2026, and practices comparable to the European GDPR. This does not mean that all those laws apply to every user. If a law requires additional notices, a representative, consent mechanisms, or rights, these must be provided to the individuals to whom they apply. This document does not limit mandatory rights.
14. Changes and effective date
We will publish the current version at https://www.eyequant.ai/privacy and communicate material changes through reasonable channels, including the registered email address or prominent notices on the platform where appropriate. Changes do not remove acquired rights or replace specific consent required by law for new purposes. This version takes effect when Quantsoft publishes it and does not retroactively change processing or acquired rights.
15. Contact
For data rights, access, correction, deletion, questions about integrations, incidents, or privacy choices: gestion@quantsoft.cl.
Controller: Quantum Software Systems SpA (Quantsoft), RUT 77.634.586-5. Registered domicile: Santiago, Chile. Mailing address: Medio Oriente 831, office 701, Viña del Mar, Chile.