This Privacy Policy explains what personal data QUAFI collects when you use quafi.io and the QUAFI app (the "Service"), why we use it, who helps us process it, where it is stored, how long we keep it and what rights you have over it. The Service is operated by QUAFI LLC, a limited liability company organized under the laws of the State of Delaware, United States of America (Delaware file number 10704762), with registered office at 16192 Coastal Highway, Lewes, Delaware 19958, United States ("QUAFI", "we", "us" or "our"). QUAFI LLC is responsible for your personal data, and in the terms of the European and Argentine laws cited below it is the controller of the data.
Last updated: 25 October 2026.
1. The data we collect
We collect data that you give us, data that is created when you use the Service, and a small amount that sign-in providers send us when you choose them.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, password (stored only as a salted one-way hash, never in readable form), language, plan and subscription status, and the dates you registered and last signed in. | You, when you register. |
| Sign-in with Google or Apple | Your email address, whether the provider has verified it, and your name if the provider shares it. We never receive your Google or Apple password. | Google or Apple, only if you choose that option. |
| Optional profile | Full name, date of birth, country, postal address and company. | You, if you add them in Settings. |
| Analyses and portfolios | The settings you choose for each analysis (risk level, time horizon, markets and assets), the portfolios you save or follow, and how many analyses you have run in the current period. | Your use of the Service. |
| QUAFI Academy | Lesson progress, quiz results and the certificates you earn, with the name printed on them. | Your use of the Academy. |
| Usage records | Which features you use and when, whether an analysis finished or failed, the plan you were on at the time and, when you arrive from one of our emails, which email it was. These records are created on our servers and linked to your account. | Your use of the Service. |
| Email preferences and delivery | Your choices about our periodic emails, a record of when and where you gave or withdrew consent (with a one-way hash of your IP address, never the address itself) and the delivery events our email provider reports: sent, delivered, opened, clicked (with the link), bounced and reported as spam. | Your choices in the Service and our email provider. |
| Messages you send us | Your name, email address and message when you use the contact, feedback or investor forms, and the screen you were on when you send feedback. These messages reach our inbox by email and are not stored in the QUAFI database. | You. |
| Technical data | IP address, browser and device type, and the pages and files requested, in the server logs of our hosting and network providers. We also hold your IP address in memory for a short time to limit abusive traffic, without writing it to our database. When your plan changes, we keep an audit record of the change that can include the IP address of the request. | Your browser, automatically. |
We do not collect bank or brokerage credentials, account balances, government identification numbers, precise location, or sensitive data such as health, religion, political opinions or ethnic origin. Please do not include such data in messages to us.
During the launch period QUAFI does not ask for any payment details. When paid plans start, payments will be processed by Stripe, and QUAFI will never receive or store your full card number. We will update this policy before that happens.
2. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in and keep your session secure. | Account, sign-in, technical data. | Performance of our contract with you (the Terms). |
| Run the analyses you request, save and follow portfolios, and record your Academy progress. | Analyses and portfolios, Academy, account. | Performance of our contract with you. |
| Send service emails, such as account verification, password resets, security notices and replies to your messages. | Account, messages you send us. | Performance of our contract with you, and our legitimate interest in answering you. |
| Send the weekly stock note and the monthly portfolio check-in, and measure whether they are opened and used. | Account, saved portfolios, email preferences and delivery, usage records. | Your consent if you live in the European Economic Area or the United Kingdom. Elsewhere, our legitimate interest in keeping registered users informed about the Service, with a one-click opt-out in every email. |
| Understand how the Service is used, fix errors and decide what to improve. | Usage records, technical data. | Our legitimate interest in running and improving the Service. These records stay on our servers and are never shared with advertisers. |
| Protect the Service, prevent abuse and fraud, and keep audit records. | Technical data, account. | Our legitimate interest in security, and legal obligations where they apply. |
| Comply with the law, respond to authorities and defend legal claims. | Any of the above, as strictly needed. | Legal obligation and our legitimate interest. |
Under Argentine Law 25,326, processing needed to perform the contractual relationship with you does not require separate consent (article 5, paragraph 2). Where consent is required, you give it by accepting this policy when you create your account, and you can withdraw it at any time without affecting processing done before.
QUAFI computes portfolio allocations automatically from the settings you choose. That calculation is the service you request, and it produces no decision about you with legal or similarly significant effects. We do not build profiles for advertising and we do not sell or rent personal data. In the terms of California law, QUAFI does not sell or share personal information.
3. Who helps us process your data
We use a small number of service providers. Each processes personal data only to provide its service to QUAFI, under its data processing terms.
| Provider | What it does for QUAFI | Where it processes data |
|---|---|---|
| Render | Hosts the QUAFI application servers. | United States |
| Neon | Hosts the QUAFI database, including account data. | Brazil (São Paulo) |
| Cloudflare | Delivers the website, protects it against attacks, routes the email sent to our @quafi.io addresses and stores the Academy videos. | Global network, company in the United States |
| Resend | Sends our emails and reports their delivery events. | United States |
| Our team's email provider | Holds the messages you send to support@quafi.io or through our forms. | United States |
| Sign-in with Google, only if you use it. | United States | |
| Apple | Sign-in with Apple, only if you use it. | United States |
| jsDelivr | Delivers the chart and PDF libraries your browser loads when you open an analysis. Like any web server, it receives your IP address. | Global network |
| Stripe (when paid plans start) | Processes payments. | United States |
We may also disclose personal data to professional advisers bound by confidentiality, to authorities when the law requires it, and to a buyer or successor if QUAFI is involved in a merger, acquisition or sale of assets. In that last case we will tell you before your data becomes subject to a different privacy policy.
4. International transfers
QUAFI LLC is established in the United States, our application servers are in the United States and our database is in Brazil. If you use the Service from another country, including Argentina or a member state of the European Union, your data is transferred to and stored in those countries, whose data protection laws may differ from yours. Our providers commit in their data processing terms to protect personal data and to use recognised transfer mechanisms, such as the standard contractual clauses approved by the European Commission. By accepting this policy when you create your account, you also give the express consent to these transfers that article 12 of Argentine Law 25,326 provides for.
5. Cookies and similar technologies
QUAFI uses one cookie of its own and a few items of browser storage, all of them needed for the Service to work or to remember choices you made. We use no advertising, analytics or social media cookies, and we do not let other companies place tracking technologies on our pages. Storage that is strictly necessary for a service you request does not require consent under the European ePrivacy rules, so QUAFI does not show a cookie consent banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| __Host-quafi_session | Cookie set by QUAFI, secure and inaccessible to scripts | Keeps you signed in. | 30 days, or until you sign out |
| quafi_lang | Local storage | Remembers whether you chose English or Spanish. | Until you clear it |
| quafi_results, quafi_prev_screen, quafi_from_screen, quafi_asset_ticker | Session storage | Keep your latest analysis and your place in the app while you move between screens. | Until you close the tab |
| quafi_src | Session storage | Records which of our emails brought you to the app, so we can tell whether the emails are useful. It is set only when you open a link in one of those emails. | Until you close the tab, 72 hours at most |
| quafi_academy_progress | Local storage | Keeps which Academy lessons you have completed on this device. | Until you clear it |
| quafi_academy_speed, quafi_academy_cc, quafi_ir_speed, quafi_ir_cc_lang | Local storage | Remember your video speed and subtitle choices. | Until you clear them |
| Notice acknowledgements | Local storage | Remember that you closed a notice, such as the launch welcome or the email invitation, so it is not shown again. | Until you clear them |
| Cloudflare security cookies (such as __cf_bm) | Cookie set by Cloudflare | Set only when Cloudflare needs to check that traffic comes from a person and not from an attack. | Usually 30 minutes |
When you open the sign-in screen and sign-in with Google is available, your browser loads Google's sign-in script from accounts.google.com, and Google may read or set its own cookies under its own privacy policy. Apple's script is loaded in the same way when sign-in with Apple is available. Neither script is loaded on any other page. You can block or delete cookies and storage in your browser settings; if you block the session cookie you will not be able to sign in.
Our periodic emails contain a small image and links that tell us whether an email was opened and which link was clicked. Residents of the European Economic Area and the United Kingdom receive these emails only after opting in. You can avoid this measurement by turning off automatic image loading in your email app, or stop the emails altogether with the link at the bottom of each one or in Settings.
If QUAFI ever adds analytics or advertising technologies that are not strictly necessary, we will ask for your consent before using them and update this policy first.
6. How long we keep your data
| Data | How long |
|---|---|
| Account, profile, portfolios and Academy records | While your account is open. When you ask us to delete your account, we delete this data within 30 days, except records we must keep by law. |
| Sign-in sessions | Up to 30 days. Signing out ends the session immediately. |
| Password reset links | Valid for one hour and usable once. |
| Usage records | About 13 months (400 days). After that we keep only monthly totals and a summary of activity per account, which is deleted with the account. |
| Email delivery events | Up to 12 months. |
| Consent records | While your account is open, and afterwards only as long as needed to prove the consent you gave. |
| Messages you send us | As long as needed to answer you and handle any follow-up. |
| Server logs | A limited period set by our hosting and network providers, usually a few weeks. |
Deleted data can remain for a short time in the backups of our database provider until those backups expire.
7. Your rights
Subject to the law that applies to you, you have the right to access your personal data, to have it corrected or updated, to have it deleted, to object to or restrict its processing, to receive it in a portable format, and to withdraw any consent you gave. You can edit your profile and email preferences yourself in Settings, and stop our periodic emails with the link in each one. For anything else, including deleting your account, write to support@quafi.io from the email address of your account. We may ask you to confirm your identity before acting on a request.
We answer requests for access within 10 calendar days and requests for correction, update or deletion within 5 business days, the periods set by Argentine Law 25,326, and in every case within the one month that the European General Data Protection Regulation allows.
The holder of personal data has the right to access that data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as established in article 14, paragraph 3 of Law 25,326. The Agencia de Acceso a la Información Pública (Argentina's Agency for Access to Public Information), as the supervisory authority for Law 25,326, has the power to hear the complaints and claims of anyone whose rights are affected by a breach of the rules on personal data protection. If you live in the European Economic Area or the United Kingdom, you can also complain to the data protection authority of your country.
8. Security
All connections to QUAFI are encrypted. Passwords are stored as salted one-way hashes, the session cookie cannot be read by scripts and is sent only over secure connections, and account data sits behind a separate service that the public web application cannot bypass, with database roles limited to what each part of the system needs. No system is completely secure. If a security incident affects your personal data, we will inform you and the competent authorities as the law requires.
9. Age limit
The Service is intended only for people aged 18 or over, as the Terms establish. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we will close it and delete its data.
10. Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change is material, we will tell you by email or in the Service before it takes effect.
11. Contact
For any question about this policy or your personal data, write to support@quafi.io or to QUAFI LLC, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, United States.
© 2026 QUAFI LLC. All rights reserved.