Privacy Policy

Last updated: September 2026

Who we are

Quantum Encoding Ltd ("we", "us", or "our") is the data controller for the personal data described in this policy — covering the Quantum Encoding API and this site. We are registered in England and Wales, Company No. 16575953, with our registered office at 33 Oxford Street, Coalville, LE67 3GS, United Kingdom. Privacy contact: info@quantumencoding.ai.

Services on the broker subdomain (broker.quantumencoding.ai) are provided by Quantum Encoding Europe Limited (Company No. 807205, The Black Church, St. Mary's Place, Dublin, D07 P4AX, Ireland), which is the data controller for personal data processed there under its own privacy policy.

1. What we collect

Account & identity: your email and name, and — depending on how you sign in — a hashed password or an identifier from your Google, Apple, or Firebase sign-in. If you enable them, a phone number and a mobile push token. Where you sign in with Apple, we store an encrypted Apple token so the login keeps working.
Usage data: your prompts and mission inputs, the outputs produced, the models you select, token counts, and costs. Conversations you run inside a saved session are stored so the assistant can continue them. Stateless API calls are not stored, apart from a short-lived (about one hour) semantic cache that speeds up repeated requests.
Billing data: a Stripe customer ID and the transaction identifiers for your purchases (from Stripe, Apple, or Google). We never receive your card number.
Technical data: IP address, browser / user-agent, and session identifiers, kept on session records for up to 30 days and used to keep you signed in and to prevent abuse.
Content you create: files, generated media, and any documents you add for retrieval (RAG).

2. What we do with it

Operate your account and authenticate you
Provide and improve the service
Process billing and credit transactions
Keep aggregate usage analytics (tokens, cost, latency) — never the content of your messages
Monitor for abuse and enforce our terms
Send service-related communications (no marketing spam)

3. What we don't do

We don't sell your data. Ever.
We don't run third-party analytics trackers or advertising pixels, and we set no advertising cookies.
We don't train AI models on your inputs, and our hosting providers don't either.

4. Who we share data with

We share personal data only with the providers needed to run the service, each acting under its own terms. We don't share it with anyone else.

AI model providers. When you run a task, your inputs go to the provider behind the model you selected — and only that one: Anthropic (Claude), OpenAI (GPT), xAI (Grok), Google (Gemini / Vertex AI), DeepSeek, Z.AI (GLM), Alibaba Cloud (Qwen / DashScope), and models served through Cloudflare Workers AI. Media features use ElevenLabs (voice), Meshy (3D), and HeyGen (avatar & video).

A note on training. For the frontier providers (Anthropic, OpenAI, Google, xAI) we use API access configured not to train on your inputs. Some providers — notably DeepSeek, Z.AI, and Alibaba (Qwen) — operate under their own regional terms, which we don't control; if you'd rather your inputs didn't reach them, choose a model from another provider.

Infrastructure & billing. Google Cloud (hosting, database, usage analytics, and media storage), SurrealDB Cloud (semantic cache and retrieval index, hosted on AWS in the EU), Cloudflare (network and proxy), Stripe (card payments — Stripe handles the card data, we never see it), Apple and Google (in-app purchases and sign-in), and Resend (transactional and contact email).

5. International transfers

Selecting a model routes your inputs to that provider's own infrastructure and jurisdiction. Our own systems run in the UK, EU, and US. Providers include ones in the US and — for DeepSeek, Z.AI, and Alibaba (Qwen) — jurisdictions outside the UK/EEA, including China. Where we can, we rely on providers' Standard Contractual Clauses or equivalent safeguards for transfers out of the UK/EEA; where a provider operates under its own regional terms, your choice of model is what controls where your inputs go, so choose accordingly.

6. Data retention

Account data: kept while your account is open.
Conversations & generated content: deleted when you delete a session, and fully purged within 30 days of account deletion.
Semantic cache: about one hour.
Session & technical records: up to 30 days.
Billing & financial records: retained for up to 6 years to meet UK tax and accounting law, in pseudonymised form after your account is deleted.

7. Security

Encrypted connections (TLS), hashed passwords, encrypted secrets, and role-based access controls. We take it seriously. No system is 100% secure, but we don't cut corners on this.

8. Your rights

Under the UK GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. You can delete your account — and its content — at any time from your account settings or by asking us; for access, correction, or a copy of your data, email us and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

9. Contact

Privacy questions: info@quantumencoding.ai
By post: Quantum Encoding Ltd, 33 Oxford Street, Coalville, LE67 3GS, United Kingdom