Privacy Policy

1. Who is responsible

Eric Wagner
c/o POSTFLEX PFX-146-499
Emsdettener Straße 10
48268 Greven
Deutschland
E-mail: quantfinancetogo@gmail.com

2. Visiting the site

When you open a page, your browser sends technical data to the server: your IP address, the date and time, the page requested and information about your browser and operating system. This is necessary to deliver the site and keep it secure (Art. 6(1)(f) GDPR). The data is kept in server logs for about one day.

The site is hosted by Vercel Inc., USA, which processes this data on my behalf. Vercel may process data outside the EU, including in the USA, and is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

3. Storage in your browser

The site saves in your browser your choice of light or dark mode, the module you opened last, how far you have read in each module, the modules and interview questions you tick as done and, if you are signed in, which account your ticks belong to. This only serves functions of the site that you use (§ 25(2) no. 2 TDDDG). Without an account, none of it is sent to me.

4. Your account

To buy a plan, you create an account. I then process your e-mail address and password, the plan you bought with its order number and refund status, the modules you tick as done, and for the limit of two devices a random device code, a short device name such as “Chrome on Windows”, when the device was first and last used and when you last removed a device. I need this to provide your account and your plan (Art. 6(1)(b) GDPR). An e-mail address and a password are required; without them I cannot open an account.

For signing in, the site stores technically necessary cookies: sign-in cookies that keep you signed in (up to 400 days), a device cookie for the device limit (up to 400 days) and a cookie that remembers for one hour which page to return to after signing in (§ 25(2) no. 2 TDDDG).

The accounts run on Supabase, which processes the data on my behalf. The database is stored in Frankfurt (Germany). My contract partner is Supabase Pte. Ltd., Singapore, with support and operations by Supabase, Inc., USA. Transfers to Singapore and the USA are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); you can get a copy from me. To protect the accounts, Supabase keeps sign-in logs with IP addresses for up to 7 days (Art. 6(1)(f) GDPR).

The site sends its e-mails through Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. This includes the confirmation of your account, the password reset and the confirmation of your purchase. Brevo processes your e-mail address and the content of these e-mails on my behalf (Art. 28 GDPR) and stores the data on servers in France and Belgium. Some subcontractors of Brevo are located in the USA, for example Cloudflare for network protection. These transfers are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

I keep your account until you ask me to delete it. A device that has not been used for 60 days is removed the next time you add a new device. After an account is deleted, I keep the record of a purchase as long as tax law requires (Art. 6(1)(c) GDPR) and as long as I need it to prove the purchase (Art. 6(1)(f) GDPR).

5. Buying a plan

The plans are sold by Paddle, which acts as reseller and merchant of record. For buyers in the EU and most other countries, the seller is Paddle.com Market Limited, London, United Kingdom. Buyers in the United States buy from Paddle.com Inc., and buyers in Canada from Paddle.com (Canada) Ltd. Paddle takes the payment and sends the invoice, and it also handles the sales tax and any refund. The bank statement shows PADDLE.NET* with a short name. The course, access to it and product support come from QuantFinanceToGo (details in the Legal Notice). Paddle processes your payment details and the data of your purchase as an independent controller under the Paddle privacy policy (paddle.com/legal/privacy). Paddle may process data outside the EU, for example in the United Kingdom and the USA, and bases such transfers on the safeguards described in that policy, such as the EU Standard Contractual Clauses.

The Paddle checkout opens on the pricing page only after you click the buy button. Only then does your browser load the checkout script from Paddle (cdn.paddle.com), and Paddle receives your IP address and technical data about your browser. This is necessary for the purchase you start (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG).

To link the purchase to your account, I pass your account number, your e-mail address, the plan and a reference number of your consent described below to the checkout. After the payment, Paddle tells me the plan, the order number, the amount paid and later any refund or chargeback, and I ask Paddle for the e-mail address used at checkout. I do not receive your full card or bank details. This is necessary to provide your plan (Art. 6(1)(b) GDPR).

Before you can buy, you tick a box to agree that access to your plan starts immediately (section 4 of the terms of use). When you click the buy button, I store the date and time, your account number, the plan and the version of the text you agreed to. I need this record to prove your consent and the early expiry of the right of withdrawal (Art. 6(1)(c) and (f) GDPR). If you buy the plan, I keep the record as long as the record of the purchase. If no purchase follows, I delete it after 30 days.

After your purchase, I send you an e-mail with your order details, the confirmation of your consent and the full terms of use, as the law requires (Art. 6(1)(b) and (c) GDPR).

6. Withdrawal and cancellation

You can withdraw from your contract online with the button “Withdraw from contract”. I then store your name, the contract you name and the e-mail addresses you enter. I also store the date and time I received your declaration. If you end your contract by e-mail, I keep that e-mail for the same purpose.

I use these details to carry out your request and to confirm it to you by e-mail (Art. 6(1)(c) GDPR). I keep them to be able to prove your declaration later (Art. 6(1)(f) GDPR). A copy of each declaration goes to my own e-mail inbox. I delete the records three years after the end of the year in which I received them (§ 195 German Civil Code).

To prevent misuse of the forms, the server counts the requests from each IP address for one hour in its working memory. It does not store the IP address with your declaration.

7. Contact by e-mail

When you write to me, I use your e-mail address and your message to answer you (Art. 6(1)(b) GDPR for questions about your account or plan, otherwise Art. 6(1)(f) GDPR). I delete the e-mails when they are no longer needed, unless statutory retention periods apply.

8. My profiles on YouTube, TikTok and Instagram

On these platforms, Google Ireland Limited (YouTube), TikTok Technology Limited (TikTok) and Meta Platforms Ireland Limited (Instagram) process your data under their own privacy policies. Where a platform shows me statistics about visits to my profile, I may be jointly responsible with it for that (Art. 26 GDPR). You can exercise your rights directly with the platform or with me.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). Send a short e-mail to the address above. You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR).

Right to object: Where I process data based on Art. 6(1)(f) GDPR, you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

Last updated: November 2026