01Scope and controller
This notice covers personal data processed by Quantstream SRL for all our websites, mobile applications, digital products and services that link to it. It applies to existing services and to new services when introduced. Only the sections relevant to the features you use apply. A feature-specific notice will explain any additional processing before it begins; this notice is not permission to collect data for unspecified future uses. Quantstream SRL is the controller for these activities. Contact privacy@quantstream.ro or write to Intr. Pristolului, No. 7, Apt. 2, Sector 3, Bucharest, Romania. Where we process data solely on behalf of another organisation, that organisation’s privacy notice identifies the controller and explains your rights.
02Names, email addresses and user accounts
When you register, we collect the name or display name and email address you provide, together with authentication details, an account identifier and records of account preferences and terms acceptance. We use registration details to create, verify, operate and secure your account, enable sign-in and account recovery, associate your saved information with you, and send necessary account or service messages. These details are not collected for advertising, sold, or used to train general-purpose AI models. Your email address is not included in your public profile by us. If you use community or sharing features, your chosen display name or username may identify your profile and contributions to other users; it need not be your legal name unless a particular service explains a genuine need. Account creation and ongoing account administration—not just the initial registration—are the purpose of collecting these details.
03Other information and its sources
We receive information directly from you when you edit a profile, save content, contact support or use a feature. Depending on the service, this may include profile photos, preferences, notes, images, voice recordings, messages, activity records, saved places, routes and sharing choices. Other users may provide content or interactions involving you. If a third-party sign-in option is offered and you choose it, that provider supplies the identifiers and profile information described in its authorisation screen. App stores or payment providers may supply transaction and entitlement records; they handle payment-card details. Our systems and service providers also receive technical data such as IP addresses, device or app information, timestamps, authentication events and error or security logs. We use these categories only for the relevant purposes described below, not merely because you have an account.
04Purposes and legal bases
Accounts and requested features — contract, Article 6(1)(b) GDPR. We process the data objectively necessary to provide the account or feature you request, including authentication, saving and syncing your content, and fulfilling a purchase where applicable. Security and support — legitimate interests, Article 6(1)(f). We process necessary technical records and correspondence to prevent fraud and misuse, diagnose faults, answer general enquiries and protect or defend legal rights. We assess these interests against your rights and minimise the data used. Support needed to fulfil your service contract may instead rely on Article 6(1)(b). Legal duties — Article 6(1)(c). We retain or disclose information when applicable law requires it, for example accounting obligations and responding to valid legal requests. Optional processing — consent, Article 6(1)(a), where required. We ask separately for a specific optional purpose, such as non-essential tracking or optional marketing if introduced. You can refuse or withdraw such consent without losing unrelated account features. Reading this notice or accepting the Terms is not blanket consent to optional processing.
05Required details, device permissions and optional features
Required fields are identified when information is collected. A working email address and authentication details are necessary for an email-based account; without them we cannot create or maintain that account. You can browse this presentation website without an account. Additional profile details and user content are needed only for the features that use them. Location, camera, selected-photo and microphone access depend on device permissions and the feature you activate. Location may be used on the device or included in saved or shared activity where the feature explains this. You can change permissions in device settings; affected features may then stop working. A device permission does not itself replace the GDPR legal basis or authorise unrelated processing. Avoid adding sensitive information about yourself or others unless a service expressly supports and explains that use.
06Who can receive information
Access is limited to authorised personnel and providers who need data to deliver the relevant service. Recipient categories include authentication, database and storage providers, hosting and infrastructure providers, transactional email and support providers, and app-store or payment operators where used. Our current app infrastructure includes Supabase for authentication, database and media storage. Providers acting as processors must act under appropriate data-processing terms and our instructions; independent providers, such as an app store acting for its own purposes, also have their own privacy notices. Map or other external content providers may receive technical connection data when their content is requested. Other users receive profile or content information according to the service’s visibility rules and your sharing choices; public information may be copied by others. We may also disclose necessary information to competent authorities where legally required, professional advisers for legal claims, or a successor in a business transfer with appropriate safeguards. We do not sell your personal data.
07International transfers
Depending on the provider and service, personal data may be processed in the European Economic Area (EEA) or accessed from countries outside it. For transfers subject to GDPR Chapter V, an appropriate transfer mechanism is required: for example, an applicable European Commission adequacy decision or the Commission’s standard contractual clauses, with an assessment and supplementary safeguards where needed. A provider’s location alone is not a guarantee that all access remains in the EEA. Contact privacy@quantstream.ro for information about the recipients, relevant destinations and applicable safeguards for the service you use, including how to obtain a copy of those safeguards, subject to necessary redactions.
08Retention and account deletion
We retain identifiable data only for the purpose that justifies keeping it. Account and saved-content records are generally kept while your account is active and the records are needed to provide the service, or until you request deletion. Support correspondence is retained for resolving the enquiry and any related dispute; security logs for investigating incidents and preventing abuse; and transaction or legal records for the applicable statutory retention or limitation period. Relevant criteria include the type of record, whether the matter is still open, the need to establish or defend legal claims, and the applicable legal obligation. You may request the period or criteria for a particular record. To request account and associated data deletion, email privacy@quantstream.ro, identifying the service and account. We explain any lawful exception rather than treating deletion as unconditional. Signing out or uninstalling does not delete cloud data or cancel an app-store subscription. Removing content from view may precede its removal from storage. Residual backups may persist until their scheduled expiry and must not be used for ordinary service activity; legally retained records remain restricted to their permitted purpose.
09Security
We use technical and organisational measures proportionate to the data and risks, including access restrictions and authentication controls. Providers and authorised personnel should receive only the access needed for their work. No service can guarantee absolute security. If a personal-data breach occurs, we assess it and notify the competent authority and affected individuals when the GDPR requires this. Protect your sign-in details and contact us if you suspect unauthorised access.
10Your GDPR rights and how to exercise them
Subject to the GDPR conditions, you can request access and a copy, correction, erasure, restriction, or portability of data processed by automated means on the basis of consent or contract. You may object to processing based on legitimate interests for reasons relating to your situation; we must stop unless a permitted overriding ground or legal-claims exception applies. You may object to direct marketing at any time. Where processing relies on consent, you can withdraw it as easily as you gave it, including by contacting us; withdrawal does not affect earlier lawful processing. Send requests to privacy@quantstream.ro. We may request proportionate information if we reasonably need to verify identity. We respond without undue delay and within one month. For complex or numerous requests, this may be extended by up to two further months, with reasons given within the first month. Requests are normally free; any lawful fee or refusal for a manifestly unfounded or excessive request must be justified. If we cannot grant a request, we explain why and your routes to challenge the decision.
11Complaints and automated decisions
You can lodge a complaint with ANSPDCP, Romania’s data-protection authority, or a supervisory authority in the EU/EEA country of your habitual residence, workplace or the alleged infringement. You do not have to contact us first and may seek a judicial remedy. Our account services do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If a future feature involves such processing, we will first explain its legal basis, logic, significance, expected consequences and applicable safeguards, including human intervention and contesting a decision where required.
12Cookies, AI features and children
This presentation website does not set analytics or advertising cookies or add non-essential tracking. Hosting providers may process technical delivery and security logs. Applications may store authentication sessions, preferences and downloaded content as needed to function. If non-essential tracking or an AI feature processing your personal information is introduced, we will explain its purpose, provider, data use and controls before you use it, and obtain consent where required. AI-assisted editorial illustrations or guides do not require using your account details to train models. Our general services are not directed to children under 13. Where a service relies on a child’s consent, the applicable national age threshold and parental-authorisation requirements also apply; being 13 does not automatically mean a child can consent. Contact us if you believe a child’s information has been collected improperly.
13Changes to this notice
We date revisions and provide appropriate notice of material changes. If we propose a new use of personal data, we explain it before that processing begins, assess the appropriate legal basis and obtain a new consent where required. A policy update alone does not authorise a new purpose or remove your existing rights.
Questions? Get in touch ↗