1. Who is responsible
The controller of your personal data is GALAXICA LLC, the company that operates Quantiko.
- Operator
- GALAXICA LLC
- Incorporated in
- Wyoming, United States (limited liability company)
- Company number
- 001344437
- Registered address
- 30 N Gould St, Ste 37977, Sheridan, WY 82801, USA
- Contact
- Contact form
For any privacy question or request, use our contact form and choose “Privacy / data request”, or write to us at the postal address above.
2. Data we collect
Account data
When you create an account: your email address, your name if you choose to give it, and your password — stored only as a one-way bcrypt hash, never in readable form. We also record which invite was used and when the account was created.
Waitlist data
When you request an invite: your email address, and optionally your name and a short message about what you would use Quantiko for, plus the date and the status of your request.
Contact form data
When you write to us through the contact form: your name, your email address (so we can reply), the topic you choose and your message, plus the date and whether we have read or archived it. If you are signed in when you send it, we also link the message to your account.
Your content
- The tasks you submit and the messages in your conversations, including the AI's answers, and conversation titles.
- For attachments: only the file name and an estimated page count. Quantiko does not currently upload, read or store the contents of attached files.
Routing metadata
For each answer: the type of task, which model was chosen and why, the scores of the models considered, and whether the answer was produced by a live model.
Technical data
When you visit the site, our hosting provider automatically processes technical data such as your IP address, browser user agent, the pages requested and timestamps, and keeps request logs for security and troubleshooting.
Cookies and local storage
Essential cookies to keep you signed in and protect forms, and small preference values in your browser. See our Cookie Policy for the full list.
3. Purposes and legal bases
| Why we use data | Legal basis (GDPR) |
|---|---|
| Creating and running your account; routing your tasks and showing answers; keeping your conversation history | Performance of our contract with you (Art. 6(1)(b)) |
| Managing the waitlist and sending you an invite | Steps at your request before entering a contract (Art. 6(1)(b)) and our legitimate interest in opening access fairly (Art. 6(1)(f)) |
| Security, preventing abuse and fraud, debugging, enforcing our terms | Legitimate interests (Art. 6(1)(f)) |
| Replying to messages you send through our contact form, and handling your requests | Steps taken at your request (Art. 6(1)(b)) or our legitimate interest in answering the people who contact us (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Anything not covered above (e.g. optional analytics, if ever introduced) | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
We don't make decisions about you that produce legal or similarly significant effects based solely on automated processing. Routing only decides which AI model answers a task.
4. Processors and recipients
We share personal data only with service providers that help us run Quantiko, and only what they need:
| Provider | Role | Data |
|---|---|---|
| Vercel Inc. (USA) | Website and application hosting. Application functions run in the EU (Frankfurt, Germany). | All data passing through the app; request logs incl. IP address |
| Supabase Inc. (USA) | Database hosting, on AWS in the eu-central-1 region (Frankfurt, Germany) | Account, waitlist, contact-form, conversation and routing data |
| Anthropic PBC (USA) | AI model provider (Claude) | Task content, only when its model is chosen |
| OpenAI (USA) | AI model provider (GPT) | Task content, only when its model is chosen |
| Google LLC (USA) | AI model provider (Gemini API) | Task content, only when its model is chosen |
| Mistral AI SAS (France) | AI model provider (Mistral) | Task content, only when its model is chosen |
What AI providers receive: the task text, relevant earlier messages in that conversation and the names of any attached files — sent only to the provider of the model chosen for that task. Your email, name and password are not sent to AI providers.
We may also disclose data where required by law, to protect rights and safety, or to a successor if Quantiko is transferred as part of a business sale (you will be informed). We do not sell your personal data, and we don't share it for advertising.
5. Where your data is processed
Quantiko's app servers and database are located in the EU (Frankfurt, Germany). Static pages may be delivered from Vercel's global edge network, close to where you are.
AI providers may process your prompts outside the EU, for example in the United States. Several of our providers (and our hosting providers) are US companies. Where personal data is transferred outside the EU/EEA or the UK, we rely on appropriate safeguards where applicable — such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (and UK equivalents). You can ask us for more information about these safeguards.
6. AI training
Quantiko itself does not use your content to train AI models. Your tasks are sent to AI providers through their business/API services, under their terms. These providers' API terms generally state that API data is not used to train their models by default, but they may retain it for a limited period, for example to detect abuse. Each provider's privacy policy and API data-usage terms, published on its own website, describe this in detail.
7. How long we keep data
- Account data: for as long as your account exists; deleted when your account is deleted.
- Conversations and routing metadata: until you ask us to delete them or your account is deleted. There is no in-app delete button yet — send a request through our contact form and we will delete specific conversations or your whole account.
- Waitlist entries: until we invite or decline you, and then for a reasonable period (normally no longer than 12 months) to manage invites and avoid duplicates — or sooner if you ask.
- Contact messages: for as long as we need to deal with your message, and then for up to 24 months after the conversation ends, so we have the context if you get back in touch — or sooner if you ask us to delete them.
- Server logs: kept for a limited period according to our hosting provider's log retention.
- AI providers: may retain API inputs and outputs for a limited period under their own terms (see section 6).
We may keep data longer where the law requires it, or to establish or defend legal claims.
8. Your rights
Depending on where you live (in particular under the GDPR and UK GDPR), you have the right to:
- access the personal data we hold about you and get a copy;
- rectify inaccurate data;
- erase your data (“right to be forgotten”);
- restrict how we process it;
- data portability — receive your data in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent;
- complain to a supervisory authority, in particular in the EU/EEA country where you live or work (or the ICO in the UK).
To exercise any of these, use our contact form (choose “Privacy / data request”) and enter the email address linked to your account, or write to us at GALAXICA LLC, 30 N Gould St, Ste 37977, Sheridan, WY 82801, USA. We will respond within one month, and may need to verify your identity first. Exercising your rights is free.
9. Security
We use appropriate technical and organisational measures, including:
- passwords stored only as salted bcrypt hashes;
- encrypted connections (HTTPS/TLS) between your browser, our servers, the database and AI providers;
- signed, encrypted session cookies, and access controls so each account can only see its own conversations;
- restricted administrative access, limited to what is needed to run the service.
No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
10. Cookies and tracking
We use only strictly necessary cookies and preference storage — no analytics, no advertising and no third-party tracking. Fonts are served from our own servers, so your browser makes no requests to third-party font services when you visit. Details are in our Cookie Policy.
11. Children
Quantiko is not directed at children. You must be 18 or older to use it (see our Terms), and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Notice for US and California residents
We collect the categories of personal information described in section 2 (identifiers such as email and IP address, account credentials, and the content you submit) for the purposes in section 3. We do not sell or “share” personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. You may request to know, correct or delete your personal information through our contact form, and we will not discriminate against you for doing so.
13. Changes to this policy
We will update this policy when our practices change — for example if we add a new provider. The date at the top shows the current version, and we will notify you of material changes before they take effect.
14. Contact
For privacy questions and requests, use our contact form and choose “Privacy / data request” — we'll reply by email.
By post: GALAXICA LLC, 30 N Gould St, Ste 37977, Sheridan, WY 82801, USA · Company no. 001344437