1. Who is the controller
QuantumAPI is operated by Victor Zaragoza Lluch, an individual based in Dublin, Ireland, who acts as data controller for the data described in this policy (website visitors, account holders, billing contacts).
When you store your own content or your own users' data in QuantumAPI, you are the controller and we act as your processor. In that case we process the data only on your documented instructions. A data processing agreement is available on request at privacy@quantumapi.eu.
Data protection contact (DPO): privacy@quantumapi.eu. No separate DPO has been appointed; this address is monitored by the person responsible for data protection.
2. Data we process
- Account and organization data: name, email address, organization name, role, language, and the hashed credentials and MFA settings needed to sign in.
- Billing data: billing name and address, VAT ID and payment status. Card and bank details are handled by our payment processor and never stored by us.
- Usage and technical data: API request metadata (timestamps, endpoint, API key name, response status, call counts), IP address and user agent, and a trusted-device cookie used by MFA.
- Audit and authentication logs: who did what to which resource, and sign-in events, kept for security and accountability.
- Content you store: secrets, keys and other objects you upload. They are stored encrypted at rest and processed only to provide the service.
- Communications: messages you send through the contact form or by email.
- Website analytics: pseudonymous usage statistics, collected only if you accept analytics cookies (see the Cookie Policy).
3. Why we process it and on which legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, providing the API and portals | Contract, Art. 6(1)(b) |
| Billing, invoicing, accounting and tax records | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Security, abuse and fraud prevention, rate limiting, audit trails | Legitimate interests, Art. 6(1)(f) |
| Answering support, sales and privacy requests | Contract or legitimate interests, Art. 6(1)(b) and (f) |
| Service operation and improvement based on aggregate usage | Legitimate interests, Art. 6(1)(f) |
| Website analytics cookies | Consent, Art. 6(1)(a), which you can withdraw at any time |
4. How long we keep data
| Data | Retention |
|---|---|
| Account and organization data | While your account is active; deleted or anonymized after closure, except where the law requires us to keep it |
| Billing and invoice records | As long as tax and accounting law requires |
| Audit and authentication logs | 365 days by policy (never less than 90 days); configurable for dedicated or on-premises deployments |
| Application and infrastructure logs | 30 days |
| Content you store (secrets, keys) | Until you delete it or close the account; removed from backups when they expire |
| Contact and support messages | As long as needed to handle the request and any follow-up |
| Analytics cookies | Up to 2 years (cookie lifetime), only with your consent |
5. Who receives your data
We do not sell personal data. We share it only with the infrastructure and service providers listed on the sub-processors page (cloud hosting, payment processing, container registry, TLS certificates) and, if you accept analytics cookies, with Google for website statistics. We give customers at least 30 days notice before adding or replacing a sub-processor, and you may object.
We may disclose data when required by law or to protect the security of the service.
6. International transfers
Customer data is stored and processed in the European Union. Two sub-processors (the GitHub container registry and Let's Encrypt) are based in the United States but do not process customer data. If you accept analytics cookies, Google may process website usage data outside the EU; such transfers rely on the European Commission adequacy decision for certified US recipients or on Standard Contractual Clauses.
7. Your rights
To exercise a right, write to privacy@quantumapi.eu. We respond within 30 days; if a request is complex we will tell you why and may extend by up to two further months as GDPR allows. We may ask you to verify your identity first.
You also have the right to lodge a complaint with a supervisory authority. For Ireland this is the Data Protection Commission (dataprotection.ie); you may also contact the authority of your own country of residence.
- Access the personal data we hold about you and receive a copy.
- Have inaccurate data corrected and incomplete data completed.
- Request erasure of your data, where no legal obligation or legitimate ground requires us to keep it.
- Request restriction of processing, or object to processing based on legitimate interests.
- Receive your data in a structured, machine-readable format (portability).
- Withdraw consent at any time, for example by changing your cookie preferences.
8. Security
Data is encrypted in transit (TLS) and at rest, and keys are protected with post-quantum key encapsulation. Access is restricted by role and every administrative action is logged. No system is perfectly secure; if a personal data breach affects you we will notify you and the competent authority as GDPR requires.
9. Cookies
We use strictly necessary cookies and, only with your consent, analytics cookies. The Cookie Policy lists each cookie and lets you change your choice.
10. Children
The service is intended for businesses and developers and is not directed to children under 16. We do not knowingly collect their data.
11. Changes to this policy
We will update this page when our processing changes and revise the date above. For material changes we will notify account holders by email at least 30 days beforehand.
12. Contact
Privacy questions and data requests: privacy@quantumapi.eu. General questions: hello@quantumapi.eu.