1. Controller and contact
The data controller is NovaQuant. Privacy enquiries: privacy@novaquants.co.uk. Customer support: support@novaquants.co.uk.
2. Information we may collect
- Identity and contact data: name, email address, billing country and contact details.
- Order data: product, price, currency, order reference, payment status, refund status and provider transaction reference.
- Licence data: licence key, activation status, permitted account identifiers and relevant MT5 account number. Do not send broker passwords.
- Support data: messages, diagnostic logs and technical information you choose to provide.
- Website and analytics data: IP address for security and rate limiting; after analytics consent, requested page path, referral origin, sanitised campaign tags, purchase-step events, coarse country/device/browser/operating-system categories and pseudonymous visitor and per-tab identifiers.
Hosted payment providers process payment credentials. NovaQuant should receive payment status and transaction metadata, not full card numbers, CVV values, private wallet keys or seed phrases.
3. Why we use information and lawful bases
- To take orders, deliver and administer licences, provide support and handle refunds: necessary to perform the contract or take requested pre-contract steps.
- To maintain transaction, tax and accounting records: necessary to comply with legal obligations.
- To secure the website, prevent fraud and enforce licence limits: legitimate interests, balanced against your rights.
- To record first-party website analytics after you choose “Allow analytics”: consent. Analytics is used only to understand page usage and improve NovaQuant services, not for advertising or profiling.
- To establish, exercise or defend legal claims: legitimate interests and applicable legal obligations.
- To send optional marketing: consent where required. Marketing consent must be separate and unticked by default.
4. Who receives information
Information may be shared only as needed with Supabase for customer authentication, database, storage and licensing infrastructure; Cloudflare for website hosting and security; Stripe for card and supported wallet payments; BTCPay Server and the relevant blockchain network for crypto payments; Resend for authentication and order emails; TikTok only when you choose to load an embedded TikTok post; accountants; professional advisers; fraud-prevention services; and public authorities where legally required.
We do not sell personal information.
5. International transfers
Some providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards, we will use an adequacy regulation, approved contractual protection or another lawful transfer mechanism and make further information available on request.
6. Retention
Order, contract and accounting records are normally retained for up to six years after the relevant relationship or transaction, unless a longer or shorter period is legally required. Licence records are retained while the licence is active and for a reasonable period afterwards for fraud prevention, support and disputes. Support and security data is retained only as long as reasonably needed for those purposes. Individual consented analytics events are automatically deleted after 90 days; aggregated daily totals without browser identifiers are retained for up to 24 months.
7. Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict personal information, object to processing, receive portable data and withdraw consent. Withdrawing consent does not affect earlier lawful processing.
Contact privacy@novaquants.co.uk. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
8. Cookies, analytics and local storage
The customer portal stores an authentication session in local storage so signed-in customers can access account functions securely. Full licence keys are not intentionally stored there. NovaQuant does not use advertising trackers.
Analytics remains off until you actively allow it. If allowed, the browser stores a random visitor identifier for up to 30 days, a random per-tab session identifier and sanitised first/last campaign attribution. NovaQuant records allowlisted page, showcase-engagement and purchase-step events, clean paths without query strings or fragments, referral origin and coarse technical categories. It does not attach browsing events to your email or customer account, store full referrer URLs or retain your raw browser user-agent. The server replaces both identifiers with separate keyed one-way digests and does not store your IP address with analytics events.
The Updates & snapshots section uses a NovaQuant-hosted preview for TikTok posts. TikTok is not contacted merely because you visit the page. If you choose Play on TikTok, your browser loads TikTok’s player and TikTok may receive your IP address, browser information and use cookies or similar technologies under its own privacy terms.
Select Privacy choices on any page to withdraw consent; this stops future analytics and removes the analytics identifiers. Supabase and hosted payment providers may use strictly necessary storage or cookies for authentication, security and checkout under their respective notices.
9. Security
We use proportionate technical and organisational controls and minimise browser-side payment handling. No internet service can be guaranteed completely secure. Never email passwords, API secrets, private keys or seed phrases.
10. Automated decisions and children
NovaQuant does not currently make legal or similarly significant decisions about customers using solely automated processing. NovaQuant GoldEdge is not offered to children and purchases require the customer to be at least 18.
11. Updates
We will update this notice when providers or processing change. Material changes will be highlighted where appropriate, and the effective date will be revised.