Privacy Policy
Last updated: September 25, 2026
The short version
- We collect what we need to run your account, take payments, keep the terminal safe and understand which parts people use.
- We do not sell your data, we do not run ads and we do not use advertising or retargeting trackers.
- Your data is stored in the EU, on our servers hosted with AWS and Cloudflare, and it is protected by European data protection law. A few outside services handle specific jobs, and they are described below.
- What you type into the AI features and the support assistant is sent to an AI provider so it can answer.
- The chat rooms are public. Anything you post there can be seen by other users.
- You can ask for a copy of your data, or for it to be deleted, at privacy@qfiterminal.com.
1. Who is responsible for your data
QFI Labs LLC, the company operating QFI Terminal, is the controller responsible for the personal data described on this page. We operate from Portugal, so the EU General Data Protection Regulation (GDPR) and Portuguese data protection law apply to everything here.
If you have a question about your data, write to privacy@qfiterminal.com.
2. What we collect and why
The GDPR asks us to name a legal reason for each thing we collect. "Contract" means we need it to give you the service you signed up for. "Legitimate interest" means we need it to run the business in a way you would reasonably expect, and you can object to it. "Consent" means you chose it and can take it back.
| What | Why | Legal reason |
|---|---|---|
| Email address and name | To create your account, sign you in and write to you about it | Contract |
| Google or X account ID | Only if you sign in with Google or X, to link that login to your account | Consent |
| Password | Only if you sign up with email. We store a scrambled version (a hash) and never the password itself | Contract |
| Plan and billing history | To know what your account includes. Card details stay with Stripe | Contract |
| Watchlists, portfolios and settings | So the terminal remembers your setup on any device | Contract |
| Questions you ask the AI features | To answer them, to fix answers that went wrong and to stop abuse | Contract |
| Chat messages and Market Bias votes | To show them in the rooms, and to moderate | Contract |
| Answers to the welcome questions | If you answer them, to tailor what the terminal shows you and the offers you see | Consent |
| Support messages | To answer you, and to find out what our help pages fail to explain | Legitimate interest |
| Which tabs and screens you open | To understand which parts of the terminal people use, so we know what to improve | Legitimate interest |
| IP address, the country it points to, and your browser type | Security, blocking bots and abuse, and knowing roughly where visitors come from | Legitimate interest |
| Clicks on the main buttons of our website, and the campaign or referral link that brought you | To know which pages and campaigns work | Legitimate interest |
| The referral code you signed up with | So the person who referred you gets credit | Contract |
3. What we do not do
- We do not sell, rent or trade your personal data.
- We do not show ads, and we do not use advertising networks, tracking pixels or retargeting cookies.
- We do not use outside analytics services. The usage numbers we look at come from our own server.
- We do not make automated decisions about you that have legal or similarly serious effects.
4. The AI features
When you use the AI Screener or QFI Intelligence, the question you type is sent to the company that runs the AI model, so it can write the answer. The support assistant on our website works the same way.
- Please do not type personal details, passwords or information about other people into these features. They do not need it to answer.
- We keep your questions and the answers on our server, linked to your account, so we can look into answers that went wrong and spot misuse.
5. The chat rooms
The chat rooms are public inside the terminal. Your display name, your plan badge and what you post can be seen by everyone in the room and by anyone who reads the history later. Please keep your email, your account details and anything private out of the rooms. If you post something personal by mistake, write to us and we will remove it.
6. Emails
- We send emails you need, such as account confirmation, password resets and payment receipts. These are part of having an account.
- From time to time we also send news about the terminal and offers. Every one of those has an unsubscribe link that works with a single click, and unsubscribing does not affect your account.
7. Payments
Payments are handled by Stripe. Stripe collects your card details and billing address directly, and we never see or store your card number. We receive what we need to run your subscription: the plan, the amount, the status of the payment and the country used for tax. Stripe's own policy is at stripe.com/privacy.
8. Cookies
We use a small number of our own cookies. They keep you signed in, protect the sign in with Google and X, remember that you have already seen our home page, keep a referral code for 30 days and, if you accept it, tie a signup to the campaign that brought the visit. That last one is the only cookie the Decline button removes, because the others are needed for the site to work.
The only cookies set by other companies come from Google reCAPTCHA on the contact form, and from YouTube if you play a stream inside the terminal. Every cookie is listed one by one, with what it does and how long it lasts, in our Cookie Policy.
9. Who else handles your data
These services handle specific parts of your data for us. Each one is only allowed to use it for the job we give it.
- AWS and Cloudflare host our servers in the EU. Your account and everything the terminal does with it is stored and processed there.
- Stripe takes payments and handles tax and invoices.
- Google and X handle the sign in, if you choose to use them.
- Specialised service providers deliver our emails, write the answers of the AI features and the support assistant, and tell us which country an IP address belongs to. Each one receives only what that job needs.
- Google reCAPTCHA checks that the contact form is filled in by a person.
We may also share data when the law requires it, for example with a court or a regulator, or to protect our users from fraud.
10. Data that leaves the EU
Your data is stored in the EU and protected by European data protection law, the GDPR. Some of the services above are based in the United States, so part of what they handle can leave the EU. This covers the text you type into the AI features and the support assistant, the emails we send you, the IP address used for the country lookup and the payment details Stripe processes. When this happens we rely on the safeguards the GDPR provides, such as the EU and US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
11. How we protect it
- Everything between your browser and our server travels encrypted.
- Passwords and the "stay signed in" tokens are stored scrambled (hashed), and those tokens change every time they are used.
- The database tables that hold personal data have access rules at row level, and each part of the terminal only reads what it needs.
- Our endpoints check your session and limit how often they can be called, which slows down bots and scraping.
No system is perfectly safe. If a breach ever puts your data at risk, we will tell you and the data protection authority as the law requires.
12. How long we keep it
- Your account, and what belongs to it, for as long as the account exists.
- Records of which screens you open for 90 days.
- Technical performance logs for 30 days.
- Support messages, and the IP address they came from, for 90 days, after which they are deleted automatically.
- Payment and invoice records for as long as tax law requires us to keep them, which in Portugal is 10 years.
13. Deleting your account
You can close your account yourself in the terminal settings. That signs you out, stops the account from being used and cancels any renewal. Your paid plan stays active until the end of the period you paid for.
Closing the account does not erase your data straight away, so you can change your mind. If you want everything erased, write to privacy@qfiterminal.com from the email on the account. We will delete your personal data within 30 days, except the payment records the law makes us keep.
14. Your rights
Under the GDPR you can ask us to:
- Show you the personal data we hold about you and give you a copy.
- Correct anything that is wrong.
- Delete your data.
- Send your data to you in a format another service can read.
- Stop using your data for something based on legitimate interest.
- Pause using your data while a complaint is looked at.
Where you gave consent, you can take it back at any time. Write to privacy@qfiterminal.com and we will reply within 30 days. It costs nothing.
If you are not happy with how we handled your data, you can complain to the Portuguese data protection authority, the CNPD, or to the authority in the EU country where you live. We would appreciate the chance to fix it first.
15. Children
QFI Terminal is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has signed up, tell us and we will delete the account.
16. Changes to this policy
When we change how we handle your data in a way that matters, we will tell you by email or inside the terminal before the change takes effect, and the date at the top of this page will change.
17. Talk to us
For anything about your personal data, write to privacy@qfiterminal.com. For everything else, support@qfiterminal.com.