Privacy Policy

1. Data Controller

The responsible data controller for processing personal information gathered on this website under the General Data Protection Regulation (GDPR) is:

2. What Data We Collect

We collect and process the following categories of personal information:

• Contact Information: Name and email address when you voluntarily submit a project inquiry via our contact form.
• Authentication Credentials: Name, email address, password hashes, or Google profile picture and sub ID if you authorize access using the Google OAuth client.
• Watchlist Analytics: Event IDs tracked on your calendar watchlist.
• System Logs: Anonymized IP addresses, browser agents, and access timestamps for security telemetry.

3. Purpose of Processing

Your personal information is processed strictly for the following purposes:

• To provide access to the secure developer dashboard workspace (Authentication).
• To answer, manage, and log project scoping details submitted through the inquiry form (Service Delivery).
• To prevent fraudulent attempts, injection attacks, or unauthorized bot access to our API routers (Security Telemetry).

4. Legal Basis (GDPR)

Under Article 6 of the General Data Protection Regulation (GDPR), we process your data based on:

• Consent (Art. 6(1)(a) GDPR): You explicitly consent to data processing when submitting forms or signing in via Google.
• Contract Fulfillment (Art. 6(1)(b) GDPR): Processing credentials is necessary to establish and secure your dashboard workspace account.
• Legitimate Interest (Art. 6(1)(f) GDPR): We log system telemetry to safeguard database tables and ensure server uptime.

5. Data Storage & Encryption

Your personal information is stored inside Cloudflare D1 SQLite database nodes located within the European Union (EU region). All database files are encrypted at rest. Telemetry caches are deleted automatically after 30 days.

6. Third-Party Infrastructure Services

To host the website and handle communications, we share necessary data fragments with:

• Cloudflare Inc.: Infrastructure hosting, DNS, and serverless Edge runtimes.
• Google LLC: Secure OAuth2 authentication services.
• Resend Inc.: Transactional email notifications and auto-replies.

7. Data Retention periods

We store your data only as long as necessary:

• Account Workspace profiles: Retained until you request account deletion.
• Contact Submissions: Retained for a maximum of 2 years to coordinate project inquiries.

8. Your Rights (GDPR Articles 15–21)

As a resident of the European Economic Area, you hold the following rights:

• Right of Access: Request copies of your processed personal data.
• Right to Rectification: Demand corrections of incorrect profiles.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your D1 user account.
• Right to Restriction: Object to processing on specific legitimate interest bases.

To exercise these rights, email us directly at [email protected].

9. Cookies & Trackers

AaroQuant does not use advertising cookies, marketing tracking nodes, or third-party behavioral analytics. We only store one first-party session cookie (NextAuth) to authenticate your dashboard access, which is exempted from cookie banner consents under EU directives.

10. Governing Law & Jurisdiction

This Privacy Policy and all data operations are governed by applicable data protection laws.

11. Third-Party Content & Jurisdiction

12. Risk Disclosure & Educational Purpose