QATS Privacy Policy

SHA-256 of the exact text

sha256:1d4671544b7311fb90969c5a6c1c34d3b5121eec1b82fdf6d67e91265abb3a64

Verify it yourself

Download the text the hash was taken over

1Who we are and what this notice covers

1.1QUANT ALGORITHM TREE SYSTEM LTD, company number 517208377, Maurizio Vitale 3, Apartment 22, Tel Aviv-Yafo 6965101, Israel (QATS, we or us), is the controller for personal data it processes to operate QATS Prop. Contact support@qats.us with Privacy request in the subject. This notice covers visitors, traders, applicants, affiliates, referred users, Builder users and people contacting support.

1.2Personal data includes information that identifies you or can reasonably be linked to you, including account-linked trading and device records. This notice explains our processing and your choices. Reading it, accepting trading terms or continuing to use the website is not consent to optional tracking, marketing or biometric processing.

1.3The Main Terms govern the service contract. They do not limit statutory privacy rights or the right to contact a competent supervisory authority. The Cookies and Storage Policy explains browser technologies. A separate notice is provided before an identity-verification workflow collects sensitive data.

2Information you provide and its sources

2.1Account and profile information includes email, username, legal name, telephone number, date of birth, residential address, country and eligibility declarations, authentication information and account preferences. Password authentication uses a salted password hash; we do not need your password in support correspondence. If you select Google sign-in, we receive the identity fields and authentication result authorised for that sign-in.

2.2Order and payment records include purchased plans and services, prices, discounts, invoices, subscription and renewal status, payment-provider references, authorised recurring-payment tokens where used, refunds, chargebacks, payout requests, beneficiary and bank or wallet details, applicable tax information and settlement evidence. Hosted payment providers collect card credentials in their own flow. QATS does not ask you to send full card details or security codes to support. A public blockchain transaction reference can disclose the destination and transfer details on a public explorer.

2.3Trading and Builder records include account identifiers, accepted rule snapshots, orders, positions, fills, marks, fees, funding, balances, performance metrics, breaches, reviews, strategy configurations, submitted code or logic, backtests, deployment instructions and API execution records. Connected services provide the transaction and integration information needed for the feature you activate.

2.4Identity verification may involve identity-document information, photos or video, liveness checks, biometric comparisons, verification results and screening signals as described in Section 5. Sources include you, the verification provider and relevant screening datasets. We also receive limited payment-dispute and fraud information from payment providers or other legitimate sources when needed to investigate a case.

2.5Communications include support messages, attachments, complaints, feedback and human or automated responses. Affiliate records include applications, approved channels, referral attribution, campaign schedules, commissions and payment details. Contract and choice evidence includes account or browser reference, exact document version and content hash, presentation and decision times, language, action source, required acknowledgments, user agent and the network address available to the service. Cancellation notices retain their receipt time, scope and contact information. This evidence is kept separately from optional activity monitoring.

3Technical information and optional activity data

3.1QATS and its infrastructure providers process IP addresses, user-agent and device information, request and event times, authentication and security events, and client error reports needed to maintain and protect the service. Error reports can include an error message and page path. Session inventories use account references, user agents and, for certain records, salted address digests or masked addresses. Other evidence, including contract acceptance, may retain the address supplied by the network infrastructure. Hashing or masking does not necessarily anonymise a record. Security processing may also include phone-verification code hashes and chat references, second-factor secrets, notification addresses and delivery logs, exchange credentials you explicitly supply, and linked-account signals derived from address digests or verified identity fields. Authorised support access and operator actions are logged; such access is limited to a supported service, security or compliance purpose.

3.2If you separately enable the signed-in activity trail, QATS records page paths, selected control labels, event times and limited event metadata to help investigate support problems. It is linked to your account. Essential order, payment and security evidence is processed separately. We limit diagnostic events to the stated purpose and exclude unnecessary field contents and credentials; if a label or path nevertheless contains personal information, it remains protected by this notice.

3.3Optional referral storage remembers a partner or Friend referral code, depending on the programme, capture time, visit identifier and landing path. This supports attribution and the relevant offer. A code you actively submit with a registration or purchase can be processed for that transaction without treating it as permission for unrelated tracking.

3.4The website has two independent optional categories, Analytics and Advertising. After Analytics consent, Google Analytics 4 through Google Tag Manager, PostHog and Microsoft Clarity receive their disclosed events or eligible-page replay. Advertising consent separately controls Meta Pixel and Reddit Pixel and any configured advertising uses of Google tags. Meta and Reddit receive only the permitted service-purchase and public conversion events, parameters and page-address information set out in Cookies and Storage Policy Sections 3.8 to 3.9(c); they do not receive the excluded withdrawals, logins, account-area activity, identity or contact contents. Advertising signals may still identify a browser and be linked by the recipient to its information. Clarity excludes /admin and all pages containing confidential or sensitive information; masking on other eligible pages is additional protection. The Cookies and Storage Policy states the detailed events, purchase and withdrawal parameters, recipients, domains, choices and retention disclosures. Neither optional category is implied by the other or by accepting trading or integration terms. Website tracking is distinct from extension processing described below.

3.5QATS Trade is an optional browser extension for operating a selected QATS account. On TradingView chart pages it reads the chart symbol, market type and available bid, ask and last quotations, approximately once per second while its chart connection operates. It also detects available internal chart functions and the positions of lines you move, to display the panel, map instruments, draw position and protection lines and support your trading instructions and local price checks. On QATS application pages its site bridge reads identifiers of accounts connected to the extension; that bridge does not receive OAuth tokens and rejects keys sent from the page. The extension is not designed to read cookies or unrelated website contents. Additional temporary page access is requested through a user action where supported. This description does not confer permission to use TradingView data contrary to its terms.

3.6The extension keeps OAuth access and refresh tokens in its background IndexedDB vault. Its local extension storage contains connected-account references without those OAuth tokens, a random installation identifier, settings, panel appearance and position, leverage and slippage preferences and cached chart-link information. If you manually enter an API key through Advanced settings, that key is also stored locally in the extension; it is distinct from the OAuth vault and is sensitive. The panel session stores the selected account. Local settings and cached chart information have no automatic expiry and remain until cleared or removed by extension or browser controls. Token validity is separate from deletion of stored bytes. The Cookies and Storage Policy extension inventory gives the current token validity and local controls.

3.7QATS receives the account and instrument requests and trading instructions sent by the extension, including orders, protection changes, close, reverse, cancel, modify and flatten instructions. Requests include authentication, request or idempotency identifiers and client version; connection uses the installation identifier and PKCE exchange data. Network requests also disclose connection information such as IP address and user agent. Extension service requests use QATS endpoints and do not send browser session cookies. Chart quotations used in a local comparison are not described as automatically transmitted: an order channel may include referencePrice and a deviation parameter if that channel actually sends them. QATS processes and retains a received reference price as part of the order record, not as a licence to collect or redistribute a TradingView feed. We do not use extension browsing or chart data for advertising, sell it or send it to website analytics or advertising pixels. Normal QATS website visits remain subject to their separate choices.

3.8A TradingView webhook delivers the alert message you configure to QATS, with request metadata and any credential placed in that message or its destination. QATS processes the permitted order fields and handling result, including rejected alerts. The current alert-history view is limited to the latest 50 records retained for up to 14 days; reaching the record cap may remove older entries sooner. A separately retained order, security or contractual record follows Section 9 rather than that short alert-history window. Credentials must be excluded from alert-history records and diagnostic logs. TradingView necessarily receives any message, script input or secret you enter on its service; QATS cannot delete it from TradingView by deleting a QATS record. Do not put a general trading API key, password, OAuth token or exchange secret in an alert, script input or URL. Use only a separately authorised secure connection design identified by QATS.

3.9QATS Ticket can prepare symbol, action, order type, price and reference price, quantity, stop-loss, take-profit, instruction identifier and source fields from your selected chart levels. Where you configure an alert, TradingView processes the script inputs and alert content and sends the configured message to QATS. Publicly publishing or sharing a script or screenshot can disclose included inputs. QATS does not control TradingView’s own retention. A private or invite-only distribution setting does not by itself establish compliance with TradingView’s terms.

3.10QATS trading API keys are scoped to one account and a disclosed read or trade mode, with selected validity of 1 to 90 days and optional IP restrictions. The secret is displayed once and the QATS authentication record retains a hash; a raw key can nevertheless exist in your client, bot or an external alert if you put it there. Revocation blocks subsequent authenticated requests but does not reverse accepted instructions. For Bybit Native, QATS receives the API key and secret supplied for the connection, stores the secret encrypted and uses the connection to read balance, equity, trades, funding and transfer records for account reconciliation and plan checks. The described reconciliation polls approximately every 15 seconds and also uses a private WebSocket. The secret is not returned by the connection API or intentionally written to logs. Removing the connection deletes its active stored credentials; the linked exchange UID and relevant historical records remain subject to Section 9. No withdrawal or transfer permission is needed. A read-only description is used only where actual permissions have been verified; lack of withdrawal permission alone does not establish read-only access.

3.11When you connect an integration or enable a separately acknowledged trading shortcut, QATS records your identity and account, source action, presentation and acceptance time, document identifiers, versions and hashes, the exact acknowledgment wording and language, the network address and user agent available to the service, client and extension version, and the related access grant and scope. Authorised staff may see the connection and acceptance status in internal account-management systems for support, security and compliance. This is operational and contract evidence, not optional advertising consent. Credential use is evidence to investigate, not conclusive proof that you personally authorised a disputed action.

4Purposes and lawful grounds

4.1We use account, order, trading, Builder and relevant communication records to create your account, supply purchased features, carry out your instructions, apply accepted trading rules, administer payments and Rewards, and respond to service requests. Where the GDPR or UK GDPR applies, we rely on performance of your contract or steps you request before entering it only to the extent that the processing is objectively necessary for that purpose.

4.2We use proportionate technical, trading, account and transaction records to prevent abuse, investigate disputed execution, maintain reliability and establish or defend claims. Our legitimate interests, where that basis applies, are account security, accurate transactions and fair application of accepted rules. We assess necessity and the impact on you, minimise the data and provide the objection route in Section 11. Fraud alerts and linked-account signals remain subject to review.

4.3We retain or disclose relevant financial, identity and transaction information where an applicable legal obligation requires it, including accounting, lawful authority requests and relevant sanctions restrictions. Identity checks also serve contractual eligibility and fraud prevention. The collection notice identifies whether the particular check is required by law, necessary for the requested service or optional; it does not describe every internal check as a statutory AML duty.

4.4Optional referral storage, diagnostic activity and configured Analytics use the separate choices described at the point of collection and in the Cookies and Storage Policy. We rely on consent for those purposes and for marketing where consent is required. A general Analytics choice does not authorise an undisclosed provider or session recording. Biometric identification also requires the condition applicable to sensitive data, including separate explicit consent where that is the applicable condition. Israeli law and other applicable mandatory rules govern collection, use and disclosure alongside any applicable GDPR or UK GDPR basis.

4.5Providing data is generally your choice unless a specific law requires it. Without core account information we cannot create or secure an account; without required payment or eligibility details we cannot complete the relevant transaction. Unresolved identity or beneficiary verification may prevent Reward payment. Ordinary hosted KYC is not a condition of Evaluation purchase or initial simulated funded activation. Declining optional tracking or marketing does not remove basic access to purchased services. Required and optional fields must be distinguished at collection.

4.6As described in the Main Terms, we also analyse recorded trading events to assess service performance, improve risk controls and conduct lawful research supporting QATS’s independent decisions. We use anonymous or aggregate data where sufficient. For necessary account-linked analysis, we assess legitimate interests where applicable and preserve your right to object. This does not authorise sale of identified trading history, reuse of biometric evidence for trading research or training on your private strategy source. The Bot Builder Terms and any separate required permission continue to apply.

4.7At collection, we provide the notice required for the particular data and workflow, identifying the controller and contacts, purposes, recipients and disclosure purposes, whether provision is legally required or voluntary, consequences of refusal and applicable access and correction rights. Where EU or UK transparency duties apply, the notice also covers the relevant lawful basis, retention, transfers and decision information. When information comes from another source, we give the required source and category information within the applicable time, unless a lawful exception applies. Any required data-protection officer or territorial representative and their actual contact details are identified in the applicable notice. A general policy acknowledgment does not replace a specific notice or required consent.

5Identity checks screening and biometrics

5.1We use hosted verification, including Didit where it is the provider identified for your workflow, to check identity, age, document authenticity, name matching and relevant fraud or sanctions indicators. We send the provider a verification reference and the information necessary for the configured check. The provider collects the document and other requested verification material through its hosted flow.

5.2If enabled and lawfully permitted, face comparison or liveness processing may collect a selfie, images or video, extract facial characteristics and compare them with a document portrait or other authorised reference. These activities may involve biometric data used to identify you. We receive the session reference, status, verified identity fields and relevant screening or review information; authorised review may also require access to supporting evidence.

5.3Before biometric capture, you receive a verification notice identifying the provider, checks, data, purposes, relevant recipients, retention or destruction arrangements and consequences of declining. Where we rely on explicit consent, we ask for a separate specific choice and record it before processing. Your general acceptance of the Main Terms or this notice does not supply it.

5.4If you do not wish to use a biometric route, contact support before starting. We explain any available lawful alternative and assess your request. If no suitable alternative is available, we explain which payment step cannot proceed and why. Declining does not automatically cancel an existing payment claim; any hold and remedy follow the Main Terms and applicable law. We do not rely on consent where the required standard of freely given consent cannot be met.

5.5Verification results can cause a hold, a request for more information or a refusal pending review. A potential screening match is not proof that you are the listed person or have committed wrongdoing. You may contest an inaccurate result and request human review. Submit identity documents only through the designated secure route, not ordinary support chat or email.

5.6Biometric retention is limited to the disclosed verification purpose, any separately authorised continuing use and applicable legal requirements. A retained template, secondary model-training use or a separate fraud-network purpose is not authorised by general acceptance of this notice. Where such processing is proposed, we explain it separately and establish the required lawful basis and permission before it begins. A provider notice does not replace our responsibilities. You may withdraw consent or request deletion through support; we explain any lawful exception and the consequences for future verification.

6Automation artificial intelligence and review

6.1The platform automatically compares execution and account data with accepted targets, loss limits, position limits and other rules. It can reject orders, lock trading, mark a breach or indicate that an Evaluation or payout condition has been met. Fraud controls can compare relevant identifiers, payment references, account relationships and trading patterns. These assessments may affect access or payment eligibility.

6.2The Evaluation and Trading Rules explain the account limits and measurements. You can ask us to explain a result, correct inaccurate input, consider your account of events and arrange review by a person with authority to change the result. That review must assess the evidence rather than merely confirm the automated output. We apply the restrictions and safeguards required by the law governing the decision, including the distinct EU and UK rules for significant solely automated decisions and sensitive data. General acceptance of these policies is not specific consent to such a decision. Where required, we provide meaningful information about the relevant inputs, decision logic and likely effects while protecting legitimate security information and other people's data. For a decision covered by EU GDPR Article 22, an ordinary Article 6 processing ground alone does not satisfy the separate exception and safeguard requirements. UK decisions are assessed under the distinct rules for significant automated decisions and special-category data. General acceptance or a merely formal review does not cure a prohibited decision.

6.3Where an AI support or trading-analysis feature is enabled, the relevant messages, conversation context or selected trading information may be processed by its model provider, including Google Gemini where identified for that feature. Generated responses can be inaccurate and do not themselves determine an appeal or legal entitlement. You can request human assistance. Do not include passwords, payment security codes, identity documents or other unnecessary sensitive information in an AI conversation.

6.4Private strategy material is processed subject to the Bot Builder Terms. This notice does not grant a new licence to publish strategies or train general-purpose models on identifiable private strategy content. Any separate model-improvement use must have its own lawful basis and comply with the applicable agreement and disclosures.

7Recipients and disclosure

7.1Authorised QATS personnel and service providers receive information needed for their functions. Hosting and storage providers process hosted records; verification providers receive identity and screening data; payment and payout providers receive transaction and beneficiary information; communications providers handle delivery details and message content; support and enabled AI providers receive the relevant conversation or analysis context; and security providers and advisers receive records necessary for protection or a specific professional task. We use appropriate access restrictions and contractual or legal safeguards.

7.2Configured integrations include Google Cloud hosting, the QATS account service, Google sign-in and outgoing email services, Google Gemini-assisted features, Didit verification, the Verifone payment bridge, Telegram notifications or verification, and WhatsApp Cloud API phone codes. Optional website recipients include Google Analytics 4, PostHog, Microsoft Clarity, Meta Platforms and Reddit under the separate choices and restrictions in Section 3.4 and the Cookies and Storage Policy. Google Tag Manager routes configured tags. Binance and Bybit provide market data and, only for a separately authorised service, exchange account information or execution. TradingView supplies an optional external chart and processes scripts and alerts configured on its service; the QATS Trade, QATS Ticket and webhook data flows are distinguished in Sections 3.5 to 3.11. The Builder can use separate QATS origins. Only recipients needed for your feature or valid optional choice receive the relevant data. Provider roles, international destinations and safeguards depend on the actual service and are explained in the relevant notice or available from support. A provider’s independent purposes do not remove QATS’s own duties.

7.3An approved commercial partner may receive only its own privacy-minimised attribution, commission and payment report under Affiliate Section 10.2: opaque references, any permitted masked contact identifier, relevant product and transaction date, eligible base, rate, commission and adjustment or payment status. This is not a customer-contact list. An ordinary Friend Inviter receives only benefit statuses such as pending, available, reserved, used or revoked and a non-identifying reference where necessary, not the Friend's identity, registration or purchase dates or purchase details. Before registration, the invitee sees the disclosed Inviter first name and offer under the Friend programme. Neither recipient receives identity documents, payment credentials, private strategy source or unrelated trading or payout history. Identifiable testimonials or performance promotion require the relevant separate permission or another lawful basis.

7.4If you authorise an external integration, we transmit the identifiers, instructions and results needed for it. Public blockchain payout details may be visible on the relevant network; do not assume a wallet address or transaction is anonymous. Only the data necessary for the selected route should be shared.

7.5We may disclose necessary information to authorities where legally required, to advisers or counterparties for a supported legal claim, or in a genuine corporate transaction subject to appropriate confidentiality and lawful-use safeguards. We do not sell extension data or identified trading history. Optional website advertising disclosures to Meta and Reddit are described in the Cookies and Storage Policy; depending on applicable law, an advertising disclosure may constitute sharing or targeted advertising even without payment. We honour applicable opt-out rights and legally required preference signals, as well as the Advertising choice. A blanket no-sharing statement does not override those disclosures.

8International processing

8.1QATS operates from Israel and uses infrastructure and service providers that may process information in other countries, including through support access and subprocessors. A hosting region in Israel does not mean that every verification, payment, AI or support record remains exclusively in Israel.

8.2Where transfer restrictions apply, we use the mechanism applicable to the actual transfer, such as a relevant adequacy decision or contractual safeguards, with the additional assessments and protective measures required. This includes applicable Israeli overseas-transfer rules and, where relevant, EEA standard contractual clauses or the relevant UK transfer arrangement. A provider’s public claim about a mechanism is not by itself proof that it covers your transfer. For a transfer governed by Israeli overseas-transfer rules, we obtain the required written recipient privacy undertaking and apply relevant outsourcing controls. Any onward disclosure must satisfy the applicable conditions and safeguards. Recognition of Israel as an adequate destination for an inbound transfer does not itself authorise a later transfer to a provider in another country.

8.3You may contact support@qats.us for information about the recipients, relevant destinations and safeguards applicable to your data, including an available copy or explanation of safeguards with confidential information appropriately protected.

9Retention and deletion

9.1We determine retention by the category, purpose and event that starts the period, such as account closure, transaction completion, verification, consent withdrawal or case resolution. We also consider an applicable statutory period, a supported dispute and a documented legal hold. We retain only the records needed for the remaining purpose. Account closure does not erase a valid debt, and the existence of a possible claim does not justify keeping every record indefinitely.

9.2Core profile and configuration data are kept while needed to provide the account and complete closure or a requested retrieval. After that, records retained for accounting, payments or contractual evidence are limited to the applicable statutory or justified claims period measured from the relevant transaction or event. Trading and decision evidence is retained for performance review, payout reconciliation and substantiated disputes. Optional diagnostics are not automatically assigned the longer period applicable to an invoice or a contract.

9.3The verification notice specifies the actual retention period or sufficiently precise criteria for identity evidence and biometric material before capture, including any legally required public destruction schedule. The period depends on the enabled check, applicable law and whether evidence remains needed for a specific review. Erasure is coordinated with the provider and covers relevant media and any separate biometric template unless a disclosed lawful exception applies. A session deletion is not treated as proof that every associated record has been erased.

9.4Support records are kept while resolving the case and for a justified subsequent complaint or claims period. Optional diagnostic events are kept only while relevant to their disclosed support purpose; withdrawal stops new optional collection and you may request deletion of existing records. Security logs use the period justified by incident detection and any actual investigation. Browser lifetimes are listed separately in the Cookies and Storage Policy. Backups remain subject to a controlled replacement cycle, restricted use and reapplication of deletion if restored.

9.5If a legal hold prevents deletion, we restrict the retained information to that purpose and review the hold. When no longer needed, records are deleted or irreversibly anonymised. Masking, pseudonymisation or ordinary hashing alone is not anonymisation. On request, we explain the applicable retention period or criteria, any remaining hold and the relevant deletion process for your record.

9.6Integration retention is separated by purpose. Local extension settings and cached chart-link data have no automatic expiry. The one-time OAuth code is usable for 60 seconds; access tokens are valid for 30 minutes; rotating refresh tokens expire after 30 days without use, within a grant lasting up to 180 days, subject to earlier revocation. These are authentication validity periods, not promises that every related log is deleted at expiry. Ordinary alert history is limited as stated in Section 3.8. QATS API keys expire within the selected 1 to 90 days or on earlier revocation. Active Bybit credentials are removed when the connection is deleted. Associated UID links, orders, rejected instructions, acceptance evidence and security records are retained only under the applicable contractual, security, accounting or supported claims criteria in Sections 9.1 to 9.5. There is no separate fixed integration-wide retention period asserted by this notice. The necessity of a retained UID link must be assessed separately from an active credential; an indefinite anti-abuse label is not by itself a retention justification.

9.7To stop extension access, revoke the QATS connection or key on the QATS account and remove the extension or clear its local data using browser controls. Removing the extension alone is not represented as server-side revocation. Revoking an OAuth grant does not revoke a separately created Advanced API key. Delete a Bybit connection in QATS and revoke the key in Bybit where appropriate; remove external alerts separately. Existing orders or positions do not disappear merely because a channel is disconnected. Request access, correction or deletion of associated server records under Section 11 at support@qats.us. QATS explains any retained records and lawful grounds; local clearing does not erase independently held TradingView or Bybit data.

10Security and communications

10.1We use measures appropriate to the data and risk, including protected transport, authentication, access controls, restricted handling of credentials and operational records, and incident response. No service can guarantee absolute security. We assess incidents and notify affected people and authorities where applicable law requires it.

10.2Authentication, security, billing, verification, execution, account and policy notices are service communications. Receiving them does not create marketing consent. We do not infer permission for promotional messages from registration or a transaction. If optional promotional messaging is introduced, its lawful choice and a functioning withdrawal route must be provided before use. You can object to marketing or withdraw a marketing choice at support@qats.us; necessary service notices may continue while relevant. We may keep a minimal suppression record on the applicable lawful basis for as long as needed to honour an opt-out and prevent re-import into a promotional list; it is not reused for promotion. A message containing promotion remains subject to applicable marketing rules even if labelled transactional or combined with a service notice.

10.3On a shared device, sign out and consider clearing browser storage. Some local preferences and cached account views can remain until removed. Protect your credentials and tell us promptly about suspected unauthorised access. Credential use alone does not conclusively establish that you authorised every action.

11Your rights and how to exercise them

11.1Under applicable Israeli law you may request access to personal information held about you and correction of information that is incorrect, incomplete, unclear or outdated, subject to the applicable procedure and exceptions. Other rights, including deletion rights for certain data or contexts, may also apply. Where the Israeli Privacy Protection Regulations concerning information transferred from the European Economic Area, 2023 apply, we also meet their additional deletion, necessity, accuracy and notification duties. Their coverage can include other personal data in the same covered database; nationality or residence alone does not decide applicability. We explain any lawful retention exception and the available request route.

11.2Where the GDPR or UK GDPR applies, rights may include access, rectification, erasure, restriction, portability for qualifying processing, objection to processing based on legitimate interests, and safeguards concerning significant solely automated decisions. You can object to direct marketing and withdraw consent without affecting processing lawfully carried out before withdrawal. Rights are subject to their legal conditions; they are not a guarantee of immediate deletion of every record.

11.3If an applicable US state privacy law covers our processing, its access, correction, deletion, portability, opt-out, sensitive-data and appeal rights apply as relevant. We do not assume that every state law applies simply because you live there. We will honour a legally required preference signal for any covered sale, sharing or targeted-advertising activity and will not unlawfully discriminate for exercising privacy rights.

11.4Send a request to support@qats.us, identifying the account and what you want us to do. You do not need to name a legal article or use a particular form. We may seek proportionate identity verification and evidence of an agent’s authority. Requests are normally free; any permitted refusal or fee is explained. We respond within the applicable deadline, ordinarily one month where EU or UK access-right rules apply, with any lawful extension or clarification pause explained. If we limit a request, we give reasons and the available review route.

11.5You may raise a privacy complaint at support@qats.us, including a complaint about how we handled a rights request. We acknowledge it, investigate the relevant facts and explain the outcome and any corrective action. Where UK data protection complaint duties apply, we acknowledge within 30 days and respond without undue delay; a shorter applicable deadline or commitment prevails. This acknowledgement period does not extend a separate rights-request deadline.

11.6You may contact the Israeli Privacy Protection Authority, a competent EEA supervisory authority or the UK Information Commissioner, as relevant, and use other statutory remedies. The regulator may have its own admissibility or complaint process. Our contract does not impose a requirement to exhaust an internal appeal or limit a regulator’s authority. Privacy rights are not waived by a contractual choice of Israeli law or courts.

12Children changes and further information

12.1The service is intended for adults aged 18 or over. If you believe a child has supplied personal data, contact us so we can investigate and restrict or delete it as required. We do not invite children to complete biometric verification as a way of gaining access to this adult service.

12.2We update this notice when practices or legal requirements change and provide appropriate notice of material changes. New purposes requiring consent are not authorised by merely publishing an update or by continued use. The version and effective date identify the notice applicable to a collection event.