← Legal

Privacy Policy

Quantum 2x Ltd — Last updated: June 2025

1. Who We Are

Quantum 2x Ltd (“Q2X”, “we”, “us”, “our”) is a company registered in England and Wales (Company Number: 16383370) with its registered office at 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE. We operate the MPP Registry at this website.

Q2X is the data controller for personal data processed through this website and the MPP Registry service. Our contact email for data protection enquiries is support@quantum2x.com.

2. Data We Collect

2.1 Account Data

When you create an account: name, email address, organisation name (optional), and a hashed password.

2.2 Billing Data

Payment information is processed by Stripe. We do not store full card numbers. We store your Stripe Customer ID, subscription status, and billing address for invoicing purposes.

2.3 Usage Data

We record registry API call counts (attestation verification requests — not the content of those requests or downstream tool invocations), package download records, API token usage, and session timestamps. This data is used to operate the service, enforce plan limits, and generate your usage dashboard. We do not track how many times an attested tool is invoked inside your own infrastructure.

2.4 Audit Log Data

When you use the MPP runtime, each invocation is recorded in an append-only audit log associated with your tenant. This log is your data — we do not use it for our own analytics.

2.5 Contact Form Data

If you use the contact form, we collect your name, email address, and message. This data is used solely to respond to your enquiry.

2.6 Technical Data

IP addresses, browser type, and device information collected during normal HTTP request processing. Retained in server logs for up to 30 days for security and debugging purposes.

3. Legal Basis for Processing

We process your data on the following bases:

  • Contract performance — account data, billing data, and usage data are necessary to provide the service you have subscribed to.
  • Legitimate interests — technical data and security logging, where our interests in securing the service do not override your rights.
  • Consent — analytics cookies (if you accept them via the cookie banner).
  • Legal obligation — where required by law (e.g., financial record-keeping under the Companies Act 2006).

4. How We Use Your Data

  • To provide and improve the MPP Registry service
  • To send transactional emails (account confirmations, invoices, security alerts)
  • To enforce fair-use limits and detect abuse
  • To comply with legal obligations
  • To respond to support and sales enquiries

We do not sell your data. We do not use your data for advertising.

5. Data Sharing

We share data with the following processors:

  • Supabase Inc. — database and authentication infrastructure (US)
  • Stripe Inc. — payment processing (US)
  • Resend Inc. — transactional email (US)
  • Vercel Inc. — hosting and edge network (US)
  • Sentry Inc. — error monitoring (US)

All processors are bound by data processing agreements. Transfers to the US are covered by the EU-US Data Privacy Framework, Standard Contractual Clauses, or equivalent mechanisms as applicable.

6. Data Retention

  • Account data: retained while your account is active and for 90 days after deletion
  • Billing records: 7 years (UK tax and accounting legal requirement)
  • Audit logs: for the retention period of your subscription plan (30 days to 12 months)
  • Contact form data: 12 months from last correspondence
  • Server logs: 30 days

7. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data (subject to legal retention requirements)
  • Restrict or object to processing
  • Data portability (receive your data in a machine-readable format)
  • Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at support@quantum2x.com. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO (ico.org.uk).

8. Cookies

We use strictly necessary cookies for authentication and session management. With your consent (via the cookie banner), we use analytics cookies to understand how the site is used. You can withdraw consent at any time by clearing your cookies or using the cookie banner controls.

9. Security

We apply technical and organisational measures including encryption in transit (TLS 1.2+), encryption at rest (AES-256), Ed25519 / ECDSA signing for package integrity, and row-level security for multi-tenant data isolation. See our Security page for details.

10. Changes to This Policy

We will notify registered users of material changes by email at least 14 days before the change takes effect. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

Quantum 2x Ltd
3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE
support@quantum2x.com