Privacy Policy

1. Introduction

8xQuant, operated by Bolana Inc. (the “Company,” “we,” “us,” or “our”), Edmonton, Alberta, Canada, is committed to protect the privacy and confidentiality of personal information of Users, Members, Clients and Subscribers (collectively, “you”).

This Privacy Policy explains how we collect, use, disclose, and protect information tied to your use of the 8xQuant Service (the “Service”). The Service is a machine-learning prediction and publication system for E-mini Nasdaq-100 (NQ) futures, provided through 8xquant.com, the Public Tape (searchable record of Calls), the Live Trade Portal (account-gated live session), the member live feed, and, where agreed, Dedicated Automated Execution via a Deployment Machine that sends model orders to your own Brokerage Account through a supported API broker.

We follow Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). Where CASL applies, we follow Canada’s Anti-Spam Legislation for electronic messages.

This policy is part of your Agreement. It works together with the Terms of Service and, where you have one, your Client Agreement. Terms defined in the Terms of Service have the same meaning here.

2. Information We Collect

We collect only what we need to run the Service, manage Accounts and registration, process payment, support Automated Execution where you request it, and improve the system. You give most data directly; some comes from your use of the Service or from your broker where you authorize it.

2.1. Account and Registration Data

• Identifiers and contact: Name, email address, phone number, billing address, and, where required for account review or regulatory checks, physical address, entity type, and authorized contact.
• Eligibility data: Information you provide to show age of majority, legal capacity, and authority to act for an organization.
• Account credentials: Password selected by you during Signup or provisioned by 8xQuant for an existing Account, two-factor authenticator enrollment (TOTP secret is stored encrypted), recovery codes, and login records. We do not see your authenticator one-time codes.
• Billing data: Payment card details and billing address processed by a PCI-compliant third-party processor. 8xQuant does not store full card numbers.
• Broker and capacity data (where you apply): Broker name, account ID, funding-capacity range, and entity documents you choose to share for account review. We do not ask for your brokerage password.

2.2. Service Usage Data

• Portal and feed use: Pages viewed, Calls viewed, Public Tape searches, session times viewed, time of access, and preferences.
• Technical data: IP address, device and browser type, operating system, time zone (to show New York time correctly), and system activity logs.
• Security monitoring: Login records, request patterns, and signs of redistribution or scraping, as described in Terms 3.6. We use this to protect the Service and enforce the Terms.

2.3. Automated Execution Data (only where you use this route)

• Brokerage statements and trade records: Periodic statements and execution records you provide under Terms 4.8 so we can calculate any percentage of model-generated revenue and reconcile against our order logs.
• API access: API keys or tokens and permission scopes you grant to the Deployment Machine, and market-data entitlements required for order submission. Keys are stored encrypted and used only to submit model orders to the Brokerage Account you designate.
• Deployment logs: Order instructions sent, timestamps, acknowledgement or rejection from broker or exchange, and error codes. These logs contain order levels and times but not your unrelated personal brokerage activity.

2.4. Communication Data

Records when you write to us through 8xquant.com/contact or the email we give with your Account or Client Agreement, including support emails, chat transcripts, and account-update requests.

3. How We Use Your Information

We use personal information only for the purposes below, and only with a lawful basis under PIPEDA/PIPA:

• Provide and manage the Service (contract): Create and manage Accounts, including registration and email verification, deliver the live feed and Public Tape, operate a Deployment Machine where agreed, authenticate logins with password plus TOTP, process subscription fees and any revenue-share billing.
• Improve the Service (legitimate interest): Monitor performance, fix errors, analyze usage in aggregate, improve model delivery and site reliability. We use anonymized or aggregate model and order records for this; we do not use your identity to train the trading model.
• Security and fraud prevention (legal obligation and legitimate interest): Verify identity, prevent misuse of credentials, detect scraping or redistribution, prevent money laundering or sanctions evasion, and meet exchange, broker, or regulator requests where required.
• Communication (consent): Send account notices, billing receipts, renewal and fee-change notices (per Terms 4.6, 12), security alerts, and, where you opt in, product updates. Promotional emails follow CASL — we send them only with your express or implied consent and you can opt out at any time. Transactional and security notices are not promotional.
• Legal compliance (legal obligation): Comply with Canadian and Albertan law, respond to lawful requests, and enforce the Terms, including fee collection and indemnity under Terms 9–10.

We do not sell your personal information. We do not use it for third-party advertising.

4. Disclosure and Sharing of Information

We share personal information only as described here:

• Service providers (processors): Trusted providers who help run the Service — payment processor (PCI-compliant), cloud hosting and storage, email delivery, logging and analytics — bound by contract to use data only to provide the service and to protect it.
• Broker, exchange, clearing where needed: For Automated Execution, your broker and related parties receive order instructions from the Deployment Machine and return execution reports. Those parties are independent controllers of that data under their own policies.
• Legal and safety: Where law requires, or where needed to protect rights, property, or safety of Bolana Inc., our Users, or the public, or to respond to a lawful request from a court, regulator, or law enforcement.
• Business transfer: If Bolana Inc. merges, reorganizes, or sells assets including the 8xQuant business (per Terms 14.3), personal information may transfer to the successor, still subject to this policy.
• With your direction: When you ask us to share with your team, accountant, or adviser, or when your Client Agreement authorizes a firm-level account.

We do not disclose brokerage statements or API keys to other clients. Aggregate, de-identified model and order statistics may be shared publicly; they do not identify you.

5. Cookies and Similar Technologies

We use only what is needed to run and secure the site:

• Essential: Session and authentication cookies to keep you logged in, remember login state, and protect against cross-site attacks.
• Security and performance: To measure load, detect abuse, and keep the Portal and live feed reliable.

We do not use third-party advertising cookies. You can block cookies in your browser, but the Portal and login will not work without essential cookies.

6. Consent and Your Rights

6.1. Consent

By creating or using an Account, paying for access, or using any part of the Service, you consent to the collection, use, and disclosure described in this policy. Because an Account may be created through Signup or opened by the 8xQuant team, your first use is your consent point, consistent with Terms 1.2. You may withdraw consent at any time, subject to legal or contract limits. Withdrawal may mean we must close the Account because we can no longer provide the Service.

6.2. Access and Correction

Under PIPEDA and PIPA you may request access to personal information we hold about you and request correction of errors. To request, write to the Privacy Officer below with your account name and what you need. We will respond within the time the law requires.

6.3. Objection and Complaint

You may object to certain uses or file a privacy complaint with us. If not resolved, you may complain to the Office of the Privacy Commissioner of Canada or the Alberta Information and Privacy Commissioner, as applicable.

6.4. Marketing Opt-Out

You can opt out of promotional emails via the unsubscribe link or by writing to us. You cannot opt out of transactional, billing, or security notices while you hold an Account.

7. Data Retention

We keep personal information only as long as needed for the purposes above:

• Account data: While your Account is active and for a reasonable period after closure to handle billing questions, disputes (per Terms 13.4, up to 2 years), tax records, and legal holds.
• Billing records: As long as tax and accounting law requires.
• Automated Execution logs and statements: As long as needed to verify fees under Terms 4.8 and to meet audit or legal duties, then deleted or de-identified.
• Security logs: For a limited period to investigate abuse, then rotated.

When no longer needed, we delete or anonymize data securely.

8. Security of Information

We run a security program suited to a financial-data service:

• TLS encryption for data in transit; encryption at rest for stored personal data and encrypted storage of API keys and TOTP secrets.
• Access controls — only authorized staff with a need to know can access personal information.
• Network and host monitoring for the Portal, live feed, and Deployment Machines.
• PCI-compliant payment processing — full card data stays with the processor.

No system is perfect. If we learn of a material breach that creates a real risk of significant harm, we will notify you and the relevant commissioner as the law requires and as described in breach-notification rules under PIPEDA/PIPA.

Your role: keep your password, authenticator enrollment, and recovery secret confidential and offline, as required by Terms 3.3, and tell us at once through 8xquant.com/contact if you think credentials are compromised.

9. Location of Processing

8xQuant is operated by Bolana Inc. in Edmonton, Alberta, Canada. Personal information is stored and processed primarily on servers in Canada and the United States, via our cloud providers. Where data leaves Alberta or Canada, we use contract protections appropriate to the sensitivity and keep access limited.

Market-data and brokerage execution for Automated Execution involves your broker (for example, Interactive Brokers LLC where you designate it) and the relevant exchange and clearinghouse. Those parties process order data under their own rules and locations.

We may update the location or provider on notice where the change is material, consistent with Terms 5.6.

10. Contact — Privacy Officer

For questions, access requests, corrections, consent withdrawal, or complaints, contact:

We reply within the time the law requires. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or the Alberta Information and Privacy Commissioner.

This policy is governed by Alberta and Canadian law, consistent with Terms 13.1. The English version controls.