Privacy Policy

Effective date: 22 September 2026Last updated: 22 September 2026

Quant0 is operated by Topgrep Technologies Pvt Ltd, an ISO 27001:2022 certified company incorporated in India.

This Privacy Policy explains how Topgrep Technologies Pvt Ltd, operating as Quant0 ("company", "we", "us", "our"), collects, uses, stores, and protects information when you use the Quant0 platform at quant0.io. We are an ISO 27001:2022 certified company incorporated in India, with servers located in Hyderabad and Mumbai. By using the platform, you accept the practices described in this policy.

1. Who This Policy Applies To

This policy applies to all users of quant0.io, including individuals who create accounts, organisations that subscribe to paid plans, and visitors who browse the website without registering. The platform is intended exclusively for business professionals. We do not knowingly collect data from or provide services to individuals under the age of 18.

2. What We Collect

We collect only the minimum data necessary to operate the platform.

Account data

Email address, collected at registration and used to identify your account.
Phone number, collected optionally for account recovery and support.
Password, stored as a salted cryptographic hash. We never store or transmit your plaintext password.

Scan data

When Qtrace scans a repository, the analysis runs locally within your environment.
We do not receive, store, or process your source code on our servers at any point.
We receive only scan metadata: file names, line numbers, algorithm identifiers, severity scores, and the resulting Cryptographic Bill of Materials report.
No secrets, credentials, business logic, or application code leave your environment.

Usage data

Basic platform usage events such as login timestamps and scan counts, used for service operation and plan enforcement.
IP address, collected temporarily for security and fraud prevention.

3. What We Do Not Collect

We do not collect, store, or process source code from any repository.
We do not collect payment card details directly. Payments are processed by Razorpay. See Section 7.
We do not collect biometric data, government identification numbers, or sensitive personal data as defined under the Digital Personal Data Protection Act 2023 (DPDP Act).
We do not collect data from children under 18.

4. How We Use Your Data

To create and manage your account on quant0.io.
To operate the Qtrace scanner, deliver scan results, and maintain your compliance dashboard.
To send transactional emails including account confirmations, scan completion notices, and security alerts.
To provide customer support when you contact us.
To enforce our Terms and Conditions and prevent misuse of the platform.
To comply with applicable Indian laws including the DPDP Act 2023 and IT Act 2000.

We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties for their own marketing purposes.

5. Data Storage and Security

Your account data is stored on servers located in Hyderabad and Mumbai, India. We do not transfer personal data outside India without your consent, except as required to operate third-party services described in Section 7.

As an ISO 27001:2022 certified organisation, we apply information security controls across our platform including encryption of data in transit (TLS 1.3), encryption of data at rest, access controls, and regular security audits. Passwords are stored using a one-way cryptographic hash function and are never recoverable in plaintext.

6. Cookies and Analytics

The platform currently uses only session cookies that are strictly necessary for authentication and platform operation. We do not use third-party analytics, advertising cookies, or tracking pixels at this time.

We intend to integrate analytics tools in a future platform update. When we do, this policy will be updated in advance and users will be notified. You will have the option to manage non-essential cookie preferences at that time.

7. Third-Party Services

We use a small number of third-party services to operate the platform. Each processes only the data necessary for its function.

Razorpay: processes subscription payments. We do not receive or store your card details. Their privacy policy governs payment data.
Cloud infrastructure (AWS, Mumbai and Hyderabad regions): hosts our servers and databases within India.

We do not integrate GitHub OAuth or any third-party identity provider by default. If your organisation configures an external SSO provider through the admin settings, that provider's own privacy policy applies to the authentication step.

8. Data Retention

We retain your account data for as long as your account is active. If you close your account, we delete your email address and phone number within 30 days, unless we are required to retain it by law.

Scan metadata and CBOM reports are retained for the duration of your subscription to power your compliance dashboard and audit history. You may request deletion at any time by writing to us at resolutions@topgrep.com.

9. Your Rights Under the DPDP Act 2023

As a data principal under India's Digital Personal Data Protection Act 2023, you have the following rights with respect to your personal data.

Right to access: request a summary of the personal data we hold about you.
Right to correction: request correction of inaccurate or incomplete data.
Right to erasure: request deletion of your personal data, subject to our legal obligations.
Right to grievance redressal: raise a complaint with our Data Protection Officer.
Right to nominate: nominate a person to exercise your rights in the event of your incapacity or death.

To exercise any of these rights, write to resolutions@topgrep.com. We will respond within the timeframe prescribed by applicable law, currently 30 days.

10. Children

Quant0 is a professional business platform. We do not direct services at children and we do not knowingly collect personal data from any person under the age of 18. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a minor has registered on our platform, contact us at resolutions@topgrep.com.

11. Changes to This Policy

We may update this policy when our practices change, when we add new features, or when law requires it. Material changes will be notified by email to registered users at least 14 days before taking effect. The current version is always available at quant0.io/privacy.

12. Contact and Grievance Officer

Company: Topgrep Technologies Pvt Ltd
Platform: quant0.io
Email: resolutions@topgrep.com
Phone: +91 8971131578
Address: Bengaluru, Karnataka, India
Grievance Officer: Antony Prem Leo, Compliance Officer

This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of courts in Bengaluru, Karnataka.