Privacy Policy

Who is the controller

Abundancia Capital LLC, a Wyoming limited-liability company (USA), is the data controller for personal data processed through quantabundancia.com, api.quantabundancia.com, our newsletters, our Telegram channels, and any paid subscription. Contact: louis@expat-llc.com.

What we collect

We collect the minimum data needed to operate the Service. In practice this means:

• Email address — when you sign up for the daily digest, premium-tier waitlist, or any paid subscription.
• Signup source tag — a short string (e.g. footer, premium-waitlist-portfolios) so we can tell where an email came from. No tracking pixel, no UTM, no cross-site identifier.
• Stripe customer + subscription metadata — for paid subscribers: billing email, subscription status, plan, country (for tax), and Stripe identifiers. We do not see or store full card numbers — Stripe handles those directly.
• Display name (optional) — if you opt to appear on the public supporters wall. Off by default.
• Telegram chat ID — only if you join a paid Telegram channel and message our bot. Used to deliver your subscription messages.
• Anonymized analytics via Google Analytics 4 (GA4) — page views, country-level location, referrer. Default-deny consent: no analytics cookies until you accept the banner. IP anonymization is on regardless of consent. See /disclosures#cookies for details.
• Server logs — IP, user-agent, timestamp, requested path, referrer. Standard webserver / nginx logs, retained no longer than 30 days for security and abuse-detection.

Why we collect it (lawful bases — GDPR / UK GDPR)

For users in the European Economic Area, the United Kingdom, or Switzerland, the lawful bases under Article 6 GDPR / UK GDPR are:

• Performance of a contract — to deliver newsletters you signed up for and to provide paid subscription services to subscribers.
• Legitimate interests — for security, abuse prevention, debugging, and very basic aggregate analytics. Balanced against your privacy interests by design (no profiling, no advertising, no data sales).
• Consent — for analytics cookies (Google Consent Mode v2 default-deny) and for any optional displays such as the public supporters wall.
• Legal obligation — to keep tax-relevant records (Stripe invoice history) for the periods required by US and applicable foreign tax law.

Who else sees it (third-party processors)

We use the following sub-processors. Each is bound by their own privacy terms; clicking their name will take you to those terms.

• Stripe, Inc. (USA) — payment processing, subscription management. Merchant of record for paid tiers.
• Resend (USA) — transactional email and newsletter delivery.
• Telegram FZ-LLC (UAE) — messaging delivery if you opt into a Telegram channel.
• Google LLC (USA) — Google Analytics 4 (anonymized, consent-gated). No ads, no Google Signals, no audience-targeting features.
• Hetzner Online GmbH (Germany) — VPS hosting. Server logs and the application database live here.
• Cloudflare, Inc. (USA) — DNS resolution for the apex domain.

We do not sell, rent, or trade personal data. We do not share personal data with advertisers, data brokers, or audience-targeting platforms.

International transfers

Personal data of EU / UK users may be transferred to and processed in the United States and other jurisdictions where our sub-processors operate. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and (where applicable) sub-processor certifications under the EU-US Data Privacy Framework, as the transfer mechanism.

How long we keep it

• Email subscribers — kept until you unsubscribe (one-click link in every email), then deleted within 30 days.
• Stripe subscription records — kept for the period required by US tax law (typically seven (7) years from the last invoice), then deleted or anonymized.
• Server logs — rotated and deleted within 30 days.
• Anonymized GA4 data— retained per GA4's default settings (currently 14 months), then auto-deleted by Google.

Your rights

Wherever you live, you can email us at louis@expat-llc.com to:

• Access — get a copy of what we hold about you.
• Correct — fix anything inaccurate.
• Delete — have your data removed (subject to tax-record retention).
• Restrict / object — limit or stop a particular use.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for anything done on the basis of your consent (analytics cookies, supporters wall display).

We respond within 30 days. We do not charge a fee unless your request is manifestly unfounded or excessive.

EU / UK supervisory authorities. You have the right to complain to your local data-protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

California (CCPA / CPRA). California residents have the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under California law. To exercise CCPA rights, email us at the address above.

Cookies and similar technologies

We run a single first-party analytics cookie set (Google Analytics 4) under default-deny consent. Full cookie inventory, consent mechanics, and how to revoke consent are at /disclosures#cookies.

Security

We use HTTPS everywhere (Let's Encrypt), TLS for all inter-service traffic, encrypted database storage at rest, principle-of-least-privilege access for operators, and dependency patching. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you and the appropriate authorities within the timeframes required by applicable law.

Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal data, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. The version with the latest "Last updated" date below is the version in effect. Material changes affecting paid subscribers or active email subscribers will be notified by email at least fourteen (14) days before they take effect.