Data and privacy
Where your data is stored and processed, and how cross-border transfers are governed. GDPR data-subject rights, retention, and how to exercise them.
Last updated Privacy requests privacy@thequantumclub.com
Data residency & data flow
Where your data lives
European residency by default. Customer data is stored and processed in the European Union — AWS eu-west-1, via Supabase. There is no setting that relocates core customer data outside the EU.
Cross-border transfers to sub-processors are governed by Standard Contractual Clauses (and the EU–US Data Privacy Framework where applicable). The authoritative transfer list is the sub-processor register and our Data Processing Agreement.
- Primary region
- Primary storage and processing of core customer data in the European Union (AWS eu-west-1, via Supabase).
- Relocation
- No setting relocates core customer data outside the EU.
- Transfers
- Cross-border transfers to sub-processors governed by SCCs (and the EU–US DPF where applicable).
Sub-processors
Where each sub-processor processes data
Every entry in the register, grouped by the region its row states.
- EU
- SupabaseAWS eu-west-1PostHog
- EU / US
- StripeDPF, SCCsResendSCCsAI model providers (Anthropic, Google)SCCs
- Global edge
- CloudflareEU-served
Privacy & your rights
Your rights, and how to use them
You can access, export, correct and erase your personal data from your privacy settings in Club OS. Consent for meeting recording is granular and affirmative (video, audio and transcription are separate).
Retention windows are defined per data type, and deletion-on-request is honoured. Personal data is kept only as long as needed for the purpose it was collected or as required by law; our retention schedule is documented and available on request.
Our Data Protection Officer is reachable at privacy@thequantumclub.com and acts as the contact point for data-subject requests and supervisory authorities. Full detail: GDPR rights.
From the security review FAQ
Questions on data
- Where is our data stored?
- In the European Union — AWS eu-west-1, via Supabase. EU residency is the default and there is no setting that moves core customer data outside the EU.
- Can we sign a DPA?
- Yes. Our Data Processing Agreement is available now from the Documents page, including the sub-processor list and EU transfer mechanisms (SCCs).
- What happens to our data if we leave?
- You can export your data at any time via self-service in-app, and on contract termination customer data is deleted on request within our defined retention windows. We never retain customer data beyond what we are contractually or legally required to keep.