Cookie Policy
This Policy explains how QuantCAD uses cookies and similar technologies.
Last updated: April 26, 2026 • Version: 1.7
1. Who we are and scope
This Cookie Policy explains how ZeroEnd Technology AB (Sweden), doing business as QuantCAD (“we”, “us”, “our”), uses cookies and similar technologies on our website at www.quantcad.ai and in connection with the Service. ZeroEnd Technology AB is responsible for the cookie and similar-technology processing described in this Policy, except where a third-party provider acts as an independent controller under its own terms and privacy notice.
Registered address: Järpvägen 41B, 75653, Uppsala, Uppland, Sweden.
This Cookie Policy should be read together with our Privacy Policy, US State Privacy Notice, Canadian Privacy Notice, and Legal Notices.
Analytics scope: We use analytics technologies on the public/marketing parts of the Site (for example home pages, blogs, and pricing pages), including Vercel Web Analytics. We do not run marketing analytics on the authenticated dashboard/app.
2. What are cookies and similar technologies?
Cookies are small text files stored on your device when you visit a website. We also use similar technologies, such as:
- Local storage/session storage: browser storage used to remember preferences.
- Pixels/SDKs: code that sends events to measure usage (often paired with cookies or local storage).
- Cookieless analytics scripts / request-based analytics: scripts or server-side request signals that measure page views without storing cookies on your device.
For simplicity, we refer to cookies and similar technologies collectively as “cookies” in this Policy, except where we specifically say that a tool is cookieless.
3. Categories of cookies we use
We use the following categories:
- Strictly necessary: required for core functionality and security (for example to store consent choices, prevent abuse, and enable sign-in/session functionality).
- Functional: remember preferences and improve usability.
- Analytics: help us understand how the marketing Site is used and improve performance and user experience. This includes cookieless analytics and, where enabled, cookie/local-storage analytics used only with your consent where required.
Strictly necessary cookies are always active because the Site and Service cannot operate securely without them. Non-essential functional cookies, analytics cookies, and analytics local-storage technologies are disabled until you consent where consent is required by law.
We do not use cookies for behavioral advertising, retargeting, Google Signals, ads personalization, or cross-context behavioral advertising at this time.
4. CookieYes consent management and Global Privacy Control (GPC)
We use CookieYes to display cookie notices and, where required by law, to collect, store, and manage your cookie preferences.
CookieYes sets cookies needed to remember your choices and to record proof of consent. For example, CookieYes may set a necessary cookie such as cookieyes-consent to store a consent identifier and/or your consent status.
Where consent is required (for example for EEA/UK users and for Quebec users where cookies involve identification, location, or profiling), our required configuration is:
- non-essential cookies are off until you make an affirmative choice;
- "accept", "reject", and "manage choices" options are presented without pre-ticked non-essential categories; and
- withdrawing consent is as easy as giving it.
Where available, you can change or withdraw your consent at any time via the "Cookie Settings" link in the footer.
4.1 Global Privacy Control (GPC) — US users
We honor the Global Privacy Control (GPC) browser signal as a valid opt-out signal for non-essential cookies and tracking technologies where the signal is available to us and where the relevant tool can be controlled by us.
When your browser sends a Sec-GPC: 1 header (or an equivalent JavaScript-exposed navigator.globalPrivacyControl === true signal), our consent management platform (CookieYes) treats it as an instruction to withhold consent for analytics and any other non-essential cookie category before the banner is shown. We do not load Google Analytics, PostHog, or consent-based non-essential scripts in the presence of a recognized GPC signal unless you later take an affirmative action that applicable law permits us to treat as consent or re-opt-in.
Under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) and similar US state laws, GPC also functions as a binding opt-out of "sale", "sharing", and targeted advertising where those concepts apply. Because we do not sell or share personal information for cross-context behavioral advertising in any case (see Privacy Policy §6.4), GPC honoring at the cookie/script-loading layer is sufficient for our current cookie use. Vercel Web Analytics is cookieless and is not used for sale, sharing, targeted advertising, or cross-site tracking; if we configure it in a way that would require consent or opt-out blocking, we will gate it accordingly. If we ever introduce behavioral advertising or another "sale/share" surface, we will extend GPC honoring to the relevant server-side and account-level processing before doing so and update this Policy.
For US state-law privacy disclosures, including the "Do Not Sell or Share My Personal Information" statement, see the US State Privacy Notice.
4.2 Canada
For Canadian users, no additional consent banner is required under PIPEDA for strictly necessary cookies. For analytics cookies and analytics local-storage technologies on the marketing Site, we apply the same consent regime as for EEA/UK users. Quebec users benefit from the express-consent rules of Law 25 for technologies that identify, locate, or profile individuals (article 8.1); those technologies are deactivated by default until consent is given and can be deactivated through Cookie Settings. Vercel Web Analytics is described by Vercel as cookieless and aggregated/anonymized, but we will reassess and gate it if our configuration or applicable law requires consent.
5. Analytics technologies (marketing Site only)
We use analytics technologies to understand how visitors use the marketing Site and to improve performance and user experience. Some analytics technologies are cookieless; others use cookies or local storage and are used only with your consent where required.
5.1 Google Analytics
Google Analytics may set cookies (for example _ga, _gid, and related cookies) and process information about your device/browser, rough location derived from IP address, and your interactions with the Site. Where required, we do not run analytics cookies unless you consent. Google Analytics is used for measurement only; we do not enable Google Signals, advertising features, retargeting, or ads personalization unless we first update this Policy and obtain any consent required by law.
You can also control cookies through your browser settings and may be able to opt out of Google Analytics using Google’s opt-out mechanism (for example the browser add-on) as described at tools.google.com. For more information about Google’s privacy practices, see policies.google.com.
5.2 PostHog
We also use PostHog for analytics on the marketing Site. PostHog is configured for event analytics only — we do not use PostHog session replay, autocapture, surveys, or feature-flag personalization. PostHog runs on PostHog Cloud (EU).
PostHog may use cookies and local storage to help us understand usage and improve the Site. Cookie names and lifetimes can vary by configuration, but PostHog commonly uses a cookie name pattern like ph_<project_token>_posthog, with a default cookie retention of around 365 days.
5.3 Vercel Web Analytics
We use Vercel Web Analytics on the public/marketing Site. Vercel describes this product as cookieless and designed to store aggregated/anonymized analytics. It does not use third-party cookies, and visitors are identified for analytics by a hash created from the incoming request that resets daily rather than by a persistent cross-site identifier.
Vercel Web Analytics may process page views, referrers, approximate country, browser, operating system, device information, and custom events. We do not intentionally send personal data, credentials, tokens, email addresses, project identifiers, or sensitive URL/query-string values to Vercel Web Analytics. If a URL or event could contain personal data, we will use Vercel's redaction/filtering controls or avoid sending that event.
5.4 Error monitoring (Sentry — where configured)
We use Sentry for error and performance monitoring where a Sentry DSN is configured. Sentry is not an advertising or marketing analytics tool. When enabled:
- Sentry is configured in the EU region where available; processing location may depend on our Sentry account region and deployment configuration.
- Sentry processes technical error data (stack traces, error codes, request metadata) needed to diagnose issues; it may capture limited identifiers and IP address as part of error context.
- We run Sentry on the basis of legitimate interests (operating a reliable Service) and do not enable session replay or full request-body capture.
- Sentry is treated as a strictly necessary security/reliability tool only for the configuration described above. If we enable session replay, product analytics, full request-body capture, or another non-essential feature, we will reassess the legal basis and consent requirement before enabling it.
6. International transfers and third-party providers
Some providers involved in cookie and similar-technology processing may process data outside your country, including in the United States, India, the European Union, and other locations depending on provider configuration. Where required, we rely on contractual safeguards such as the EU Standard Contractual Clauses, the UK Addendum, the EU-US/UK-US Data Privacy Framework where applicable, and supplementary technical and organizational measures. See Privacy Policy §7 for more detail.
Third-party providers may also act under their own privacy notices for certain processing. Relevant provider notices include:
- CookieYes: cookieyes.com/privacy-policy
- Vercel Web Analytics: vercel.com/docs/analytics/privacy-policy
- Vercel Privacy Notice: vercel.com/legal/privacy-policy
- Google: policies.google.com/privacy
- PostHog: posthog.com/privacy
- Sentry: sentry.io/privacy
7. Cookie list (examples) and how to view the current list
Because cookies can change as we update the Site, vendors, and configurations, the most current list of non-essential cookies in use (including name, provider, purpose, and lifetime) is available in the CookieYes consent tool via Cookie Settings. If the CookieYes tool shows a more specific cookie name, purpose, or duration than the examples below, the CookieYes tool should be treated as the current operational list.
For convenience, here are representative examples:
| Category | Example cookies (may vary) | Provider | Purpose | Typical lifetime |
|---|---|---|---|---|
| Strictly necessary | cookieyes-consent | CookieYes | Stores consent identifier/status and helps record consent logs | ~1 year (varies) |
| Strictly necessary | Clerk session/authentication cookies (names vary) | Clerk | Enables sign-in, account security, and session management | Session to ~1 year (varies) |
| Analytics (marketing Site, cookieless) | No analytics cookie set by Vercel Web Analytics | Vercel Web Analytics | Aggregated/anonymized page-view and visitor measurement | No cookie; visitor hash resets daily according to Vercel |
| Analytics (marketing Site) | _ga, _gid, _ga_* | Google Analytics | Visitor measurement and Site usage analytics | 1 day–2 years (varies) |
| Analytics (marketing Site) | ph_<project_token>_posthog and local storage | PostHog | Site usage analytics and product improvement | ~365 days (cookie) (varies) |
| Functional | sidebar_state | QuantCAD | Remembers a UI preference (for example sidebar open/collapsed) | 7 days |
8. How to control cookies
You can control cookies in several ways:
- Cookie Settings (recommended): use the CookieYes Cookie Settings link in the footer to view cookie details and change or withdraw consent (where available).
- Browser settings: most browsers let you delete or block cookies. Note that blocking certain cookies may impact Site functionality.
- GPC-enabled browser or extension: where your browser sends a recognized GPC signal, we treat it as described in Section 4.1.
Withdrawing consent stops future non-essential cookie use from that browser/device, but it may not automatically delete cookies already stored on your device. Use your browser settings to delete existing cookies.
If you are in the EEA/UK and similar jurisdictions, we will ask for consent for non-essential cookies (such as analytics) where required.
9. Do Not Track and browser signals
Some browsers offer a legacy Do Not Track (DNT) setting. There is no consistent legal or technical standard for DNT, so we do not treat DNT by itself as a consent withdrawal or US privacy opt-out. We do honor GPC where recognized as described above.
10. Changes to this Cookie Policy
We may update this Cookie Policy from time to time. We will post updates on this page and, for material changes, we may provide additional notice.
Past versions of this Policy are retained internally and are available on request via Support Ticket — select Privacy & Compliance.
11. Contact
For questions about this Cookie Policy or cookies, submit a Support Ticket and select Privacy & Compliance. You may also write to us at the registered address listed above.