Privacy policy. Plain terms, no surprises.

Who we are

Nyquist is an agent research desk for funds, operated by its founding team. Company details, registered jurisdiction, and corporate disclosures are published on the legal and security registries.

What we collect

We collect minimal data required to provide institutional services: contact information for pilot applications, session tokens for security, and operational audit logs when running live books.

How we use it

Your data is strictly used to deliver quantitative risk calculations, portfolio attribution, and model execution. We never sell, monetize, or share your data with advertisers or third parties.

Analytics & session replay

Two tools measure this website. Cloudflare Web Analytics counts page views and load times in aggregate and sets no cookie. Umami runs on our own Azure server, so its data never leaves our infrastructure. PostHog is not loaded on this website.

The signed-in platform uses PostHog (PostHog Cloud, US region) for product analytics: which pages and features are opened, and in what order. PostHog keeps a random identifier in your browser’s local storage so page views from one browser join into one visit; it does not follow you across other sites, and we set no advertising cookies.

Inside the signed-in platform PostHog also records the session — a replay of the pages you open and what you click, type and scroll — so we can see where the product is confusing or broken. Password, login, e-mail, phone-number and one-time-code fields are masked and never recorded; other fields you type into are. Analytics events and recordings are stored by PostHog in the United States, so this data leaves the EU. Signed-in users are identified to PostHog by an internal account number only, never by name or e-mail. Write to us and we will exclude your account from recording.

Error and speed reports

When a page of the platform or of the public demo breaks in your browser, the browser sends a short error report to our own server, not to a third party: the error text and its technical trace, the page path, the version of the application, the code of the page, and your browser’s user-agent string. Reports of content blocked by the page’s security policy are sent the same way. The report is sent without your sign-in, so it is not linked to your account.

Before a report is stored, the server removes anything that looks like an access token, key, password or e-mail address. We do not store your IP address with the report. Reports are kept for 30 days and then deleted automatically. We use them only to find and fix defects.

Once per visit to the platform or the demo, the browser also sends our own server three page-speed measurements: how long the main content took to appear, how much the layout shifted while loading, and how quickly the page responded to clicks and typing. With them go the page path, the version of the application and whether the device is a phone. This report carries no account, no cookie and no user-agent string, and we do not store your IP address with it. Speed reports are kept for 30 days and used only to find slow pages.

Survey e-mail

We invite people who work at financial institutions to take a short research survey. We write to business addresses that the institution itself publishes on its own website. The e-mails are sent through our e-mail provider, Resend.

Where the provider reports them, we record what happened to each message: delivered, opened, link followed, bounced or marked as spam. For each event we store the recipient’s address, the type of event, the time, which link was followed and the message details the provider reports (such as subject and sender). We do not store the IP address or the device details of the person who opened or clicked: they are removed before the record is written. The provider keeps its own records under its own privacy policy. We use these records to see how the survey invitation performed. To be taken off the list, reply to the e-mail or write to the address in Contact; we will remove your address and delete the records tied to it.

Model providers & zero-training guarantee

Strict zero-training policy: Customer financial positions, portfolio weights, trades, and proprietary theses are never used to train or fine-tune models. In dedicated VPC and on-premise deployments, model inference is configured by contract.

Retention

Operational data is retained only for the duration of your active pilot or contract period, plus any retention period required by your regulator.

Your rights

Under GDPR, CCPA, and global privacy standards, you have the right to inspect, export, or delete your operational data at any time.

Security

All data in transit is encrypted via TLS 1.3. Data at rest is encrypted via AES-256. Private deployments run inside on-premise or single-tenant VPC environments.

Contact

For privacy and data sovereignty inquiries: privacy@nyquist.pro