Privacy Policy
1. Who We Are
Vanguard Arc ("we," "us," or "our") operates NHLQuant at nhlquant.com — an AI-powered NHL hockey analytics platform. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.
Our designated Privacy Officer can be reached at: [email protected]
2. What Personal Information We Collect
We collect only what is necessary to provide our service:
| Category | What We Collect | Why |
|---|---|---|
| Account Info | Name, email address, profile photo | Create and manage your account via Google OAuth |
| Authentication | Google OAuth tokens, session cookies | Keep you securely signed in |
| Usage Data | AI search queries, number of searches per day | Enforce daily quota limits; no query history stored permanently |
| Billing Data | Subscription plan, billing status | Manage Pro subscriptions (card data is never stored by us) |
| Technical Data | IP address, browser type, request timestamps | Rate limiting, security monitoring, abuse prevention |
We do not collect: Credit card numbers, CVV codes, or bank details. All payment processing is handled directly by Stripe (PCI-DSS Level 1 certified). We only receive a subscription status and a Stripe Customer ID.
3. How We Collect Your Information
- Directly from you: When you sign in with Google OAuth, you explicitly authorize us to receive your name, email, and profile image from your Google account.
- Automatically: When you use the service, we log your IP address (retained temporarily for rate limiting only) and AI search counts (aggregated by day).
- From third parties: Our payment processor sends us events when your subscription status changes (e.g., payment succeeded, subscription canceled).
4. How We Use Your Information
We use your information only for the purposes for which it was collected:
- To create and authenticate your account
- To provide the NHLQuant service (player search, AI queries, analytics)
- To enforce daily AI search limits based on your subscription plan
- To process and manage your subscription via Stripe
- To detect and prevent fraud, abuse, and security threats
- To send you material service notifications (e.g., payment failures, policy updates) — not marketing emails unless you opt in
We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.
5. Third-Party Service Providers
We share minimum necessary data with the following processors to operate our service:
| Provider | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| OAuth authentication | Receive: name, email, photo | policies.google.com/privacy | |
| Stripe | Payment processing | Email, name, subscription status | stripe.com/privacy |
| Secure cloud infrastructure | Data storage & hosting | Account & usage data (encrypted) | N/A |
| AI inference provider | AI search processing | Query content only — not stored | N/A |
| Rate limiting service | Abuse prevention | IP addresses (short-term TTL) | N/A |
All processors are contractually required to protect your data and may not use it for their own purposes beyond providing services to us.
6. Cross-Border Data Transfers
Your data may be processed and stored in Canada and the United States by our cloud infrastructure providers. We ensure comparable protection through contractual agreements with all processors that meet or exceed PIPEDA standards. By using our service, you consent to this transfer.
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (name, email) | While account is active + 30 days after deletion request |
| Session tokens | 30 days (sliding window), then automatically purged |
| AI search counts | 90 days of daily aggregates (not individual query content) |
| IP addresses (rate limiting) | Maximum 24 hours, then auto-expired |
| Billing/subscription records | 7 years (required by Canadian tax law) |
9. Your Rights Under PIPEDA
You have the following rights regarding your personal information:
- Right to access: Request a copy of the personal information we hold about you
- Right to correction: Request correction of inaccurate information
- Right to deletion: Request deletion of your account and associated data (subject to retention requirements for billing records)
- Right to withdraw consent: You may withdraw consent at any time by deleting your account. Note that withdrawal may prevent you from using the service.
- Right to complain: You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
10. Security Measures
- All data in transit is encrypted using TLS 1.3
- Database connections require SSL (
sslmode=require) - Session cookies are
httpOnlyandsecure— inaccessible to JavaScript - AI search queries use a read-only database connection with strict SQL validation
- Access keys and secrets are stored in platform secret managers (Vercel env vars), never in source code
- Rate limiting prevents brute force and abuse
11. Children's Privacy
NHLQuant is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by sending an email to your registered email address at least 14 days before the change takes effect. Your continued use of the service after that date constitutes acceptance of the updated policy.
13. Contact Us
For privacy inquiries, data access requests, or complaints, contact our Privacy Officer: