Legal
Privacy notice
Effective date: 10 October 2026. Version 0.13.
This notice explains what personal information we collect about you, why we collect it, what we do with it, who else sees it, how long we keep it, and what you can ask us to do about it.
We have written it in plain language because a privacy notice you cannot read is not a privacy notice. If anything here is unclear, write to us at support@quantumthrivehub.com and we will explain it.
1. Who we are
Robert Russell, a sole proprietor trading as QuantumThrive Hub, of U37 Stonewood Estate, 3 Macbeth Avenue, Fourways, 2191, South Africa.
In this notice, “we”, “us” and “our” mean Robert Russell, trading as QuantumThrive Hub. “You” means the person whose personal information we are processing.
We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). If you are in the United Kingdom or the European Union or the European Economic Area, we are the controller of your personal information under the United Kingdom General Data Protection Regulation and the European Union General Data Protection Regulation (together, the GDPR).
Our Information Officer, the person responsible for how we look after your personal information, is Robert Russell. Robert Russell is registered with the Information Regulator of South Africa, the government body that makes sure businesses follow the privacy law.
How to reach us about your personal information:
-
Email: support@quantumthrivehub.com
-
Post: U37 Stonewood Estate, 3 Macbeth Avenue, Fourways, 2191, South Africa
Please put “Privacy” in the subject line so it reaches the right person quickly.
2. What we collect, why, and on what basis
We collect only what we need. The table below is the complete list. Nothing is collected that is not on it.
2.1 When you buy a session or a build
| What we collect | Required | Why we collect it | Our lawful basis |
|---|---|---|---|
| First name | Yes | To address the artefact to you. This is sent to the AI model that drafts your artefact | Performance of our contract with you |
| Last name | Yes | To identify you as a customer and match your order to your intake. For a comprehensive build it is also sent to the AI model, so that Eigenprint Name can trace your full name | Performance of our contract with you |
| Email address | Yes | To deliver your artefact and to correspond with you about your order | Performance of our contract with you |
| Telephone number | Yes, except in the United States, Canada and Australia, where it is optional | To reach you if there is a problem with your order that email cannot resolve. We never use it for marketing and we never add you to a text or messaging list | Performance of our contract with you |
| Company name | No | Context for our records. Not used to build your artefact | Our legitimate interest in understanding our customers |
| Date of birth | Yes | To derive your Eigenprint Path and Eigenprint Sky. Both are worked out from it as soon as you give it | Performance of our contract with you |
| Where you are based | Yes | To set your price and currency, to route your form correctly, and to apply the right privacy rules to you | Performance of our contract, and compliance with our legal obligations |
| Which of the three starting points describes you | Yes | To ask you the right version of the questions that follow, and to write your artefact for where you actually are. This is sent to the AI model | Performance of our contract with you |
| Your answers to the Eigenprint Type assessment | Yes | To work out your Eigenprint Type. We keep your individual answers as well as the result, so that a result can always be checked against what you actually said. Your individual answers are never sent to the AI model. The result is | Performance of our contract with you |
| Your Eigenprint Type result | Yes | The structural basis of the artefact | Performance of our contract with you |
| Your four career answers | Yes | The substance of your artefact. These are sent to the AI model | Performance of our contract with you |
| Your seven answers about your working setup, how steady things feel for you and what your work means to you | Yes | To score how well your current role fits you. These are sent to the AI model | Performance of our contract with you |
| Sex | Yes, once you have paid | Used to build your work. See section 3 | Your consent |
| Gender | Yes, once you have paid | Used to build your work. See section 3 | Your consent |
| Religion | Yes, once you have paid | Used to build your work. Special personal information, see section 3 | Your consent, POPIA section 27(1)(a) and GDPR Article 9(2)(a) |
| Ethnicity | Yes, once you have paid | Used to build your work. Special personal information, see section 3 | Your consent, POPIA section 27(1)(a) and GDPR Article 9(2)(a) |
| Product and price tier | Yes | To build the right product and to keep accurate sales records | Performance of our contract, and our legal obligation to keep records |
| Your consent record | Yes | Proof that we processed your information lawfully. Includes what you agreed to, which version, and when. We keep the exact wording you were shown, not only a version number | Compliance with our legal obligations |
| Notes we keep about our work with you | No, we write them ourselves | To remember what we agreed with you and when to follow up. Only Robert, and anyone he gives access to, can see them. You can ask us for a copy at any time | Our legitimate interest in managing our work with you |
| Age confirmation | Yes | A parent or guardian buys for anyone under 18. See section 8 | Compliance with our legal obligations |
We also ask your sex, gender, religion and ethnicity once you have paid for a build or a session. Those four are covered separately in section 3, because two of them carry extra protection in law and we would rather set them out on their own than bury them in a table.
What the AI model never sees. Your email address, your telephone number, your company, your location, your payment details and your individual answers to the Eigenprint Type assessment are never included in the information sent to the AI model that drafts your artefact. Your last name is sent only for a comprehensive build, because Eigenprint Name traces your full name to its roots. The model receives your first name, your last name (comprehensive build only), which of the three starting points on the form describes you, your date of birth, your sex, your gender, your religion, your ethnicity, your Eigenprint Type result, your four career answers and your seven answers about your working setup, how steady things feel for you and what your work means to you, and nothing else. Your sex, gender, religion and ethnicity are sent to the model because they shape the advice and the roadmap, and you agree to that in the consent above the payment button.
2.2 When you create an account
| What we collect | Why | Our lawful basis |
|---|---|---|
| Email address and password | To create and secure your account | Performance of our contract with you |
| Order history and artefact downloads | So you can find what you have bought | Performance of our contract with you |
| Login records and device information | Account security, and detecting misuse | Our legitimate interest in keeping accounts secure |
We store your password in an encrypted, hashed form. We cannot read it, we will never ask you for it, and we will never send it to you.
Which of our videos you came from. If one of our videos brought you to the free assessment on our site, we save that video’s name with your answers. We use the video name to see which videos bring people to the assessment, so that we can make more like them. The video name does not go into your artefact. We keep it only in your account with us. We do not save it in your browser or on your device. Our lawful basis is our legitimate interest in knowing which of our videos reach people. You may object at any time to our keeping or using the video name, by writing to support@quantumthrivehub.com.
2.3 Free content
There is no free scorecard or quiz. The one free thing is the Eigenprint Type, it sits behind an account, and section 2.1 covers what it collects. Section 2.2 covers the account itself, and section 7 says how long we keep your answers if you never buy anything.
2.4 When you pay us
Our payment provider collects and processes your card and payment details directly. We never see or store your full card number. We receive a record that the payment succeeded, the amount, the currency, and a reference. Our lawful basis is performance of our contract with you and our legal obligation to keep financial records.
2.5 When you visit our website
See our Cookie and tracking notice for more detail. In short, the site uses only the small files (cookies) it needs to work. The site shows no cookie banner, because there is nothing to ask you about. If we add other cookies or tracking later, we will ask for your permission first.
2.6 When you write to us
Whatever you put in your message, and our reply. We keep correspondence so that we have a record of what was asked and what we said. Our lawful basis is our legitimate interest in running our business properly and being able to answer questions about what we did.
3. Special categories of information
We ask four questions about you: your sex, your gender, your religion and your ethnicity.
Religion and ethnicity are special personal information under section 26 of POPIA, and special category data under the UK and EU GDPR. Race, ethnic origin and religious belief get extra protection because misuse of them causes disproportionate harm. Sex and gender are neither, and we collect them on ordinary grounds.
Here is our position, stated plainly.
-
These questions are required, and we only ask them after you have paid for a build or a session. They are not part of anything free, and you are never asked them before you have decided to work with us.
-
We ask for your consent before you pay, not after. The consent sits above the payment button and the button does not work until you tick it. At that point you have paid nothing and declining costs you nothing, which is the only way a consent to these questions can be a real choice.
-
If you pay and then decide you will not answer them, tell us and we refund you in full. You are never trapped between answering and losing money.
-
They are used to build your work. They inform the advice and the roadmap we write for you. This is a change from our previous position, under which they were optional and held only for aggregate reporting. We changed it because it was not an accurate description of how we work, and we would rather correct it than leave it standing.
-
Our lawful basis is your consent, under section 27(1)(a) of POPIA and Article 9(2)(a) of the UK and EU GDPR. Nothing else licenses us to hold them, so if you withdraw that consent we no longer hold them.
-
The options follow your own country’s recognised categories, so the answer means the same thing to you as it does to us. South Africa uses the employment equity categories, the United Kingdom uses the ONS census categories, and the United States uses the federal standard.
-
We keep them for 12 months and then delete or anonymise them. See section 7.
Withdrawing your consent. Write to support@quantumthrivehub.com at any time. We will delete these four fields and confirm within 30 days, and you do not have to give a reason. The rest of your record is unaffected. What withdrawal cannot do is unwrite work we have already delivered to you, because that document is already in your hands.
4. How your work is made
Robert Russell builds your artefact himself. It is not generated and sent to you by a machine.
We use an artificial intelligence model as a drafting and analysis tool while we build it, in the same way we use any other tool. He decides what goes in it, writes and shapes it, and reads the whole thing before it is sent. Nothing reaches you without that.
The AI processor we use is Anthropic, through its application programming interface. The information that reaches the model is the smallest set that lets us do the work, and it never includes your contact details.
Our full statement on this is on our page How we use AI and human review, and we recommend you read it. It sets out what the tool does, what Robert does, what the artefact is and is not, and how to tell us if something in it is wrong.
Automated decision-making. We do not make decisions about you by automated means alone, and there is no version of our service in which we do. Your artefact is built by Robert Russell and is guidance rather than a decision about you. You are entitled to ask us about our reasoning, to put your own view, and to ask us to reconsider anything in it. Write to support@quantumthrivehub.com.
5. Who else processes your information
We use a small number of service providers. Each of them processes your information on our instructions, under a written agreement, and for no purpose of their own.
| Provider | What they do | Where they process | Personal information involved |
|---|---|---|---|
| Anthropic | Provides the AI model that drafts your artefact | United States | First name, last name (comprehensive build only), which of the three starting points describes you, date of birth, sex, gender, religion and ethnicity, Eigenprint Type result, four career answers and seven answers about your working setup. If you buy an artefact, we also send your answers to the written questions we use to write it |
| Paystack | Processes your payment | South Africa and Nigeria | Your payment details, name, email and amount |
| Brevo | Sends our emails | European Union | Your name and email address |
| Cloudflare | Hosts the website and your account. Your account and order records are stored in its D1 database in the European Union. Its Turnstile check confirms that a person, not an automated program, is filling in our forms. Cloudflare Web Analytics counts how many people visit the site. It uses no cookies and saves nothing on your phone or computer | European Union for stored records. Pages are served from Cloudflare’s network worldwide | Your account credentials and order history. For the Turnstile check, your IP address and technical details about your browser |
We do not sell your personal information. We do not share it with advertisers or data brokers. We do not use your intake answers or your artefact to train any AI model, and we have instructed our AI provider accordingly.
Anthropic deletes the information we send it within 30 days. Anthropic keeps it longer only if the law requires it, or if its safety checks pick up possible misuse. In that case Anthropic can keep it for up to two years.
We will disclose your information if the law requires it, if a court orders it, or if we need to establish, exercise or defend a legal claim. If that happens and we are permitted to tell you, we will.
6. Transfers outside South Africa
We never give your information to a partner. Nobody who refers you to us, introduces you to us or works alongside us receives anything about you. Referral runs one way, towards us, and stops there. This is not a current practice that could change quietly: if it ever changed we would have to come back and ask you first.
The only outside parties who touch your information are the service providers we need in order to operate, and they act on our instructions rather than their own. Some of them process it outside South Africa.
Section 72 of POPIA and Chapter V of the UK and EU GDPR permit these transfers where appropriate safeguards are in place. Ours are:
-
A written data processing agreement with each provider, containing the terms section 21 of POPIA and Article 28 of the GDPR require.
-
Standard Contractual Clauses, or the United Kingdom International Data Transfer Addendum, with providers outside the European Economic Area and the United Kingdom.
-
Data minimisation before anything is sent. What leaves for drafting is the smallest set that lets us do the work, and it excludes your contact details entirely.
You may ask us for details of the safeguards that apply to a particular provider. Write to support@quantumthrivehub.com.
7. How long we keep your information
| What | How long | Then |
|---|---|---|
| Name, email | For three years after your last delivery, and after that only on the record of the sale, for as long as tax law requires us to keep it. Also on any consent record you gave, for as long as we keep that record | Deleted or anonymised |
| Telephone, company | For three years after your last delivery | Deleted or anonymised |
| Date of birth, Eigenprint Type, career answers | For three years after your last delivery. Your artefact is the durable output, not the raw answers | Deleted or anonymised |
| Sex, gender, religion, ethnicity | 12 months from collection | Deleted or anonymised. Reviewed monthly |
| Location, product and price tier | Five years from the date we file the tax return that covers the sale, with the sale record | Deleted |
| Orders and payment records | Five years from the date we file the tax return that covers the sale, because tax law requires it | Deleted |
| Consent records | For as long as we keep the information they cover, and three years after that, as proof of lawful processing | Deleted |
| Account login | 30 days after you close your account, or three years after your last delivery, whichever comes first | Deleted |
| Marketing list membership | Until you unsubscribe, then we keep a suppression record so we do not email you again by accident | Suppression record retained |
| Your free Eigenprint Type answers, for an account that never buys | 24 months from your last sign-in | Deleted, and the account is deleted at the same time |
| Correspondence | Three years from the last message in the thread | Deleted |
| Notes we keep about our work with you | For three years after your last delivery | Deleted |
| Your finished artefact | We keep a copy for three years so we can resend it if you lose it. Tell us if you would rather we did not | Deleted |
Your last delivery is the last time we delivered an artefact to you or held a coaching session with you. If we refund you before anything was delivered, the date of the refund counts as your last delivery. Signing in to your account does not reset the clock.
We review retention monthly against this schedule. If you ask us to delete something sooner, we will do it unless the law requires us to keep it, in which case we will tell you which law and for how long.
8. Children
Anyone under the age of 18 needs a parent or guardian to buy for them.
For someone under 18, a parent or guardian creates the account, gives consent and pays, and the young person completes the intake. If an order turns out to be a child buying directly, without a parent or guardian, we refund the payment in full, delete the child’s information and close the account. We keep only the payment reference and the amount, because tax law requires it.
If you believe a child has given us personal information, write to support@quantumthrivehub.com and we will delete it.
9. Your rights
You have the following rights. Exercising them is free, and we will not treat you differently for it.
| Right | What it means |
|---|---|
| Access | Ask us what personal information we hold about you and get a copy |
| Correction | Ask us to correct anything inaccurate, misleading or incomplete. This includes your birth date and your type, which matter to your artefact |
| Deletion | Ask us to delete your personal information, subject to records the law requires us to keep |
| Objection | Object to processing we do on the basis of legitimate interest, and to direct marketing at any time |
| Withdraw consent | Withdraw any consent you gave, at any time. This does not affect processing we did before you withdrew it |
| Restriction | Ask us to pause processing while a dispute about accuracy or lawfulness is resolved (GDPR) |
| Portability | Receive the information you gave us in a structured, commonly used, machine-readable format, or ask us to send it to someone else (GDPR) |
| Automated decisions | Ask for human involvement, express your view, and contest an outcome reached by automated means |
| Complain | Complain to us, and to a regulator |
How to exercise them. Email support@quantumthrivehub.com with what you want and enough detail for us to find your record. We may ask you to verify your identity, because handing your information to the wrong person is the bigger risk. We respond within 30 days, and if we need longer we tell you why before the 30 days are up.
Our full procedure, including the forms, is in our PAIA manual and requests about your information.
9.1 If you are in the United States
Several states give residents specific privacy rights. Whether a particular state law applies to a business depends on its size and on how much data it handles, and we are currently below those thresholds. We would rather tell you what we do than rely on that.
-
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws. We have never done so and we have no plans to.
-
We do not use your information for targeted advertising, which means adverts aimed at you. If we start using an ad service later, we will ask for your permission first.
-
We do not profile you in a way that produces legal or similarly significant effects.
-
The rights in the table above are available to you on the same basis as everyone else: free, within 30 days, with no reason required and no penalty for asking.
-
We do not discriminate against you for exercising a privacy right. Your price, your product and your service are unaffected.
To exercise any of these, email support@quantumthrivehub.com. If you want an authorised agent to act for you, send us written proof of their authority.
10. Marketing
We only send you marketing if you have asked for it, or if you are an existing customer and we are telling you about something similar to what you bought.
Every marketing email has an unsubscribe link that works, in one click, without a login. Unsubscribing is immediate and permanent unless you opt in again.
Marketing consent is separate from the consent you give to have your artefact made. Refusing marketing has no effect on your order.
Under section 69 of POPIA and the amended POPIA Regulations, consent to direct marketing by electronic communication requires positive action from you. A pre-ticked box is not consent, and neither is silence. Our forms reflect that.
11. How we protect your information
-
Access to systems holding personal information is limited to the people who need it, and each has their own account.
-
Multi-factor authentication is required on administrator access.
-
Passwords are stored hashed. We cannot read them.
-
Your artefact files are stored in restricted folders. Public link sharing is switched off.
-
Delivery links expire.
-
We choose providers who publish their security position and who will sign a data processing agreement.
-
We keep a written incident response procedure and we test it.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to affect you, we will notify the Information Regulator and, where the law requires it, we will notify you directly, describing what happened, what it means for you and what we are doing about it.
12. Complaints
Please tell us first. Email support@quantumthrivehub.com and we will investigate and respond within 30 days.
If you are not satisfied, you may complain to a regulator.
South Africa. The Information Regulator.
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
Email: complaints.IR@inforegulator.org.za
Website: inforegulator.org.za
United Kingdom. The Information Commissioner’s Office.
Website: ico.org.uk
European Union. The data protection authority in the country where you live, work, or where you believe the problem happened.
13. Changes to this notice
We will update this notice when what we do changes. When we do, we change the version number and the effective date at the top, and we record what changed at the end.
If a change materially affects how we use information you already gave us, we will tell you directly rather than relying on you noticing.
14. Revision history
| Version | Date | Change | Approved by |
|---|---|---|---|
| 0.1 | 31 July 2026 | First draft for review. Not published | Pending |
| 0.2 | 25 September 2026 | Supplier details filled for a sole proprietor, retention and refund rulings applied, Path and Sky described by how they work | Robert Russell |
| 0.3 | 1 October 2026 | Email and hosting providers named: Brevo and Cloudflare, with D1 and Turnstile. Sex added to the retention row | Robert Russell |
| 0.4 | 2 October 2026 | Section 2.3 no longer describes a free Career Clarity Scorecard. There is none, and the free Eigenprint Type sits behind an account | Robert Russell |
| 0.5 | 5 October 2026 | Added to Anthropic’s row in section 5: the answers to the written questions we use to write an artefact. Added to section 5: Anthropic deletes what we send it within 30 days. Anthropic keeps it longer only if the law requires it, or if its safety checks pick up possible misuse | Robert Russell |
| 0.6 | 7 October 2026 | Added to section 2.2 the name of the video that brought you to the free assessment, why we keep it, and your right to object | Robert Russell |
| 0.7 | 8 October 2026 | Section 5 now says the model receives your sex, gender, religion and ethnicity, in line with the checkout consent | Robert Russell |
| 0.8 | 8 October 2026 | Section 5 providers table: Tally, Make and Google come out, because the intake is built on the site and the automated product is not live. Cloudflare Web Analytics is named in the Cloudflare row | Robert Russell |
| 0.9 | 8 October 2026 | A row for the notes we keep about our work with you in sections 2 and 7: legitimate interest, three years after your last delivery | Robert Russell |
| 0.10 | 9 October 2026 | We added Australia to the countries where the phone number is optional. Australia is now a region of its own on the site | Robert Russell |
| 0.11 | 9 October 2026 | Section 1 says the Information Officer is registered with the Information Regulator of South Africa. Registered on 9 October 2026, number 2026-068770 | Robert Russell |
| 0.12 | 11 October 2026 | Section 4 says Robert Russell builds your artefact, as the terms of sale do. Section 5 lists everything the AI model receives, in line with section 2.1. Sections 2.1 and 3 say the four extra questions come once you have paid for a build or a session. The retention table calls the free answers your free Eigenprint Type answers. In section 9, how to make a request now comes before the part for the United States. Other documents are called by their page headings | Robert Russell, 15 October 2026 |
| 0.13 | 16 October 2026 | Your last name is sent to the AI model for a comprehensive build only, and the section 2.1 row and section 5 say so | Robert Russell, 16 October 2026 |