Privacy policy
Last updated: .
Who operates this service
Iman Samizadeh operates Risk Desk as an AvidQuant project. AvidQuant is the project name. Contact info@avidquant.com about this policy.
This policy covers riskdesk.avidquant.com, including its website and remote MCP tools. Your chat provider has a separate policy.
Data you send and how we use it
The service receives the values you supply, such as positions, profit and loss, scenario shocks, currency, dates and source labels. Supplied MCP requests include your data-rights confirmation. Browser uploads also include rights, retention and terms acknowledgements.
We use these values to calculate and return the research results you request. Results include provenance and can include position labels and contributions.
Use opaque position labels. Do not send names, account numbers, passwords, API keys, authentication codes, payment-card details, government identifiers or health records.
MCP calculations
An MCP calculation does not create a stored browser report. The application does not save its request as a portfolio file or database record.
If you omit the request, the tools use a public synthetic example. They do not fetch market data or connect to a broker.
Browser reports
A browser upload creates a report in server memory. The report contains calculated values, provenance and position details.
The report expires after one hour. Reads reject expired reports immediately. A cleanup task runs every minute to remove expired entries.
A restart also removes these reports. The application does not write browser report data to disk or provide a backup.
Anyone with the private report link can access the report before it expires. Keep the link private.
Use Delete this report now on the report page to remove it sooner. Deletion cannot remove copies you saved or shared.
Operational diagnostics
Application and Nginx access logs are disabled. The application does not write raw uploads to persistent storage.
To limit abuse, the application keeps a keyed digest of the client address and request times in process memory. The rate limit uses a 60-second window. Old entries are removed on the next rate-limited request; a restart clears all entries.
Nginx records critical proxy errors, which can include timestamps, request paths and network addresses. Its rotation configuration calls for daily rotation, one rotated file and a one-day maximum age for rotated files. These settings do not impose a one-day expiry on the active log.
The deployed container can record application diagnostics. Docker rotates these logs at 10 MB per file and keeps up to three files. These logs have no fixed time-based expiry; rotation or removal of the container removes them.
Service providers and recipients
Cloudflare and the hosting provider process requests and network metadata, including IP addresses, request headers, timestamps and paths, to deliver and protect the service. Their independent security records follow their own retention policies.
Cloudflare describes its data processing in its privacy policy. If you contact support, the email provider processes your message and reply address to deliver the correspondence.
No sale, advertising or training
Risk Desk does not sell your inputs or use them for advertising, public display, data aggregation or model training. We share them only with the service providers needed to deliver your request.
Cookies and other services
The Risk Desk application has no user accounts, advertising trackers, browser analytics or account cookies. Cloudflare can use security cookies when it applies protection checks.
When you use ChatGPT or another client, that provider also processes your messages and tool results under its own policy.
A report deletion on Risk Desk does not delete the conversation or copies held by another service.
Your choices and requests
Send only data you have permission to share. Use synthetic data for testing. Do not include passwords, account credentials or personal identifiers.
You can use the public synthetic example without uploading data. You can stop before submission or delete a private browser report early.
If your data cannot leave your machine, use local calculation tools without sending that data to a remote chat provider.
Contact info@avidquant.com about access, correction or deletion requests. Do not include a real portfolio or private report link in the first message.
If you contact support, your message and reply address reach the support mailbox. Include only information needed to explain the issue.
Because the service has no accounts, we may be unable to identify a calculation after its temporary data has been discarded.
Your data-protection rights
Where applicable, data-protection law gives you rights to access, correction, erasure, restriction, objection and portability, subject to legal conditions and exceptions. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing. A terms or data-rights acknowledgement is not blanket privacy consent.
Contact [email protected] to exercise applicable rights. You can also complain to the UK Information Commissioner at the ICO complaints page or your competent local data-protection authority. Using infrastructure providers does not remove our own applicable data-protection duties.
Policy changes
This page states the current policy. We update its date when the policy changes.