GAS Quant MCP Privacy Policy

Effective date: July 15, 2026

Last updated: July 15, 2026

Operator: Risksoft Technology Ltd. (沛然資訊有限公司)

Address: 7F, 150 Zhouzi Street, Neihu, Taipei 114064, Taiwan

Privacy contact: customer@risksoft.com

1. Scope

This Privacy Policy explains how Risksoft Technology Ltd., the operator of GAS Quant and ONE10 services ("Risksoft," "we," "us," or "our"), collects, uses, stores, and shares information when you use the GAS Quant MCP website, OAuth authentication service, remote MCP connector, tools, APIs, documentation, and support channels (collectively, the "Service").

This Policy applies to the GAS Quant MCP service available at https://gas-quant.one10.com and its related authentication services.

2. Information We Collect

2.1 Account and authentication information

When you connect to the Service using OAuth, we may process:

• Your name and email address.
• Account, customer, and user identifiers.
• OAuth subject and client identifiers.
• Roles, scopes, permissions, and tool entitlements.
• Authentication status, login time, session information, and authorization records.
• Information provided by your identity provider, such as Google, according to the permissions shown during authorization.

We do not receive or store your Google password.

2.2 Tool inputs and research data

The Service receives the parameters necessary to perform each tool call. Depending on the tool, these parameters may include:

• Security symbols, markets, products, factors, pools, or strategy names.
• Date ranges and output options.
• Portfolio holdings, weights, prices, or return observations.
• Research filters, ranking parameters, and other query criteria.
• Other content that you or Claude intentionally includes in a GAS Quant MCP tool call.

The Service does not independently access your complete Claude conversation history, Claude memory, unrelated uploaded files, or other conversation content. It receives only the information sent to a specific MCP tool call.

Certain tool-call parameters may appear in protected operational logs for troubleshooting, auditing, quota enforcement, and security purposes. Recognized passwords, authorization headers, API keys, client secrets, and access tokens are excluded from application audit logs.

2.3 Usage, audit, and technical information

We may collect:

• Request IDs and timestamps.
• Account, customer, user, and OAuth client identifiers.
• Authentication method, MCP protocol, and transport information.
• Tool name, API path, request status, and error code.
• Duration, performance, quota, and usage measurements.
• Input and output sizes and aggregate request characteristics, such as row, symbol, or date-range counts.
• IP address or a derived IP hash.
• Browser, client, or user-agent information.

Tool results may contain market data, quantitative scores, research indicators, warnings, and source dates. These results are returned to the requesting client, including Claude when the Service is used through Claude.

2.4 Website, cookies, and support information

Our documentation website does not currently use advertising cookies or third-party advertising analytics. Our authentication service may use cookies necessary to maintain OAuth login, authorization, security, and session state.

If you contact us, we may collect your email address, message content, request IDs, troubleshooting details, and our communications with you.

3. How We Use Information

We use information to:

• Authenticate users and manage authorization.
• Provide GAS Quant MCP tools and return requested research data.
• Enforce account, tool, market, raw-mode, and quota permissions.
• Maintain request traceability and audit records.
• Detect, prevent, and investigate unauthorized access, abuse, fraud, or security incidents.
• Troubleshoot errors and respond to support requests.
• Monitor availability, performance, reliability, and usage.
• Maintain and improve the Service.
• Comply with applicable legal, regulatory, accounting, and security obligations.

Risksoft does not sell personal information. Risksoft does not use MCP tool inputs or outputs to train general-purpose artificial intelligence models.

4. How Data Flows Through Claude

When you use GAS Quant MCP through Claude:

1. You instruct Claude to perform a research task.
2. Claude determines whether to call an enabled GAS Quant MCP tool.
3. Claude sends the required tool parameters to the Service.
4. The Service processes the request and may retrieve data from GAS Quant or ONE10 data services.
5. The Service returns the result to Claude.
6. Claude may use that result to prepare its response to you.

Anthropic separately processes information under its applicable agreements and privacy policies. You should review the Anthropic Privacy Policy and the terms applicable to your Claude plan.

5. Sharing and Service Providers

We may disclose information only as necessary to:

• Anthropic, when you use the Service through Claude.
• Google, when you choose Google as your OAuth identity provider.
• Google Cloud, which hosts or supports Service infrastructure.
• GAS Quant, ONE10, and affiliated systems involved in providing the requested market data and research functionality.
• Professional advisers, auditors, or security providers subject to confidentiality obligations.
• Government authorities, regulators, courts, or other parties when required by applicable law or necessary to protect legal rights and security.
• A successor organization in connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to applicable law.

We do not permit service providers to use personal information for purposes unrelated to providing their contracted services to us. Third-party services process information according to their own terms and privacy policies, including the Google Privacy Policy and Google Cloud Privacy Notice.

6. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy:

Data category	Retention period
Application, access, and tool-call logs	Up to 90 days from creation
Usage, quota, and audit events	Up to three years from the event date
Active OAuth session and token records	Until expiration, revocation, or session termination
Account and authorization records	While the account is active and up to 90 days afterward
Support and privacy-request communications	Up to three years after the last communication
Backup copies	Up to 90 days through normal backup rotation

We may retain specific records for a longer period when reasonably necessary to investigate a security incident, prevent fraud or abuse, resolve a dispute, enforce an agreement, or comply with applicable law.

After the applicable retention period expires, information is deleted, anonymized, or overwritten through our normal system and backup processes.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including HTTPS/TLS transport, OAuth authentication, account and tool-level authorization, restricted administrative access, audit and security monitoring, filtering of recognized credentials from application audit logs, and separation of development and production authentication and service environments.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Choices and Rights

Depending on applicable law, you may have the right to request information about personal data we hold about you; request access, correction, or deletion; object to or restrict certain processing; withdraw consent where processing is based on consent; disconnect the GAS Quant connector from Claude; or revoke OAuth authorization through your account or identity provider.

To submit a privacy request, email customer@risksoft.com. We may need to verify your identity before completing a request. Certain information may be retained when required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcing agreements.

If you do not provide the account, authentication, or tool-input information required for a request, we may be unable to authenticate your account, authorize access, or provide the requested GAS Quant MCP functionality.

9. International Data Processing

The Service may process or store information in countries or regions other than your country of residence, including locations where our service providers operate. Where required by applicable law, we use appropriate contractual, organizational, or other safeguards for international transfers of personal information.

10. Children

The Service is intended for business, professional, and investment-research use. It is not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, please contact us.

11. Changes to This Policy

We may update this Policy to reflect changes to the Service, our data practices, legal requirements, or security standards. When we make material changes, we will update the "Last updated" date and provide additional notice where required by applicable law.

12. Contact Us

For privacy questions, requests, or complaints, contact:

Risksoft Technology Ltd. (沛然資訊有限公司)
7F, 150 Zhouzi Street, Neihu, Taipei 114064, Taiwan
Email: customer@risksoft.com
Website: https://gas-quant.one10.com/contact

---

GAS Quant MCP 隱私權政策

生效日期： 2026年7月15日

最後更新： 2026年7月15日

營運者： 沛然資訊有限公司（Risksoft Technology Ltd.）

地址： 台北市內湖區洲子街150號7樓

隱私權聯絡信箱： customer@risksoft.com

1. 適用範圍

本隱私權政策說明 GAS Quant 與 ONE10 服務營運者沛然資訊有限公司（以下稱「沛然資訊」、「我們」）在您使用 GAS Quant MCP 網站、OAuth 身分驗證服務、遠端 MCP Connector、工具、API、文件及客服管道（以下合稱「本服務」）時，如何收集、使用、儲存及分享資訊。

本政策適用於 https://gas-quant.one10.com 提供的 GAS Quant MCP 服務及其相關身分驗證服務。

2. 我們收集的資訊

2.1 帳號與驗證資料

當您使用 OAuth 連接本服務時，我們可能處理：

• 姓名與電子郵件地址。
• 帳號、客戶及使用者識別碼。
• OAuth subject 與 client 識別碼。
• 角色、scope、權限及可使用工具。
• 驗證狀態、登入時間、session 資訊及授權紀錄。
• Google 等身分提供者依授權畫面所提供的資料。

我們不會取得或儲存您的 Google 密碼。

2.2 工具輸入與研究資料

本服務會接收執行個別工具呼叫所需的參數，依工具不同可能包括：

• 股票代碼、市場、商品、因子、pool 或策略名稱。
• 日期範圍及輸出選項。
• 投資組合商品、權重、價格或報酬觀測值。
• 研究篩選、排名參數及其他查詢條件。
• 您或 Claude 主動放入 GAS Quant MCP tool call 的其他內容。

本服務不會自行存取您完整的 Claude 對話紀錄、Claude memory、無關的上傳檔案或其他對話內容，只會接收特定 MCP tool call 所傳送的資料。

部分工具參數可能出現在受保護的系統營運紀錄中，用於除錯、稽核、quota 管理及安全防護。系統會從應用程式 audit logs 排除可辨識的密碼、Authorization header、API key、client secret 及 access token。

2.3 使用、稽核及技術資料

我們可能收集：

• Request ID 及時間。
• 帳號、客戶、使用者及 OAuth client 識別碼。
• 驗證方式、MCP protocol 及 transport 資訊。
• 工具名稱、API path、呼叫狀態及錯誤代碼。
• 執行時間、效能、quota 及使用量資料。
• 輸入與輸出大小，以及回傳筆數、商品數量或日期範圍等彙總特徵。
• IP address 或由其產生的 IP hash。
• 瀏覽器、client 或 user-agent 資訊。

工具結果可能包含市場資料、量化分數、研究指標、警告及資料日期。這些結果會傳回提出請求的 client；透過 Claude 使用本服務時，結果會傳回 Claude。

2.4 網站、Cookie 與客服資料

我們的文件網站目前不使用廣告 Cookie 或第三方廣告分析工具。身分驗證服務可能使用維持 OAuth 登入、授權、安全性及 session 狀態所必要的 Cookie。

當您聯絡我們時，我們可能收集您的電子郵件地址、訊息內容、request ID、除錯資料及雙方往來紀錄。

3. 資料使用目的

我們使用相關資料以：

• 驗證使用者身分及管理授權。
• 提供 GAS Quant MCP tools 及傳回使用者要求的研究資料。
• 執行帳號、工具、市場、raw mode 及 quota 權限控管。
• 維持 request traceability 與稽核紀錄。
• 偵測、防止及調查未授權存取、濫用、詐欺或資安事件。
• 處理錯誤及回覆客服需求。
• 監控服務可用性、效能、可靠性及使用狀況。
• 維護及改善本服務。
• 履行適用的法律、法規、會計及安全義務。

沛然資訊不出售個人資料，也不會使用 MCP tool 的輸入或輸出訓練通用人工智慧模型。

4. 資料如何透過 Claude 傳送

當您透過 Claude 使用 GAS Quant MCP 時：

1. 您要求 Claude 執行研究工作。
2. Claude 判斷是否需要呼叫已啟用的 GAS Quant MCP tool。
3. Claude 將所需的工具參數傳送至本服務。
4. 本服務處理請求，並可能向 GAS Quant 或 ONE10 資料服務查詢資料。
5. 本服務將結果傳回 Claude。
6. Claude 可能使用該結果產生對您的回覆。

Anthropic 會依其適用的合約及隱私政策另行處理資料。您應閱讀 Anthropic Privacy Policy 及適用於您 Claude 方案的條款。

5. 資料分享與服務提供者

我們僅會在必要範圍內向下列對象揭露資料：

• 您透過 Claude 使用本服務時的 Anthropic。
• 您選擇 Google 作為 OAuth 身分提供者時的 Google。
• 代管或支援本服務基礎設施的 Google Cloud。
• 提供市場資料及研究功能所需的 GAS Quant、ONE10 及關係系統。
• 負有保密義務的專業顧問、稽核人員或安全服務商。
• 依法必須提供資料，或為保護法律權利與安全而有必要時的政府機關、主管機關、法院或其他對象。
• 發生合併、收購、融資、重組或全部／部分業務移轉時的承接組織。

我們不允許服務供應商將個人資料用於與受託服務無關的目的。第三方會依其自身條款及隱私政策處理資料，包括 Google Privacy Policy 及 Google Cloud Privacy Notice。

6. 資料保存期限

我們僅在達成本政策所述目的合理所需的期間內保存資料：

資料類別	保存期限
Application、access 及 tool-call logs	自建立日起最長90天
Usage、quota 及 audit events	自事件發生日起最長3年
有效 OAuth session 及 token 紀錄	至到期、撤銷或 session 終止
帳號及授權紀錄	帳號有效期間及終止後最長90天
客服及隱私權請求往來紀錄	最後一次聯絡後最長3年
備份資料	透過正常備份輪替最長保存90天

為調查資安事件、防止詐欺或濫用、解決爭議、執行合約或遵守適用法律，特定紀錄可能保存較長期間。

保存期限屆滿後，資料會透過正常系統及備份程序刪除、匿名化或覆寫。

7. 資訊安全

我們採取合理的管理、技術及組織措施保護資料，包括 HTTPS/TLS 網路傳輸、OAuth 身分驗證、帳號及工具層級權限控制、限制管理權限、audit 及安全監控、從應用程式 audit logs 排除可辨識的憑證，以及區隔開發與正式環境的驗證及服務系統。

任何傳輸或儲存方式都不可能完全安全，因此我們無法保證絕對安全。

8. 您的選擇與權利

依適用法律，您可能有權查詢我們持有的個人資料、要求存取或取得副本、更正或刪除資料、反對或限制特定資料處理、在以同意為處理依據時撤回同意、從 Claude 中斷 GAS Quant Connector，或透過帳號或身分提供者撤銷 OAuth 授權。

如需提出隱私權請求，請寄信至 customer@risksoft.com。處理請求前，我們可能需要驗證您的身分。依法必須保存，或為安全、詐欺防範、爭議處理或合約執行合理必要的資料，可能無法立即刪除。

如果您不提供完成請求所必要的帳號、驗證或工具輸入資料，我們可能無法驗證您的帳號、授權存取或提供您要求的 GAS Quant MCP 功能。

9. 跨境資料處理

本服務可能在您居住國家以外的國家或地區處理或儲存資料，包括服務供應商營運所在地。適用法律要求時，我們會採用適當的合約、組織或其他保護措施處理個人資料的跨境傳輸。

10. 未成年人

本服務主要提供企業、專業及投資研究用途，不以18歲以下未成年人為服務對象，我們也不會在知情情況下收集18歲以下未成年人的個人資料。如果您認為未成年人向我們提供了個人資料，請與我們聯絡。

11. 政策變更

我們可能因服務內容、資料處理方式、法律要求或安全標準變更而更新本政策。發生重大修改時，我們會更新「最後更新日期」，並依適用法律提供其他必要通知。

12. 聯絡我們

如有隱私問題、資料請求或申訴，請聯絡：

沛然資訊有限公司（Risksoft Technology Ltd.）
台北市內湖區洲子街150號7樓
Email: customer@risksoft.com
Website: https://gas-quant.one10.com/contact