Privacy Notice

1. Data we collect and why

• Account data (name, email address, login credentials, company name, registration number, VAT ID, address, phone, IBAN, website, logo) — to create and operate your account and to render your business details on the documents you generate. Legal basis: performance of our contract with you.
• Content data (quotes, invoices, price book items, client names and contact details you enter, signatures, scheduled jobs, activity log comments) — to provide the service. Legal basis: performance of our contract. Where this includes your clients' details, you are the controller and we process it on your behalf.
• Usage and technical data (device identifiers, browser type, IP address, log and error data) — to keep the service secure, prevent fraud and abuse, and improve reliability. Legal basis: our legitimate interests.
• Support messages — to answer your questions. Legal basis: legitimate interests and contract performance.
• Marketing communications — only where you have opted in. Legal basis: consent, which you may withdraw at any time.

2. Who we share data with

• Service providers and subprocessors that host our infrastructure, database, storage, email delivery and error monitoring.
• Paddle.com, our Merchant of Record, for the sale of our product, subscription management, payments, tax compliance and invoicing.
• AI processing providers used only when you actively use AI drafting features.
• Professional advisers such as legal and accounting firms where necessary.
• Public authorities where we are required to do so by law.

We do not sell personal data.

3. International transfers

Some of our providers may process data outside the EEA/UK. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate additional safeguards.

4. Retention

We keep account and content data for as long as your account is active. After account closure we delete or anonymise personal data within a reasonable period, except where we must retain records to meet legal, tax or accounting obligations.

5. Your rights

Under the GDPR you may request access to your data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time. We respond to requests within one month. You also have the right to lodge a complaint with your data protection supervisory authority.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls, row-level database authorisation and least-privilege access for our systems.

7. Cookies and local storage

We use essential cookies and browser storage to keep you signed in, remember your language preference and secure the service. These are strictly necessary for the service to work. We do not use advertising cookies. You can clear or block storage in your browser settings, but parts of the service may then stop working.

8. Contact

For privacy requests, contact QuoteGenius through the support contact shown in your account.