Privacy policy

1. Who we are

Quotable is run by Quotable Ltd, a company registered in England and Wales (number 16881346), registered office 85 Bevendean Crescent, Brighton, BN2 4RE. You can contact us about anything in this policy at support@quotable-it.co.uk.

We have two roles, depending on whose data it is:

• Your account details (you, your business, your subscription): we decide how these are used, so we are the controller.
• Your customers' details (the names, addresses, phone numbers and job details you put on quotes, invoices and jobs): you decide what to collect and why, so you are the controller and we are your processor. We only use that data to run Quotable for you, as set out in section 6 of our terms.

2. What we collect

• Account details: your name, email address, password (stored scrambled, never readable), trade, and your business name, address, phone number, website, logo and VAT number.
• Payment details for your invoices: bank details and a payment link, if you add them, so they appear on documents you send.
• Your subscription: plan, status and billing history. Card details are taken by Stripe; we never see or store your card number.
• What you create: job descriptions (typed or spoken), quotes, invoices, clients, jobs and schedules, stock and prices, photos you attach and your settings.
• When your customers use a quote or invoice link: when it was opened, and the name they type if they accept.
• Technical data: IP address, browser and device type, and logs of requests, kept by our hosting and database providers to keep the service secure and working.
• Messages: anything you send us by email or through the app.

3. How we use it, and our legal basis

Data protection law requires a legal basis for each use. Ours are:

We don't sell personal data, and we don't use it for advertising.

4. AI and live prices

When you create a quote, the job description and your relevant settings (such as your trade and rates) are sent to an AI provider, which suggests the materials, quantities and labour. Groq, our main provider, has zero data retention switched on for our account, so it doesn't store requests. Google's paid Gemini API, our backup, doesn't use what we send to improve its products. We don't use the free tier of any AI service that would.

Only include what the AI needs to price the job. You don't need to put your customer's name or address in the job description; those go in the quote's customer fields, which aren't sent to the AI.

To price materials, Quotable reads public product pages on UK merchants' websites. No personal data is sent to the merchants. The AI's suggestions are a starting point: no decision with legal or similar effects is made about anyone automatically.

Spoken job descriptions are turned into text by your own browser's speech service (for example, Chrome uses Google's), under that browser's privacy terms. Quotable receives only the text.

5. Who we share it with

We use the following service providers to run Quotable. They act on our instructions, under contracts that protect your data, and only see what they need:

We'll update this list before adding a new provider that handles personal data. We may also share data if the law requires it, to protect our rights or someone's safety, or with a buyer if Quotable is ever sold (they'd be bound by this policy).

Quotes and invoices you send are shared with whoever you send the link to: anyone with the link can open it, so only send it to your customer. If your customer pays through a payment link you've added (such as your own Stripe, SumUp or PayPal link), that payment is between you, them and that provider.

6. Data sent outside the UK

Some of the providers above are based in, or can be accessed from, the United States. Where personal data leaves the UK, it's protected by the UK's adequacy regulations (including the UK–US Data Bridge, for certified companies) or by the UK International Data Transfer Agreement or Addendum, which are contract terms approved for UK transfers. You can ask us for details.

7. How long we keep it

• Your account and everything in it: for as long as you have an account. If you close it, we delete it within 90 days, apart from the records below.
• Billing and tax records: six years after the end of the financial year they relate to, as the law requires.
• Things you delete (a quote, a client): removed straight away, and gone from backups within 30 days.
• Security logs: usually up to 30 days, kept by our hosting and database providers.
• Daily usage counts used for fair-use limits: 90 days.

8. Keeping it safe

Data is encrypted in transit and at rest. Each account can only reach its own records, enforced by the database itself rather than just the app. Passwords are stored scrambled. Our own access is limited and protected with two-factor sign-in. Quote and invoice links use long random codes that can't be guessed. If a breach puts your data at risk, we'll tell you without delay and report it to the ICO within 72 hours where the law requires.

9. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how we use it, including at any time to marketing;
• get it in a portable format (you can also export your data yourself from Settings);
• withdraw consent, where we rely on it.

Email support@quotable-it.co.uk to use any of these. It's free, and we'll reply within one month. If your request is about a customer's data held in your account, we'll help you deal with it, since you're the controller for that data.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

10. Cookies and similar storage

Quotable only stores what it needs to work in your browser:

• Sign-in: keeps you logged in between visits.
• Preferences: things like your theme and the sample account's example data.

These are strictly necessary, so the law doesn't require us to ask first. We don't use analytics, advertising or tracking cookies. If we ever add analytics, we'll ask for your permission before setting them. Stripe's checkout and billing pages set their own cookies to prevent fraud; see Stripe's privacy policy.

11. Children

Quotable is a business service for people aged 18 and over. We don't knowingly collect data about children.

12. Changes to this policy

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect. The version and date at the top show when it last changed.