Privacy Policy

1. Information We Collect

We collect the following types of information to provide and improve our Service:

• Personal Information: Name, email address, phone number, business name, and address
• Account Information: Username, password, subscription details, billing information, and an optional birthday month and day (never a required birth year)
• Business Data: Quotes, invoices, customer information, payment history
• Usage Data: Browser and device type, pages viewed, referral domain, usage patterns, and approximate city, region, and country derived from an internet address
• Client document activity: The contractor who owns a shared quote or invoice can see recorded opens and visible-time activity, with an approximate city, region and country when available. Cloudflare supplies this network-based estimate; it is not GPS, proof of identity or proof of attention. VPNs and mobile networks can produce inaccurate locations. This activity feature does not add raw IP addresses, browser/device details, coordinates or postal codes to activity records. Hosting providers may retain their ordinary security logs. Older events may not have a location.

2. How We Use Your Information

We use your information for the following purposes:

• Provide and maintain the Service
• Process payments and manage subscriptions
• When you optionally provide a birthday month and day, wish you a happy birthday, determine annual account-gift eligibility, prevent duplicate claims, and apply the gift you activate
• Determine whether an account is eligible for an administrator-created promotion, record an explicit activation, enforce activation limits, and provide the temporary benefit
• Send invoices, quotes, and transactional communications
• Improve, test, and develop our Service
• Respond to customer support requests
• Send service updates and promotional communications (with your consent)

Important: We do not sell, trade, or rent your personal data to third parties. We only share your data with service providers necessary to operate the Service.

3. Data Storage

Your data is stored on Supabase, a PostgreSQL database hosted on AWS. We implement industry-standard security measures to protect your data, including:

• Encryption at rest and in transit
• Regular security audits and updates
• Access controls and authentication
• Backup and disaster recovery procedures

4. AI Voice Transcripts and Optional Audio

When you submit text from Voice To Quote using Generate Quote, QuoteDr saves that text transcript to your authenticated account. We retain it so you can review what was submitted, connect a later question to the source wording, and help us investigate a reported AI Voice problem.

• Audio requires an explicit first-use choice: Before Voice To Quote can use the microphone for the first time, you must choose either Save private audio for 14 days or Transcript only. QuoteDr does not begin recording before that decision. Your selection is saved as your account default, shown whenever you open Voice To Quote, and can be changed later. Choosing Transcript only prevents QuoteDr from retaining original microphone audio; it does not silently delete recordings already listed in your history.
• Separate records: Text transcript retention is separate from optional audio. Audio expiry or deletion does not delete, shorten, or overwrite the text transcript. The optional audio is support evidence and is not sent to the quote parser.
• Private storage and playback: Audio files are stored in a private Supabase Storage bucket, not in the public database and not at a public URL. Playback uses a short-lived access link after an ownership or authorized-support check. QuoteDr does not place a service-role credential in your browser.
• Normal audio retention: Optional audio is scheduled for automatic deletion from active storage 14 days after capture. Each history entry shows its file size and current expiry date. Browser formats and encoded sizes vary; QuoteDr enforces per-recording duration and file-size limits and a rolling account storage cap.
• Case-specific preservation: Before normal expiry, you can preserve one recording for a specific support case by entering the case reference, explaining the reason, and explicitly authorizing support access. An active authorized case pauses normal expiry. When you or authorized support closes the case hold, the recording is scheduled for deletion after a 30-day post-case period.
• Your deletion control: You can delete optional audio immediately unless that exact recording is temporarily held for an active case you authorized. The history explains an active hold and lets you end it; after the hold ends, you may delete the recording immediately.
• Account access: Other customers cannot view your transcripts. You can view, copy, or delete them from AI Voice Transcript History.
• AI processing: The submitted text is sent to our AI service provider to create and verify the quote draft.
• Limited, audited support review: QuoteDr staff do not routinely view transcripts. QuoteDr Support cannot listen to original audio unless you explicitly authorize the exact recording for a specific customer-support investigation and case. Transcript review requires an exact account identity and a real case or investigation reason. Audio cannot be browsed generally: support must use the exact account, exact active case reference, an investigation reason, and the owner's explicit recording authorization. Access is case-bound and audited. Transcript searches, playback, case holds, deletion, and cleanup are audited; access-audit records are retained for up to two years for security and accountability.
• Sensitive information: Avoid dictating access codes or unnecessary sensitive information. Voice To Quote includes a visible live recording indicator and a pause control so you can pause during private conversations.
• Investigation evidence only: A stored recording can help a human compare what was said with the transcript and generated draft. It is not represented as legal proof and does not automatically guarantee compensation, a credit, refund, or reimbursement.
• No advertising use: QuoteDr does not sell Voice To Quote transcripts or use them for advertising or routine employee monitoring.
• Text retention: Transcripts remain in your active account until you delete them or the account is removed, subject to legal obligations and normal backup-protection periods.

5. Third-Party Services

We use the following third-party services to operate the Service:

• Stripe: Payment processing and billing
• Supabase: Database hosting and management
• Cloudflare: Website hosting and security
• OpenAI: AI processing for features such as Voice To Quote
• PostHog: Privacy-conscious website and product analytics, including coarse geographic and referral reporting

These third parties have access to your data only to perform the services they provide and are prohibited from using it for other purposes.

Our administrator traffic view uses generated visitor labels and approximate location only. It does not display or copy raw IP addresses, exact coordinates, quote contents, client information, material details, or pricing data into visitor alerts.

6. Cookies and Tracking

We use minimal cookies to enhance your experience:

• Session Cookies: Required for you to use the Service
• Analytics Cookies: Help us understand which public pages and product tools are useful (optional and disabled when browser Do Not Track or QuoteDr analytics opt-out is active)

Marketing analytics use normalized page routes without query strings, hashes, portal tokens, client identifiers, or full referral URLs. You can manage cookie preferences through your browser settings.

7. Your Privacy Rights

Under applicable laws, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request updates to inaccurate information
• Deletion: Request deletion of your data (see Data Retention below)
• Export: Request a copy of your data in a portable format
• Opt-out: Opt out of marketing communications

To exercise these rights, contact privacy@quotedr.io.

8. PIPEDA Compliance

As a Canadian company, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). This means:

• We collect only the information necessary for our purposes
• We obtain your consent for collection, use, and disclosure
• We protect your information with appropriate security measures
• You have the right to access and correct your information
• We retain your information only as long as necessary

9. GDPR Compliance

If you are located in the European Union, we comply with the General Data Protection Regulation (GDPR). This includes:

• Providing clear and transparent information about data processing
• Obtaining lawful basis for processing your data
• Respecting your data subject rights
• Implementing appropriate data protection measures

10. Data Retention

We retain your data for the following periods:

• Active Accounts: As long as your account is active
• Birthday rewards: Birthday month/day, change history, and annual gift claim history are retained with the active account to enforce change and one-gift-per-365-days limits and to resolve support questions
• Promotion activations: Promotion identifier, benefit period, and activation history are retained with the active account to prevent duplicate activations, enforce promotion limits, and resolve support questions
• Closed Accounts: Your data is deleted within 30 days of account closure
• Legal Requirements: We may retain data longer if required by law

11. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with applicable privacy laws.

13. Security

We implement robust security measures to protect your data, including:

• Encryption of sensitive data
• Secure authentication and authorization
• Regular security assessments
• Incident response procedures

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on this page
• Sending an email notification to your registered email address

Continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Information

If you have any questions about this Privacy Policy, please contact us at:

Email: privacy@quotedr.io