Quotlane

Privacy Policy

Draft for review, not in effect

This document has not been approved. Highlighted items in brackets must be decided by the business owner, and the whole text reviewed by a qualified lawyer, before it is published or relied on.

Effective date: [effective date]. This policy explains what personal data Quotlane (provided by [legal entity name], [registered address]) processes and why. Contact: [privacy contact email].

1. Our role

For account data (people who sign up and use the service) we decide how it is used. For the content a business puts into its workspace (its customers, contacts and their emails) the business decides, and we process it on its behalf. [controller and processor roles, to be confirmed by counsel]

2. What we process

  • Account data: name, email address, password (stored by our authentication provider as a hash, never readable by us), two factor authentication settings and recovery codes (stored hashed).
  • Workspace content: catalog, prices, customers, contacts, quotes, conversations and the emails received through the workspace's forwarding address or sent from it, with their attachments.
  • Mailbox connection: when a member connects a Google mailbox, an OAuth token limited to sending email (the gmail.send permission), stored encrypted. We cannot read the mailbox.
  • Billing: Paddle customer and subscription identifiers and payment status. Card details are entered on Paddle's checkout and never reach us.
  • Security and operations: IP address and browser user agent in the audit log and for rate limiting; error reports with personal data removed.

3. Why

To provide the service (reading requests, preparing and sending approved emails, follow ups), to secure it (authentication, audit log, abuse limits), to bill for it, and to send service notifications to owners and managers (for example a failed payment or follow ups waiting for approval). We do not sell personal data and do not use workspace content for advertising. [legal bases for each purpose]

4. Service providers

  • Supabase: database and authentication (United States, AWS us-east-1).
  • Vercel: application hosting. [region]
  • Paddle: payments, as reseller and merchant of record.
  • Google: sending email from a mailbox a member connects.
  • Cloudflare: receiving forwarded email, once inbound forwarding is enabled.
  • Resend: service notification emails, if enabled.
  • Sentry: error reports with personal data removed, if enabled.
  • Anthropic: reading requests with an AI model, only if AI reading is switched on (it is not today).

5. How long we keep data

[retention periods, to be decided after review] Today nothing is deleted automatically. When a subscription ends the workspace becomes read only. An owner can export the data at any time and ask for the workspace to be deleted; after a reviewed deletion, billing and commission records are kept without the workspace's contents.

6. Security

Workspaces are isolated from each other in the database, connections are encrypted and verified, mailbox tokens are encrypted, approvals and settings require two factor authentication, and every sensitive action is recorded in an audit log.

7. Your rights

You can ask to access, correct, export or delete your personal data by writing to [privacy contact email]. Requests about data inside a business workspace are handled with that business. [applicable rights and supervisory authority, to be confirmed by counsel]

8. International transfers

[transfer mechanisms for data processed outside the user's country]

9. Changes

[how users are told about changes to this policy]