Privacy policy

This policy explains what Quotefloor does with personal data. Quotefloor is operated by QuoteFloor LTD, a company registered in England and Wales, of Fourth Floor, St James House, St James's Row, Burnley BB11 1DR. The company is owned and run by Connor Myles and Tom Henderson.

If you have any questions about this policy or how your data is handled, email hello@quotefloor.co.uk.

Two different sets of data

This matters, so it comes first. Quotefloor holds two kinds of personal data and our responsibilities are different for each.

• Your data as a Quotefloor subscriber. Your email, your business details, your billing information. We decide how this is used, so we are the data controller for it.
• Your customers' data that you enter into quotes. Names, addresses and any notes you type. You decide what goes in and why, so you are the controller and we are your processor. We only use it to run the service for you.

In practice that means we will never contact the customers you quote, market to them, or use their details for anything other than storing and displaying your quotes, invoices and diary.

What we collect about you

• Account details — your email address, your name if you set one, and a password which is hashed by our authentication provider. We never see or store your password in readable form.
• Business details — trading name, phone, email, address, VAT number, bank details for your invoices, and your logo. These appear on the documents you produce.
• Your price book — the rates and settings you enter.
• Quotes, invoices, diary entries and stock — the rooms, measurements, figures, payments, bookings and any customer name, address, phone number or notes you choose to enter.
• Billing — subscription status, renewal dates and the last four digits of your card. Full card details go directly to Stripe and never touch our servers.
• Technical data — IP address, browser type and server logs, kept for security and to diagnose faults.

Why we hold it, and on what basis

• To provide the service you have paid for — account, price book, quotes, invoices, diary and stock. Legal basis: performance of a contract.
• To take payment and prevent fraud — via Stripe. Legal basis: contract and our legitimate interests.
• To keep the service secure and working — logs and error reports. Legal basis: our legitimate interests in running a reliable service.
• To meet accounting and tax obligations — invoices and payment records. Legal basis: legal obligation.

We do not sell your data, we do not share it with advertisers, and we do not use it to train anything.

Who else handles it

We use a small number of suppliers to run the service. Each is bound by contract to protect the data and use it only on our instructions.

• Supabase — database, authentication and file storage. Hosted in Ireland (EU).
• Vercel — application hosting and content delivery.
• Stripe — payment processing. Stripe is a controller in its own right for payment data; see stripe.com/privacy.
• Resend — sending emails: account messages, and the quotes, invoices and receipts you choose to send to your own customers.

Some of these suppliers may process data outside the UK or EEA. Where that happens it is covered by an adequacy decision or by standard contractual clauses.

Quotes and invoices you send

When you email a quote or an invoice, your customer receives a link rather than an attachment. That link carries a long random token: it is not guessable and it is not listed anywhere, but anyone who has the link can see that one document. Treat it the way you would treat a tracking link — it is fine to forward to the customer it belongs to, and not something to post publicly.

Cookies

Quotefloor sets only the cookies it needs to keep you signed in and keep your session secure. There is no advertising, tracking or analytics cookie, which is why you are not asked to accept a banner. If you block these cookies you will not be able to sign in.

How long we keep things

• While your account is open — your account, price book, quotes, invoices and diary stay as you left them, including through a lapsed subscription, so nothing is lost if you come back.
• After you delete your account — your data is deleted within 30 days.
• Billing and invoice records — kept for six years, as tax law requires.
• Server logs — kept for up to 90 days.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your data, where we have no legal reason to keep it
• give you your data in a portable format
• restrict or object to how we use it

Email hello@quotefloor.co.ukand we will respond within one month. If you are unhappy with how we have handled things you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Your obligations to your own customers

When you enter a customer's name and address into a quote, you are the data controller for that information. You are responsible for having a lawful basis to hold it and for telling your customers how you use it. Quotefloor gives you the tools to export and delete that data at any time.

Security

Data is encrypted in transit and at rest. Access to your records is restricted at database level so that one subscriber cannot see another's data. Payment card details are handled entirely by Stripe and never reach our servers.

Changes

If we change this policy we will update the date at the top, and tell you by email if the change is significant.