Privacy Policy

1. Who is responsible for your data

Quotive is operated by Jonathan Pereira, a sole trader based in Portugal (tax number [NIF missing], [address missing]), who is the data controller for the data described in this policy.

For any privacy question, or to exercise your rights, email [contact email missing].

2. What we collect and why

• Account data: your name, email and password (stored only as a one-way hash). If you sign in with Google, we receive your name, email and Google account ID. Legal basis: performing our contract with you.
• Business profiles and quotes: whatever you enter, such as trading name, tax number, address, contact details, scope, prices and client details. Legal basis: performing our contract with you.
• Payments: Stripe processes payments. We never see or store your card details. We keep your email, Stripe customer ID, subscription status and purchase records. Legal basis: performing our contract with you, and complying with tax law.
• Single-quote purchases without an account: the email you give at checkout and a copy of the quote, so we can send you the download link. Legal basis: performing our contract with you.
• Emails: we send essential emails (password resets, purchase receipts, billing notices). We also send account holders a few tips and product updates about Quotive, which you can stop at any time using the link in every such email. Legal basis: performing our contract with you, and legitimate interest.
• Usage analytics: we use PostHog (hosted in the EU) to understand how the site is used. Analytics cookies are only stored on your device if you accept them. Otherwise we count visits anonymously, without cookies. Legal basis: consent (cookies) and legitimate interest (anonymous counts).
• Technical logs: our hosting provider logs IP addresses and browser details for security and abuse prevention. Legal basis: legitimate interest.

Quote drafts you make while signed out are kept only in your browser (localStorage). They are not sent to our servers unless you save or buy the quote.

3. Your clients' data

When you enter your clients' details in a quote (names, emails, addresses), you are the controller of that data, and Quotive processes it only on your behalf, as a processor, to create, store and export your quotes. We don't use it for anything else, we only share it with the processors listed below, and we delete it when you delete the quotes or your account.

4. Who we share data with

We don't sell personal data or use it for advertising. We use the following providers (processors), each with access only to what it needs to provide its service:

• Vercel: website and application hosting.
• Neon: database (Frankfurt, EU).
• Stripe: payments and billing (Stripe Payments Europe, Ireland).
• Resend: email delivery.
• PostHog: usage analytics (EU hosting).
• Google: only if you choose to sign in with Google.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable.

5. How long we keep data

• Account data, business profiles and quotes: for as long as your account is active. When you ask us to delete your account, we delete this data within 30 days.
• Payment and billing records: for as long as Portuguese tax law requires (up to 10 years).
• Single-quote purchases: the download link expires after 30 days. The purchase record is kept for accounting.
• Password reset links: expire after 1 hour.
• Usage analytics: for as long as it's useful for understanding usage trends, after which it's deleted.

6. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (this doesn't affect processing that already happened).

To exercise any of these rights, email [contact email missing]. We reply within one month.

You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

7. Security

Passwords are stored only as bcrypt hashes, every connection uses HTTPS, and access to production data is restricted. No system is perfectly secure, but we take reasonable steps to protect your data.

8. Children

Quotive is built for professionals and isn't intended for anyone under 16.

9. Changes to this policy

If we make significant changes, we'll tell you by email or on the site before they take effect. The date of the last update is shown at the top of this page.