Privacy Policy

1. Who we are

This Privacy Policy is issued by QuoteAI (referred to as "the Company", "we", or "us"), a business operating from Ontario, Canada, reachable at privacy@quoteai.ca. The person in charge of the protection of personal information (Québec Law 25) can be reached at the same address. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information we collect

We collect the following categories of personal information:

• Account information: first name, last name, and email address, provided when you create an account.
• Business profile information: company name, Business Number / GST-HST number, address, phone number, business email, and company logo.
• Quote data: job descriptions, client (customer) information, amounts, and line items on quotes you generate.
• Payment information: handled directly by Stripe Inc. — we never access your full credit card details.
• Authentication credentials: your password is stored as a salted hash on our own servers; we do not send it to any third-party identity provider.
• Technical information: IP address, browser type, pages visited, and session duration (via system logs).

3. Purposes and grounds for collection

4. Data retention

We retain personal information only for as long as necessary for the purposes described above:

• Account data — until you delete your account. Deletion is self-serve (Settings → Security → Delete account) and takes effect after a 7-day grace period during which you can cancel from the confirmation email; your login is blocked, your subscription cancelled and connected services disconnected as soon as you request it. At the end of the grace period every quote, client, job, cost, photo, document and setting is permanently erased, including files in storage.
• Signed contracts and issued invoices — kept for 7 years after deletion, as required by the Income Tax Act, the Excise Tax Act (GST/HST) and Revenu Québec for books and records. They are unlinked from the deleted profile and held under an anonymous record that keeps only the business name and tax registration numbers needed to identify them; they are then deleted automatically.
• Subscription billing records — 7 years, per CRA requirements for GST/HST and income tax records (held by Stripe and in our accounting).
• Data exports — the ZIP file you request from Settings → Security is deleted 7 days after it is produced.
• Technical logs — 90 days. Encrypted database backups — 30 days, so deleted data can persist in a backup for up to 30 days after the purge.

5. Who we share information with

Personal information may be shared with the following categories of recipients:

• Stripe Inc. — payment processing and payouts (Stripe Connect).
• AI providers (Groq, Inc. or OpenAI, LLC) — quote, contract and document generation. The job description, the photos and documents you attach, your price catalogue and the client details on the quote are sent under their API terms of service.
• Vercel Inc. and Supabase Inc. — application hosting, database and file storage.
• Resend Inc. — transactional email delivery; Gmail (Google LLC) or Outlook (Microsoft Corporation) when you connect your own mailbox to send from it.
• Meta Platforms, Inc. — WhatsApp Business messages you choose to send to clients, and Meta Lead Ads if you connect an ad account.
• Google LLC and Microsoft Corporation — calendar sync (Google Calendar, Outlook) when you connect a calendar.
• Intuit Inc. (QuickBooks) and Wave Financial Inc. — accounting sync when you connect them.
• Financeit Canada Inc. and Flinks Technology Inc. — client financing offers and bank-transaction matching when you enable them.
• PostHog, Inc. and Google LLC (Google Analytics) — product analytics and website traffic measurement.
• Twilio Inc. — text messages (SMS) you choose to send to clients and crew, and the replies they send back.
• Functional Software, Inc. (Sentry) — error reports when something fails in the app; they carry the technical context of the error (page, browser, account identifier), not the content of your quotes.
• Apple Inc., Google LLC and Mozilla Corporation — delivery of the push notifications you turn on, through your browser's own push service.

We do not sell personal information to third parties. Where information is processed or stored outside Canada (including in the United States), we take reasonable steps to ensure a comparable level of protection through contractual safeguards, consistent with PIPEDA principle 4.1.3 (accountability for information transferred to third parties).

6. Your rights

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access — request a copy of the personal information we hold about you. Account owners can download everything at once from Settings → Security → Export my data (one export per day, link valid 7 days).
• Correction — request correction of inaccurate or incomplete information.
• Withdrawal of consent — withdraw consent at any time, subject to legal or contractual restrictions.
• Deletion — delete your account yourself from Settings → Security → Delete account, subject to the legal retention obligations in section 4.
• Complaint — file a complaint about how we handle your information.

To exercise these rights, contact us at privacy@quoteai.ca. We will respond within 30 days. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada, or with your provincial privacy regulator where applicable.

7. Cookies and tracking technologies

We use only strictly necessary cookies required for the service to function (authentication, session management). We do not use profiling or third-party advertising cookies.

8. Security

We use appropriate technical and organizational safeguards to protect personal information against unauthorized access, loss, or alteration: encrypted connections (TLS/HTTPS), access controls, and hashed credential storage on our own infrastructure.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via an in-platform notice at least 14 days in advance.

10. Contact us

For any questions about this Privacy Policy: privacy@quoteai.ca