Privacy Policy

1. Introduction

QuoteFlow Pro ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our cloud-based business management platform ("the Service").

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act (Cap. 586 of the Laws of Malta), and other applicable data protection legislation.

2. Data Controller

The data controller responsible for your personal data is:

QuoteFlow Pro
Email: support@quoteflowpro.app

3. Data We Collect

3.1 Account Information

When you register, we collect your full name, email address, and password (stored as a secure hash). If you register on behalf of a business, we also collect company name, VAT number, registered address, and contact details.

3.2 Business Data

Through your use of the Service, you may create and store quotes, invoices, purchase orders, client records, payment records, product catalogues, and other business documents. This data is created and controlled by you.

3.3 Usage & Technical Data

We automatically collect: IP addresses, browser type and version, device information, pages visited, timestamps, and referring URLs. This data helps us maintain security and improve the Service.

3.4 Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number or bank details. Stripe may collect payment information directly under their own privacy policy.

3.5 Cookies

We use essential cookies for authentication and session management. We may also use analytics cookies to understand how the Service is used. You can manage cookie preferences through your browser settings or our cookie consent banner.

4. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery: To create and maintain your account, process your documents, and provide the features you use
• Communication: To send transactional emails (e.g., password resets, subscription confirmations), service announcements, and support responses
• Billing: To process subscription payments and manage your plan
• Security: To detect fraud, prevent abuse, and protect the integrity of the Service
• Improvement: To analyse usage patterns and improve the Service (using aggregated, anonymised data where possible)
• Legal compliance: To comply with applicable laws, regulations, and legal processes

5. Legal Basis for Processing

We process your personal data under the following legal bases (Article 6 GDPR):

• Contract performance: Processing necessary to provide the Service under our Terms of Service
• Legitimate interests: Security monitoring, fraud prevention, service improvement, and business analytics
• Legal obligation: Compliance with applicable tax, accounting, and regulatory requirements
• Consent: Where you have given explicit consent, such as for optional marketing communications or non-essential cookies

6. Data Sharing & Third Parties

We share personal data only as necessary to operate the Service:

• Supabase (database hosting, authentication) — stores your account and business data
• Vercel (application hosting) — serves the web application
• Stripe (payment processing) — processes subscription payments
• Anthropic (AI features) — processes document images for AI OCR import (images are not stored by Anthropic)
• Email providers — transactional emails sent via your configured SMTP provider or Gmail

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. International Data Transfers

Some of our third-party service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the service provider's participation in recognised data protection frameworks.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion:

• Your business data is permanently deleted within 30 days
• Anonymised analytics data may be retained indefinitely
• Billing records are retained for the period required by applicable tax and accounting laws
• Security logs are retained for up to 12 months

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-level security (RLS) ensuring strict tenant isolation in the database
• Encrypted storage of sensitive credentials (SMTP passwords, OAuth tokens)
• Rate limiting and account lockout to prevent brute-force attacks
• Password policies requiring minimum length and complexity
• Role-based access control within team accounts

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request that we limit how we process your data
• Data portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at support@quoteflowpro.app. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes via email or a prominent notice within the Service. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

13. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

QuoteFlow Pro
Email: support@quoteflowpro.app