Privacy Policy

Who we are

Quote Composer provides quoting software to contractors. When you request a quote, you are dealing with the contractor whose site or link you used. They decide what to do with your enquiry; we store and process it on their behalf.

What we collect

When you request a quote, we collect:

• The property address you enter, and its map coordinates
• The project layout you draw and the products or materials you select
• Your name, email address, phone number, and any notes you add
• Any photos you choose to upload
• Basic usage events about how the quote flow was used, so contractors can see where people drop off

When you accept a quote, we additionally record your typed signature, the time, your IP address, and your browser's user agent, as evidence of the acceptance.

For contractors using the dashboard, we collect account and organization details through our sign-in provider, plus the workspace settings you configure.

How we use it

On our homepage and public demos, we use Vercel Web Analytics to measure link and control clicks, map engagement, drawing starts and completions, and quote-preview views. These interaction events do not include entered addresses, map coordinates, drawing layouts, or contact details. We do not record session replays.

To produce your quote, send it to you, notify the contractor, and let both sides follow up. We use aggregate usage data to operate and improve the product. We do not use customer quote details for advertising.

Optional advertising measurement

When enabled, and only after you accept advertising, we send Meta (Facebook and Instagram) page views on approved marketing pages, sample-demo opens, and successful walkthrough or setup enquiries. We use these events to measure advertising and create website retargeting audiences. General enquiries, clicks and form starts are not advertising leads.

Meta receives the event name, an approved marketing page URL and referrer, browser and advertising-click identifiers and, for a confirmed enquiry, an event identifier used to avoid double counting. Only reviewed URL parameters are allowed, such as a contact topic or Meta click identifier. Browser requests also disclose your IP address and browser information to Meta. Our server may send the confirmed Lead with the same event identifier, browser and click identifiers and browser information. We do not send your name, email, message, property address, coordinates, quote details or account identifier. Automatic advanced matching and automatic event detection are not used. Advertising tracking is excluded from workspaces, customer quote and share links, payments, authentication, previews, embedded experiences and demos using an entered address.

Use Advertising preferences on marketing pages or this page to accept, reject or withdraw consent. We remember this choice for six months in the qc_advertising cookie. Optional _fbp and _fbc browser and click cookies last up to 90 days and are removed when you reject or withdraw. We honor Global Privacy Control (GPC) and Do Not Track as advertising opt-outs. Withdrawal stops future events; it does not recall data already sent. Contact us about access or deletion requests.

Sharing consented browsing events with Meta for targeted advertising may be considered sharing or a sale under some privacy laws. You can opt out using Advertising preferences or GPC. Meta processes received data under its Privacy Policy. Vercel analytics remains separate from optional Meta advertising.

Google Calendar connection

A workspace owner may choose to connect a Google account so booked site visits appear on a company calendar. We use the account's email address to identify the connection and show the list of calendars the account can write to so the owner can choose one. We do not read the contents of existing calendar events.

When a site visit is booked, rescheduled, or cancelled, we create, update, or delete its Google Calendar event. The event may include the customer's name and email address, the property address, the visit time, and a link to the quote. Google Calendar may send event invitations and updates to the customer as an attendee.

We store the connected account email, the chosen calendar identifier, and an encrypted access credential so the connection can keep working. We also store the identifiers of site visit events we create so we can update or remove them when the visit changes. Disconnecting removes our stored credential and stops future calendar updates; events already created remain on the calendar. The owner can also remove Quote Composer's access in their Google Account.

We protect Google account and Calendar data in transit with HTTPS. Before storing the Google refresh token in our database, we encrypt it with AES-256-GCM using a server-side secret kept separate from the database. Only authenticated workspace owners can connect, change, or disconnect a Calendar account, and Calendar settings are restricted to the workspace. Disconnecting deletes the stored refresh token. We do not use Google Calendar data to develop, improve, or train generalized AI or machine learning models.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Who we share it with

Your enquiry is shared with the contractor you requested it from. Beyond that, we use the service providers below to run the product. Each processes data only as needed to provide their service.

• Vercel — Application hosting and file storage
• PlanetScale — Database hosting
• Google Maps Platform — Address lookup and satellite imagery
• Google Calendar — Optional company calendar sync and customer invitations
• Amazon Web Services (Amazon SES) — Transactional email delivery
• Clerk — Contractor account sign-in and organizations
• Stripe — Deposit payments, when a contractor enables them
• Sentry — Error monitoring

Address searches and map views send the search text or viewed location to Google Maps Platform. Google processes this information under its Privacy Policy. A selected address and location are retained with your quote; search predictions are not stored in a shared address database.

A contractor may also forward quote details to their own CRM or chat tools if they have configured that. Those systems are outside our control and governed by that contractor's own policies.

Links in your email

Quote and account links contain a long random identifier and are not listed in search engines. Anyone with the link can view that quote, so treat it as private and avoid forwarding it to people you don't want to see your details.

Retention

We keep quote records for as long as the contractor's account is active, since they form that business's customer history. Photos uploaded but never submitted with a quote are deleted automatically.

Your choices

You can ask us to access, correct, or delete your information by writing to contact@quotecomposer.com. If your request concerns a quote you sent a contractor, we may need to refer you to them, or act on their instruction, since it is their customer record.

Changes

If we change this policy we will update the date above. Continuing to use the service after a change means you accept the updated policy.