Privacy Policy

1. Information We Collect

We collect information that you directly provide to us, as well as metadata gathered automatically during service operation.

2. Purpose of Processing & Legal Basis

We process data to deliver the core service features under standard contract performance:

• Account Delivery: To register accounts, authenticate access, and maintain session persistence.
• AI Estimation: To run calculations and generate professional PDF/text quotes for your clients based on job inputs (sqft, rooms, service type).
• Automated Reminders: To deliver scheduled rebooking reminders via WhatsApp (Meta API integration) as requested by you.
• Billing & Fraud Prevention: To verify subscription status and block spam registrations (e.g. temporary/disposable emails).

3. Data Sharing and Third-Party Subprocessors

We do not sell, rent, or trade your data. To perform our services, we share data with the following trusted subprocessors, all of which comply with standard security and privacy regulations:

4. Security, Encryption & Data Residency

We apply bank-grade security protocols to prevent unauthorized access, alteration, or disclosure:

• In-Transit Security: All connections are encrypted via SSL/TLS (HTTPS) using modern cryptographic standards.
• At-Rest Encryption: Database records are encrypted at rest using Advanced Encryption Standard (AES-256) on Supabase infrastructure.
• Security Auditing: Session security and access controls are refreshed using modern server-side JSON Web Token (JWT) verification.

5. Cookies & Session Management

QuoteNest uses essential session cookies (via Supabase Auth) for secure login persistence. We also use analytics cookies (via PostHog) to track feature usage and improve our product, and functional cookies (via Lemon Squeezy) for affiliate tracking on our marketing site. You can disable non-essential cookies in your browser settings. For full details on our cookie practices, please read our Cookie Policy.

6. AI-Generated Content & Data Processing

• QuoteNest uses Google's Gemini AI models to generate professional cleaning estimates and quotes.
• Job inputs (room counts, square footage, service type, add-ons) and business name are sent to Google's API.
• Google's Gemini API does NOT retain or train on user-submitted data per their Cloud API Terms.
• AI outputs are suggestions only; users bear full responsibility for reviewing and confirming accuracy before sending quotes to clients.
• QuoteNest does not use client personal data (names, phone numbers, addresses) as AI model inputs.

7. Data Retention & Deletion

• Active accounts: Data retained for the duration of the subscription.
• Cancelled accounts: Profile and client data retained for 30 days after cancellation, then permanently deleted.
• Backups: Encrypted database backups stored on Cloudflare R2 are automatically rotated and purged after 90 days.
• Users can request immediate, permanent deletion of all data by emailing support@getquotenest.com or via the Settings page.

8. International Data Transfers

• QuoteNest's infrastructure is hosted primarily in the United States (Vercel, Supabase, PostHog).
• If you access the service from outside the US (including the EU/EEA), your data may be transferred to and processed in the US.
• We rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable to ensure adequate protection for cross-border transfers.

9. Data Breach Notification

• In the event of a data breach affecting personal data, QuoteNest will notify affected users within 72 hours via email.
• Where required by law (e.g., GDPR), we will also notify the relevant supervisory authority.
• Our incident response process includes immediate containment, forensic investigation, and remediation.

10. Data Controller vs. Data Processor

Under international privacy frameworks (including GDPR, CCPA, and CPRA), QuoteNest acts solely as a Data Processor when handling the personal information of your clients (e.g., their names and phone numbers). You, the QuoteNest registered user, are the Data Controller. You are solely responsible for ensuring you have obtained explicit, verifiable consent from your clients before uploading their data to our servers or sending them communications via our Meta WhatsApp API integration.

11. Your Rights (GDPR & CCPA Compliance)

Regardless of your residency, QuoteNest provides all users with control over their data. You have the right to:

• Access the personal information we hold about you.
• Rectify or correct any inaccurate client or profile information.
• Request the permanent deletion of your account and all associated client data (right to be forgotten) from the Settings menu.
• Cancel subscriptions instantly to prevent future billing.
• California Residents (CCPA/CPRA): We do not sell, share, or rent your personal information to third parties for monetary or other valuable consideration. You have the right to request access to, deletion of, and correction of your personal data. To exercise these rights, email support@getquotenest.com.

12. Children's Privacy

Our services are intended strictly for business operators and professionals. We do not knowingly collect or solicit personal information from anyone under the age of 13.

13. Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations or services. Any updates will be posted on this page with an updated "Effective Date" at the top. We recommend checking back regularly to stay informed.