Privacy notice
Last updated: 9 November 2026
This notice explains what personal information QuoteFlow collects, why, who else sees it, how long it is kept, and your rights. We've tried to write it in plain English.
Who we are
QuoteFlow is run by QuoteFlow, United Kingdom. We are the "controller" of the information about our account holders. ICO registration number: TBC.
Questions, requests or complaints about your information: email hello@quoteflowuk.co.uk.
The short version
- We only collect what we need to run the app and keep it secure.
- Your quotes, invoices, receipts and your customers' details are kept on your own phone, not on our server. The one exception is a quote you choose to send as an online link (see below).
- No advertising, no tracking, no analytics, no selling of data. The app loads no outside scripts or fonts.
- Job descriptions and photos you ask the AI to help with are sent to our AI provider, Anthropic, to draft your quote. We never store your photos: they are read once and discarded, and Anthropic deletes its copy within 30 days.
What we collect, and why
| Information | Why we need it | Lawful basis (UK GDPR) |
|---|---|---|
| Your email address and a scrambled (hashed) version of your password. We can't read your password. | To give you your own account and let you sign in. | Contract: providing the service you signed up for. |
| Your business details: name, business name, phone, email, hourly rate, VAT setting, payment details, terms and logo. | So they appear on your quotes and follow you to a new phone. | Contract. |
| Sign-in records: which devices are signed in, the browser name, the first part of the network (IP) address, and sign-in times. A short security log (for example "password changed"). | To keep accounts secure, limit how many devices share one login, and stop password guessing. | Legitimate interests: keeping the service and your account secure. |
| How many AI helps you have used this month. | To apply the monthly allowance in your plan and control costs. | Contract. |
| If you pay by subscription: your subscription status (for example "free trial" or "paying"), the date it runs to, and a customer reference from Stripe. We never see or store your card number. | To switch your access on when you subscribe and off when it ends. | Contract. |
| Job descriptions, item names and photos you send for AI help. | To draft your quote and suggest prices. Passed to Anthropic and not kept by us. | Contract. |
| A copy of a quote you choose to share as an online link, and your customer's answer (see below). | So your customer can read and accept the quote online. | Contract (for you). For your customer's details, we act on your behalf: see "If you received a quote link". |
Stored on your phone, not on our server
Quotes, invoices, receipts, your list of customers and their addresses are saved in your phone's web browser storage. We can't see them. If you lose your phone or clear your browser's data, they are gone, so use "Save a backup of my quotes" now and then. Anyone who uses your phone and your QuoteFlow account can see them, so keep your phone locked.
Online quote links
If you tap "Make an online link" on a quote, a copy of that quote is stored on our server: your customer's name and address, the job, the prices and your business details. Anyone who has the link can open it, so only send it to your customer. The link stops working when the quote expires, when you stop it or delete the quote, or when your account is closed. The copy is deleted 60 days after it expires or is answered.
Cookies and storage on your device
We use one cookie, called qf_session. It keeps you signed in and protects your account. It is strictly necessary for the service you asked for, so the law doesn't require us to ask your permission. The app also uses your browser's storage to keep your quotes and settings on your phone, and an "offline copy" of the app so it opens quickly. There are no advertising or analytics cookies.
Who else handles your information
We use a small number of trusted companies ("processors") to run QuoteFlow. They may only use your information to provide their service to us.
| Company | What they do | What they receive | Where |
|---|---|---|---|
| Render Services, Inc. | Hosts the app and its database. | Everything stored on our server (listed above), and short-term technical logs including IP addresses. | Servers in Frankfurt, Germany (EU). Render is a US company certified under the EU-US Data Privacy Framework, including the UK Extension. |
| Anthropic, PBC | AI that drafts quotes and suggests prices. | The job description, item names and photos you send for AI help, and your hourly rate. Not your email address or your customers' contact details unless you type them into a job description. | United States. Under Anthropic's commercial terms, API data is deleted within 30 days and is not used to train their AI by default. Transfers are covered by the safeguards in Anthropic's Data Processing Addendum (standard data protection clauses). |
| Stripe (Stripe Payments UK Ltd and its group) | Takes subscription payments on a payment page that Stripe runs. | The email address, name, card and billing details you type on Stripe's payment page. Stripe tells us only your email address and whether your subscription is active. Stripe also uses payment data for its own legal and fraud-prevention duties, under its own privacy policy. | UK, EU and United States, under Stripe's own safeguards. |
| Brevo (Sendinblue SAS) | Sends emails: password resets, and a note when a customer answers an online quote. | Your email address and the email's content. | European Union (France). |
When you choose to send a quote by WhatsApp, text, email or your phone's share button, that app's provider (for example WhatsApp/Meta, or your email provider) handles the message under its own privacy terms. We don't share anything with them ourselves.
We may also share information if the law requires it, or to protect the service and its users from fraud or abuse.
How long we keep it
- Your account and business details: while you have an account. 90 days after your access ends, your account and everything stored with it is deleted automatically. Ask and we'll delete it sooner.
- Photos: never stored by us.
- Monthly AI-help counts: about 13 months.
- Sign-in sessions: up to 60 days, or 30 days if a device isn't used.
- Security log: 180 days.
- Invitation and password-reset links: they stop working after 7 days and 1 hour respectively.
- Online quote copies and answers: 60 days after the quote expires or is answered.
- Backups: copies of the database kept for disaster recovery are kept for no more than 30 days.
- Payment records: invoices and payment records are kept by Stripe and by us for 6 years, because tax law requires it.
- AI requests: not kept by us. Anthropic deletes them within 30 days (longer only if needed to investigate misuse or by law).
If you received a quote link
If a tradesperson sent you a link to a quote, they are responsible for your information (they are the "controller"). We store the quote on their behalf so you can read it. If you accept or decline, we record your answer, the name you typed, the date and time, your browser's name and the first part of your network address, so the tradesperson has a record of your agreement. This is kept for 60 days after the quote expires or is answered, and the tradesperson may keep their own copy. For questions, contact the tradesperson first, or us at hello@quoteflowuk.co.uk.
Your rights
You have the right to: get a copy of your information; have it corrected; have it deleted; object to or restrict how we use it; and receive it in a portable format. To use any of these rights, email hello@quoteflowuk.co.uk. We'll reply within one month. There's normally no charge.
Complaints
If you're unhappy with how we've handled your information, please tell us first at hello@quoteflowuk.co.uk. We'll acknowledge your complaint within 30 days and tell you what we're doing about it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Security
Passwords are stored only in scrambled form. Connections are encrypted (https). Each account can only reach its own information. Sign-in is protected against password guessing, and you can see and limit the devices on your account. No system is perfectly secure. If a breach affects you, we'll tell you and, where required, the ICO.
Children
QuoteFlow is for businesses and sole traders, not for anyone under 18.
Changes to this notice
If we change this notice in a way that matters, we'll tell account holders by email or in the app before the change takes effect.