# Quality Quote — Master System Execution Tree > Version 2.0 · Europe-first SaaS · EUR billing · Source of truth for execution ## Product thesis Quality Quote is not a review filter. It is a closed operational improvement loop: ```text Customer problem → private verified signal → AI-assisted diagnosis → accountable staff task → manager verification → customer recovery → optional controlled reward → honest follow-up experience → recurring prevention → measurable business improvement ``` The customer must always remain free to give an honest opinion. A reward can recognise a repaired experience, but must never require a positive review. ## Complete connected tree ```text QUALITY QUOTE │ ├── 01. PUBLIC WEBSITE │ ├── Homepage: problem, promise, product preview, workflow, proof, FAQ, CTA │ ├── Product, Pricing, Security, Help and Legal pages │ ├── Business registration and login │ └── Downloadable master system blueprint │ ├── 02. BUSINESS REGISTRATION │ ├── Google OAuth or work-email registration │ ├── Email verification, secure session and optional MFA │ ├── Create organisation and owner membership │ ├── Business identity, country, timezone and billing email │ ├── Terms, Privacy and DPA acceptance │ ├── Create Stripe customer and trial state │ └── Continue into onboarding wizard │ ├── 03. ONBOARDING WIZARD │ ├── Business name, industry, logo, colours and default language │ ├── First location, address, hours, timezone and manager │ ├── Paste and validate Google Review destination URL │ ├── Configure issue categories, owners and response SLAs │ ├── Configure customer acknowledgement copy │ ├── Invite team members │ ├── Generate and test location feedback link/QR │ └── Activate workspace │ ├── 04. TEAM AND ACCESS │ ├── Owner: billing, security, locations, exports and all data │ ├── Manager: location feedback, assignments, verification and campaigns │ ├── Staff: assigned tasks/checks with minimum customer data │ ├── Auditor: read-only reports without customer contacts │ ├── Invitation: email → signed expiring token → authentication → membership │ ├── Location/category responsibility rules │ └── Offboarding: revoke sessions, reassign work, preserve audit history │ ├── 05. LINKS AND QR SYSTEM │ ├── Stable URL: qualityquote.eu/r/{location_slug} │ ├── Sources: counter, receipt, table, delivery, email and SMS │ ├── In-app QR generator with business logo │ ├── SVG, PNG and print-ready PDF export │ ├── Scan, session and submission analytics by source │ ├── Disable/rotate public token without deleting location │ └── QR contains no personal or admin data │ ├── 06. CUSTOMER RATING JOURNEY │ ├── Scan/open without installing an app │ ├── Confirm business/location and select honest 1–5 rating │ ├── 1–3 stars → private improvement route │ │ ├── Google identity or verified-email fallback │ │ ├── Review text: required │ │ ├── Order/receipt number: required │ │ ├── Verified email: required for recovery communication │ │ ├── Name: optional │ │ ├── Phone: optional; step-up verification only when risk requires it │ │ ├── Case-communication consent: required │ │ ├── Marketing consent: separate and optional │ │ └── Submit → case ID → acknowledgement → customer portal │ └── 4–5 stars → configured Google Review destination │ ├── Clearly identify external destination │ └── Never prefill or require a particular rating/text │ ├── 07. CASE CREATION │ ├── Validate public link, rate limit and verify identity │ ├── Normalise/encrypt contact data │ ├── Hash receipt reference for duplicate detection │ ├── Create immutable case ID and consent record │ ├── Queue AI triage and notification jobs │ ├── Notify responsible manager │ └── Send customer acknowledgement │ ├── 08. AI TRIAGE │ ├── Redact/minimise personal data before model processing │ ├── Structured outputs │ │ ├── Category, tags, sentiment, urgency and safety flag │ │ ├── Problem summary and probable root cause │ │ ├── Recommended corrective action │ │ ├── Suggested owner, deadline and recurring check │ │ └── Confidence and rationale │ ├── Human manager confirms/corrects every assignment and response │ ├── AI cannot punish staff, close cases or issue money/rewards │ └── Prompt/model versions, evaluations and manager-correction dataset │ ├── 09. BUSINESS FEEDBACK INBOX │ ├── Filters: location, rating, category, status, risk and SLA │ ├── Case view: message, verification, AI result, similar cases and timeline │ ├── Field-level permission for phone/email/name │ ├── Acknowledge, clarify, assign, merge duplicate or flag abuse │ └── SLA alerts and manager digest │ ├── 10. TASK WORKFLOW │ ├── Fields: problem, expected result, location, category, priority and SLA │ ├── Assignee, accountable manager, deadline, checklist and evidence │ ├── State machine │ │ └── Draft → Assigned → Accepted → In progress → Submitted │ │ ├── Manager verified → Closed │ │ └── Reopened → In progress │ ├── Staff: accept, complete checklist, add evidence, request help, submit │ ├── Manager: reassign, verify on site, reopen or create preventive check │ └── Every state transition writes an audit event │ ├── 11. RECURRING QUALITY CHECKS │ ├── Manual or suggested from a solved problem │ ├── Time, shift, event or frequency schedule │ ├── Role/person rotation │ ├── Checklist, timestamp, note and photo evidence │ ├── Missed-check escalation and random manager spot-check │ └── Recurrence measurement: did the original problem return? │ ├── 12. POINTS AND TEAM CAMPAIGNS │ ├── Reward verified improvement—not complaint volume │ ├── Points ledger, never an editable balance │ ├── Points for accepted work, valid evidence, verification and prevention │ ├── Reverse points when work is reopened or evidence is rejected │ ├── Campaign builder │ │ ├── Period, locations, eligible roles and target metric │ │ ├── Individual/team mode, reward, budget and approval │ │ └── Monthly/weekly campaigns and privacy-aware leaderboard │ ├── Compare similar responsibilities/shifts for fairness │ ├── Manager cannot approve own reward │ └── Appeals and immutable adjustments │ ├── 13. CUSTOMER RECOVERY │ ├── Manager-approved apology and explanation of what changed │ ├── Customer portal shows case timeline and verified outcome │ ├── Optional goodwill reward │ │ ├── Percentage, fixed amount, free item or no monetary reward │ │ ├── Only after transaction and resolution checks │ │ ├── One-use, non-transferable, expiry and eligible location/items │ │ ├── Linked to customer, case and original receipt │ │ └── Never conditional on a positive/public review │ ├── Atomic QR/code redemption at the business │ └── Follow-up asks for honest new-experience feedback │ └── If customer independently selects 4–5, show Google continuation │ ├── 14. CUSTOMER PORTAL │ ├── Passwordless signed, expiring access │ ├── Case status, business messages and clarification replies │ ├── Customer-safe resolution summary │ ├── Reward availability, terms, expiry and redemption state │ ├── Follow-up experience and previous cases │ └── Communication preferences, data export and deletion request │ ├── 15. EMAIL/NOTIFICATION ENGINE │ ├── Queue, retries, idempotency and provider delivery webhooks │ ├── Customer: verification, accepted, acknowledged, clarification │ ├── Customer: assigned, verified, reward ready/expiring/redeemed, follow-up │ ├── Business: invitation, new case, task assigned/due/overdue │ ├── Business: evidence awaiting verification, reward approval, weekly digest │ ├── Billing: trial ending, payment failed, subscription changed/cancelled │ ├── No sensitive review text in subject; signed portal links; escaped content │ └── Transactional consent separated from marketing consent │ ├── 16. STRIPE BILLING │ ├── Monthly and annual Start, Improve and Scale prices │ ├── Stripe-hosted Checkout; Quality Quote never stores raw card data │ ├── VAT/tax, invoice and billing email │ ├── Stripe customer portal for card, invoice and cancellation management │ ├── Trialing → Active → Past due → Restricted → Cancelled │ ├── Verify webhook signature from raw request body │ ├── Idempotently process checkout, subscription and invoice events │ ├── Daily reconciliation job │ └── Enforce entitlements on backend—not only by hiding frontend buttons │ ├── 17. RECOMMENDED PLANS │ ├── START · €12/month or €120/year │ │ ├── 1 location · 3 users total (owner/manager + 2 staff) │ │ ├── 100 private cases/month · manual tasks · standard emails │ │ ├── 1 active QR campaign · unlimited QR file downloads │ │ ├── 3 recurring checks · 90-day analytics │ │ └── No AI automation, campaigns or rewards │ ├── IMPROVE · €29/month or €290/year │ │ ├── 1 location · 10 users total · unlimited cases under fair use │ │ ├── AI triage · unlimited tasks · 25 recurring checks │ │ ├── Evidence, verification, points and campaigns │ │ ├── Customer recovery rewards · 24-month analytics │ │ └── Best default plan for an active single-location operator │ └── SCALE · €59/month or €590/year │ ├── 3 locations · 30 users total │ ├── Location managers and combined comparisons │ ├── Unlimited checks · advanced campaigns and controls │ ├── API, webhooks, exports and priority support │ └── Unlimited analytics; paid extra location/user packs │ ├── 18. FRONTEND ROUTE MAP │ ├── Public: /, /product, /pricing, /security, /help, /legal/* │ ├── Auth: /signup, /login, /verify, /invite/{token} │ ├── Business setup: /onboarding/{step} │ ├── Customer: /r/{slug}, /case/{magic_token}, /redeem/{token} │ └── Workspace │ ├── /app/overview, /feedback, /feedback/{id} │ ├── /tasks, /tasks/{id}, /checks │ ├── /team, /campaigns, /rewards, /analytics │ └── /qr, /locations, /billing, /settings/security │ ├── 19. BACKEND SERVICE MAP │ ├── API gateway: TLS, WAF, validation, rate limits and request IDs │ ├── Auth, organisation, membership/invitation and entitlement services │ ├── Link/QR, feedback/customer-portal and AI-triage services │ ├── Task, check, campaign/points and reward/redemption services │ ├── Notification, billing, analytics and audit services │ └── Queue/scheduler for AI, email, reminders, digests and reconciliation │ ├── 20. DATABASE/STORAGE MAP │ ├── users, identities, sessions, email_verifications │ ├── organisations, businesses, locations, memberships, invitations │ ├── categories, responsibility_rules, slas, brand_settings │ ├── feedback_links, qr_assets, link_events │ ├── customer_profiles, customer_identities, consents │ ├── feedback_cases, feedback_messages, receipt_verifications │ ├── ai_runs, ai_suggestions, ai_feedback, prompt_versions │ ├── tasks, assignments, checklist_items, evidence, manager_decisions │ ├── recurring_checks, check_runs │ ├── point_ledger, campaigns, participants, reward_grants, redemptions │ ├── notification_jobs, deliveries, templates, preferences │ ├── subscriptions, entitlements, usage_ledger, stripe_events │ ├── audit_events, security_events, export_jobs, deletion_jobs │ └── Private object storage for evidence; public storage for safe QR assets │ ├── 21. SECURITY AND GDPR │ ├── Tenant isolation │ │ ├── organisation_id on every tenant-owned record │ │ ├── Server derives tenant from authenticated membership │ │ ├── Row-level/authorisation policy on every query │ │ └── Automated cross-tenant access tests │ ├── Authentication: OAuth state/PKCE, exact redirects, MFA, rotation/revocation │ ├── Secure HttpOnly SameSite cookies and CSRF protection │ ├── Deny-by-default RBAC plus field control for customer contact data │ ├── TLS, managed encryption at rest, secret manager and key rotation │ ├── Signed uploads, file validation, malware scanning and private evidence │ ├── Parameterised queries, output escaping, CSP and narrow CORS │ ├── Per-IP, account, location and tenant rate limits plus bot/risk challenge │ ├── Logs never include tokens, full contacts, receipt images or secrets │ ├── GDPR data inventory, purpose/lawful basis, retention, export and deletion │ ├── Subprocessor/DPA management and EU transfer controls │ ├── Encrypted backups, tested restore, monitoring and incident response │ └── Append-only audit of contacts, exports, roles, billing, rewards and decisions │ ├── 22. ABUSE PREVENTION │ ├── Identity, receipt, device, network, customer and merchant risk signals │ ├── Duplicate receipt hash and repeated/coordinated text detection │ ├── Velocity limits per customer, device, location and campaign │ ├── One eligible reward per transaction/case │ ├── No automatic reward for submitting feedback │ ├── Value thresholds, manager approval and budget caps │ ├── Atomic redemption preventing double use │ ├── Staff/customer collusion signals │ └── Risk hold, manual review, appeal and false-positive monitoring │ ├── 23. OBSERVABILITY AND OPERATIONS │ ├── Structured logs, request/case IDs, error monitoring and traces │ ├── Queue delay/failure, email delivery and Stripe webhook dashboards │ ├── AI cost, latency, confidence and manager-correction metrics │ ├── Security anomaly and audit dashboards │ ├── Health checks, alerts, status page and incident postmortems │ └── Support console with strict permissions and full auditing │ └── 24. EXECUTION ROADMAP ├── P0 · Product/legal rules, data map and threat model ├── P1 · Auth, tenant isolation, organisation, location and team invites ├── P2 · Links, QR generator and customer rating journey ├── P3 · Inbox, acknowledgement emails and customer portal ├── P4 · Tasks, evidence, manager verification and recurring checks ├── P5 · Stripe subscriptions, entitlements and plan limits ├── P6 · AI triage with human approval and evaluation framework ├── P7 · Points, campaigns, controlled rewards and redemption ├── P8 · Follow-up experience and recovery analytics ├── P9 · Multi-location, API, exports and advanced reporting └── P10 · Security hardening, penetration test and production launch ``` ## Canonical state machines ```text CASE Submitted → Identity verified → Purchase verified → Triaged → Acknowledged → Task assigned → In progress → Submitted → Verified/Reopened → Customer notified → Reward offered/redeemed/expired → Follow-up → Closed TASK Draft → Assigned → Accepted → In progress → Submitted ├── Verified → Closed └── Reopened → In progress SUBSCRIPTION Incomplete → Trialing → Active → Past due → Restricted → Cancelled ``` ## Email event matrix | Event | Recipient | Message | Control | |---|---|---|---| | Email verification | Customer/user | Single-use access link | 15-minute expiry | | Feedback accepted | Customer | Case ID and acknowledgement | No reward promise | | New critical feedback | Manager/owner | Immediate alert | No sensitive subject text | | Task assigned | Staff | Task and due date | Minimum customer context | | Task overdue | Staff + manager | Reminder/escalation | Deduplicated scheduler | | Evidence submitted | Manager | Verification request | Authenticated deep link | | Resolution verified | Customer | What the business changed | Customer-safe details only | | Reward available | Customer | Value, terms and expiry | Explicitly no review obligation | | Reward redeemed | Customer + business | Redemption confirmation | Atomic event | | New experience follow-up | Customer | Honest 1–5 experience request | Not a five-star request | | Team invitation | User | Role/location invite | Signed, expiring, revocable | | Payment failed | Owner/billing email | Billing action | Stripe portal link | | Weekly digest | Manager/owner | Quality and SLA summary | Authorised locations only | ## Personal-data decision - Review text and receipt/order number: required for 1–3 stars. - Verified email: required through Google OAuth or email OTP because the recovery loop needs a reliable channel. - Name: optional. - Phone: optional by default; request/verify it only for SMS, high-value rewards or elevated fraud risk. - Case communication consent: required. Marketing consent: separate and optional. This is the best MVP balance between completion rate, recovery communication, fraud resistance and data minimisation. ## First real MVP acceptance criteria 1. Business registration, organisation/location creation, Stripe subscription and staff invitation work end to end. 2. Business can validate its Google destination and generate/download a location QR code. 3. Customer can submit 1–3 star private feedback with verified identity and required receipt/order number. 4. Customer gets acknowledgement and a secure case portal. 5. Manager sees AI suggestions and confirms the responsible staff member. 6. Staff completes a checklist and submits evidence. 7. Manager verifies or reopens the work; customer receives the outcome. 8. Optional reward is controlled, one-use and never conditional on a positive review. 9. Follow-up asks for an honest new experience; 4–5 can continue to Google. 10. Tenant boundaries, permissions, sensitive-data access, billing webhooks and reward changes are server-authorised and audited. 11. Backups/restores, monitoring, rate limits, privacy export/deletion and incident procedures are tested. ## Recommended execution order ```text Tenant isolation + permissions + audit → registration + team + location → QR + customer submission → inbox + emails + portal → task + verification + recurring checks → Stripe + plan limits → AI recommendations → points + campaigns → rewards + redemption → recovery follow-up + analytics → multi-location scale + production hardening ```