Privacy notice
Version: privacy-notice-2026-10-04-draft-2
Effective date: 4 October 2026
Quality Quote processes account, business, feedback and case-communication data to operate the service, protect it from abuse and help businesses resolve customer issues.
Who controls the data
The Quality Quote service operator is the controller for account, platform-security and product-operation records. Each subscribing business controls the customer feedback it collects through its workspace. Privacy requests can be submitted from the authenticated customer or workspace privacy centre.
Data and purposes
We process identity and login records, workspace membership, locations, customer feedback, messages, operational tasks, evidence, notification history, billing state and limited acquisition analytics. We use them to provide the contracted service, secure access, prevent abuse, communicate about cases, measure service reliability and meet legal obligations.
Data minimisation
Private feedback requires a verified email and purchase reference. A name and telephone number remain optional unless an elevated-risk action requires additional verification.
Control
Authenticated customers and workspace users can download a machine-readable export and submit tracked access, correction, restriction or erasure requests. Requests are reviewed without undue delay; the product records a one-month response target and supports identity verification where needed.
Retention
Personal data is retained only for documented service, security and legal purposes. Authentication sessions and verification artefacts expire automatically; acquisition records are anonymised after the configured period. Case, task, audit and billing evidence has separate documented schedules. Erasure is not absolute where law, fraud prevention or legal claims require restriction instead.
Processors and transfers
The application is designed for Cloudflare Workers, D1 and R2 hosting. That technical configuration does not itself prove a production deployment or an approved processing agreement. Transactional email delivery, Stripe billing, external malware scanning, privileged Cloudflare Access MFA and optional external AI remain inactive until the operator completes the separately recorded provider, transfer, retention and deletion review. A provider is described as active only after observed runtime evidence confirms it.
Queued email means that Quality Quote preserved a message for delivery; it does not mean that a provider accepted or delivered it. Payment access is based on authenticated Stripe webhook state only after billing is activated. Evidence remains quarantined when no approved production scanner is available. External erasure work remains pending until the processor confirms completion.
Security and contact
Quality Quote uses tenant isolation, role-based access, encrypted transport, restricted evidence storage, rate limits, audit trails and incident procedures. No internet service can promise absolute security. Use the authenticated privacy centre for rights requests and the published support channel for other privacy questions.
This draft is an operational description, not legal advice. Counsel approval, controller/processor identity, contact details, transfer mechanism and jurisdiction-specific disclosures remain required before accepting production users.