Privacy Policy

1. Who we are

This Privacy Policy is issued by QuoteAI (referred to as "the Company", "we", or "us"), a business operating from Ontario, Canada, reachable at privacy@quoteai.ca. We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information we collect

We collect the following categories of personal information:

• Account information: first name, last name, and email address, provided when you create an account.
• Business profile information: company name, Business Number / GST-HST number, address, phone number, business email, and company logo.
• Quote data: job descriptions, client (customer) information, amounts, and line items on quotes you generate.
• Payment information: handled directly by Stripe Inc. — we never access your full credit card details.
• Authentication credentials: your password is stored as a salted hash on our own servers; we do not send it to any third-party identity provider.
• Technical information: IP address, browser type, pages visited, and session duration (via system logs).

3. Purposes and grounds for collection

4. Data retention

We retain personal information only for as long as necessary for the purposes described above:

• Account data: until account deletion, then 30 additional days for security purposes.
• Quote data: 7 years from issuance, in line with Canada Revenue Agency (CRA) record-keeping requirements.
• Billing records: 7 years, per CRA requirements for GST/HST and income tax records.
• Technical logs: 90 days.

5. Who we share information with

Personal information may be shared with the following categories of recipients:

• Stripe Inc. — payment processing.
• OpenAI, LLC — AI-generated quotes. Only the job description text is sent.
• Cloud hosting providers — infrastructure and hosting.
• Resend Inc. — transactional email delivery.

We do not sell personal information to third parties. Where information is processed or stored outside Canada (including in the United States), we take reasonable steps to ensure a comparable level of protection through contractual safeguards, consistent with PIPEDA principle 4.1.3 (accountability for information transferred to third parties).

6. Your rights

Under PIPEDA and applicable provincial privacy laws, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete information.
• Withdrawal of consent — withdraw consent at any time, subject to legal or contractual restrictions.
• Deletion — request deletion of your information, subject to legal retention obligations.
• Complaint — file a complaint about how we handle your information.

To exercise these rights, contact us at privacy@quoteai.ca. We will respond within 30 days. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada, or with your provincial privacy regulator where applicable.

7. Cookies and tracking technologies

We use only strictly necessary cookies required for the service to function (authentication, session management). We do not use profiling or third-party advertising cookies.

8. Security

We use appropriate technical and organizational safeguards to protect personal information against unauthorized access, loss, or alteration: encrypted connections (TLS/HTTPS), access controls, and hashed credential storage on our own infrastructure.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via an in-platform notice at least 14 days in advance.

10. Contact us

For any questions about this Privacy Policy: privacy@quoteai.ca