Privacy Policy

1. Introduction

QuoTrak ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have in relation to your data when you use QuoTrak (the "Service").

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. Data We Collect

We collect the following categories of personal data:

• Account information: name, email address, and password (stored as a secure hash) when you register.
• Business data: customer names and contact details, quotes, invoices, line items, products, and other content you create within the Service.
• Billing information: subscription plan, billing interval, and payment status. Full card details are handled by Stripe and are never stored on our servers.
• Usage data: pages visited, features used, and actions taken within the Service, collected to improve performance and usability.
• Log data: IP address, browser type, operating system, referring URLs, and timestamps, collected automatically by our servers.
• Cookies: see the Cookies section below for details.

3. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the Service.
• Process transactions and send you billing-related communications.
• Send transactional emails such as email verification and password reset links.
• Respond to support requests and troubleshoot issues.
• Analyse usage patterns and improve the Service.
• Detect and prevent fraud, abuse, or security incidents.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data to train machine learning models. With your explicit consent, we may use limited tracking data (via tag management and advertising pixels) for advertising and retargeting purposes — see the Cookies section below for details.

4. Legal Basis for Processing

Where applicable law requires a legal basis for processing personal data, we rely on the following:

• Contract: processing is necessary to provide the Service you have signed up for, including account management, billing, and delivering features you use.
• Legitimate interests: processing is necessary for our legitimate interests in improving and securing the Service, such as analysing usage patterns, preventing abuse, and maintaining system reliability, provided those interests are not overridden by your rights.
• Legal obligations: processing is necessary to comply with applicable laws, such as retaining billing records for tax and accounting purposes.
• Consent: for certain activities — such as loading advertising and retargeting technologies — we rely on your freely given, specific, and informed consent, which you may withdraw at any time.

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate the Service, understand how it is used, and — only with your prior consent — to serve relevant advertising. This includes:

• Essential / session cookies: required to keep you logged in and to maintain your preferences across page loads. These are always active.
• Analytics cookies: we use a privacy-friendly analytics tool to measure aggregate traffic patterns and feature adoption. This tool does not use cookies and does not identify you personally.
• Advertising / retargeting cookies (consent required): with your explicit consent, we load tag management and advertising pixel technologies that place cookies on your device to enable cross-site retargeting and conversion measurement. These scripts are only loaded after you click "Accept" in our cookie consent banner. If you click "Decline" or have not yet made a choice, these scripts are not loaded. For a current list of active advertising and tag management providers, please contact us at support@quotrak.com.

The legal basis for loading advertising cookies is your consent (GDPR Art. 6(1)(a)). You may withdraw or change your consent at any time using the Cookie Preferences link in our footer or by clearing your browser's local storage for this site.

You can also control cookies through your browser settings. Disabling session cookies will prevent you from logging in to the Service.

6. Third-Party Services

Each third-party service provider listed below processes your data only to the extent necessary to provide their respective service to QuoTrak. We work with the following providers:

• Stripe — payment processing. When you subscribe to a paid plan or accept a Stripe payment link, Stripe collects and processes your payment card information. QuoTrak does not store full card numbers. Stripe's privacy policy is available at stripe.com/privacy.
• Resend — transactional email delivery. Resend processes email addresses and message content solely for the purpose of delivering emails you initiate (such as sending a quote or invoice to a customer). Resend's privacy policy is available at resend.com/legal/privacy-policy.
• Google OAuth — if you choose to sign in with Google, Google authenticates your identity. We receive only your name and email address from Google. Google's privacy policy is available at policies.google.com/privacy.
• Advertising & tag management providers — with your consent, we use tag management and advertising pixel technologies for advertising and conversion-measurement purposes. These providers are only activated after you accept cookies. For a current list of active providers, please contact us at support@quotrak.com.

7. User Responsibility for Data

When you use the Service to store, process, or share personal data belonging to your customers or other third parties, you are responsible for ensuring that you have the right to upload and process that data. This includes obtaining any necessary consent or authority from those individuals under applicable privacy laws.

QuoTrak is not responsible for how you collect, use, or manage your customers' personal data. You agree to handle such data in compliance with all applicable laws and regulations.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law (for example, billing records for tax purposes, which we retain for up to 7 years).

You can request account deletion by contacting us at support@quotrak.com or through account settings if that option is available. Personal data will be deleted within 30 days of that request, subject to any legal retention requirements.

Anonymised aggregate data (such as aggregate usage statistics) may be retained indefinitely.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data (subject to legal retention requirements).
• Portability: request that we provide your data in a portable, machine-readable format.
• Objection: object to certain processing activities. Where we rely on consent as the legal basis for processing (such as advertising cookies), you may withdraw that consent at any time — withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at support@quotrak.com. We will respond within 30 days.

10. Data Security

We implement industry-standard security measures to protect your data, including HTTPS encryption for data in transit, hashed password storage, and access controls limiting who within our team can access personal data.

Your data may be stored and processed in Canada, the United States, or other jurisdictions where our service providers operate. When personal information is transferred outside Canada, it may be subject to the laws of those jurisdictions, including lawful access by foreign governments. We take steps to ensure our service providers protect your information in a manner consistent with this policy and applicable Canadian privacy law.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

In the event of a breach of security safeguards involving your personal data that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) as required under the Personal Information Protection and Electronic Documents Act (PIPEDA). Notification will be provided as soon as feasible and will include a description of the breach, the type of information involved, and the steps we are taking to address it.

11. Children's Privacy

The Service is not directed at children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal data from children under 13 (or the applicable age in your jurisdiction). If we become aware that we have inadvertently collected such data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page and, where the changes are material, notify you by email. We encourage you to review this policy periodically.

13. Contact & Privacy Officer

QuoTrak has designated a Privacy Officer who is accountable for our compliance with PIPEDA and this Privacy Policy. If you have any questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Officer:

Privacy Officer, QuoTrak
support@quotrak.com

We will acknowledge your inquiry within 10 business days and respond fully within 30 days, or notify you if additional time is required.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.