Privacy Policy

Last updated: 13 November 2026

This policy explains what personal data QuoteSpanner collects, why, and what your rights are. QuoteSpanner is run by QuoteSpanner ("we", "us").

1. Two kinds of data

  • Your account data: details about you and your business. We decide how this is used, so we are the "controller".
  • Your customers' data: the names, contact details, quotes and invoices you store about your own customers. You decide what to store and why, so you are the controller and we are your "processor". If you are a customer of a business that uses QuoteSpanner, please contact that business first about your data.

2. What we collect

  • Account: your email address, a scrambled (hashed) copy of your password, and two-step login settings if you turn them on.
  • Business details: your name, business name, address, phone, email, VAT and company numbers, logo and payment details you choose to print on invoices.
  • What you create: customers, quotes, variations, invoices, credit notes, price lists, templates and notes.
  • Subscription: whether you are subscribed and your Stripe customer reference. Card details go straight to Stripe; we never see or store your card number.
  • Records of use: a history of changes to quotes and invoices (who did what, and when), and technical logs such as error reports and the internet (IP) address of requests.
  • When a customer accepts online: the name they type, the date and time, their IP address, and a copy of the quote or change exactly as accepted.

We do not collect special category data and ask you not to store any in the service.

3. Why we use it, and our legal bases

  • To provide the service to you (performing our contract with you): running your account, storing your records, producing documents, sending the emails you ask us to send.
  • To take payment (contract): managing your subscription through Stripe.
  • To keep the service secure and working (our legitimate interests): error monitoring, preventing misuse, backups.
  • To keep trustworthy records (legitimate interests, and your own legal obligations): the change history and the stored copies of accepted quotes and issued invoices.
  • To meet legal obligations: for example keeping our own accounting records.

We never sell personal data, and we do not use it for advertising.

4. Evidence of acceptance

When a customer accepts a quote or a change through their private link, the details listed above are kept as evidence of what was agreed, for the benefit of both the business and the customer. The private link is long and random, is not listed anywhere, and search engines are asked not to index it.

5. Who we share it with

Only the organisations that help us run the service, under contracts that protect the data:

  • Microsoft Azure: hosting, database, backups and error monitoring, in UK data centres.
  • Stripe: subscription payments.
  • Our email delivery provider: sending emails such as password resets and the quotes and invoices you choose to email.
  • A postcode lookup service: when you search for an address, only the postcode you typed is sent, not who you are.

We may also disclose data if the law requires it. If the service is ever sold, your data would pass to the new owner under this policy, and we would tell you beforehand.

6. Where it is stored

Your data is stored in the United Kingdom. Some of our providers may process limited data outside the UK (for example Stripe when handling payments); where they do, it is protected by safeguards recognised under UK law, such as adequacy regulations or the UK's international data transfer agreements.

7. How long we keep it

  • While your account is open: we keep your data so the service works. You can edit or delete customers and quotes that have not been invoiced.
  • Invoices and the records behind them: cannot be deleted from within the app, because UK tax law requires businesses to keep them, normally for at least six years.
  • After you cancel: your account and data are kept so you can come back, until you ask us to close the account.
  • When you ask us to close your account: we delete your data from the live service within 30 days. Download any records you need first.
  • Backups: encrypted backups are kept for up to seven years for disaster recovery. Deleted data may remain in them until they expire; it is not used for anything else.
  • Technical logs: kept for up to 90 days.

8. Keeping it safe

  • All connections are encrypted (HTTPS), and data is encrypted where it is stored.
  • Each business's data is kept separate, so one business can never see another's.
  • Passwords are stored only in hashed form, and two-step login is available.
  • Issued invoices and accepted quotes are stored with a digital fingerprint so that any change would be detectable.

9. Cookies

We use only the cookies needed for the service to work: one that keeps you logged in, one that protects forms against forgery, and one that remembers a trusted device for two-step login if you choose that. A display preference (such as your calendar filters) may be saved in your browser. We use no advertising or tracking cookies, so there is no cookie banner.

10. Your rights

Under UK data protection law you have the right to:

  • see a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted, where we have no legal reason to keep it;
  • object to, or ask us to restrict, how we use it;
  • receive your data in a portable format.

Much of this you can do yourself in the app (Account → Your data, and the invoice export). For anything else, contact us and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

11. Changes to this policy

If we change this policy we will update the date at the top and, for significant changes, tell you by email or in the app.

12. Contact