Privacy.

Tony Fisher, trading as QuoteCo, is the data controller for personal data processed through QuoteCo. QuoteCo is built so a sole trader can work without handing over any data: on the Free plan every estimate, invoice and business default is held in your browser on this device. Nothing is uploaded, and clearing your browser data removes it.

What we collect and why

If you sign in we process your email address and account identifiers to create and secure your account (performance of our contract with you). On Platinum we also store a copy of your business defaults, clients and documents so they follow you between devices (contract). We process limited technical data — IP address, device and browser information, error and usage logs — to keep the service secure, prevent fraud and fix faults (legitimate interests). Support messages you send are used to answer you (legitimate interests). We only send marketing email if you ask for it (consent, withdrawable at any time).

Who we share it with

Service providers acting on our instructions (hosting, database, error monitoring); Paddle.com, our Merchant of Record, for the sale of Platinum, subscription management, payments, tax compliance and invoicing; professional advisers such as accountants and lawyers where needed; and authorities where the law requires it. Card details never reach QuoteCo — we keep only the subscription status needed to unlock your plan.

Retention

Account and document data is kept while your account is open and for up to 90 days after you close it, then deleted or anonymised. Billing records are kept for as long as tax law requires. Technical logs are kept for up to 12 months.

International transfers

Some of our providers process data outside the UK and EEA. Where they do, transfers rely on UK/EU adequacy decisions or standard contractual clauses with additional safeguards.

Your rights

Under UK and EU data protection law you may request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent. We answer within one month. You can also complain to the Information Commissioner's Office. Settings has Export my data (JSON and CSV) and a typed confirmation to delete everything on this device; to close a synced account, cancel Platinum in Settings and reply to your Paddle receipt to have the stored copy removed.

Security

Data is encrypted in transit and at rest, access is restricted per account and enforced on the server rather than in the browser, and administrative access is limited to those who need it.

Cookies

Essential cookies and local storage only: signing in sets a session cookie so you stay signed in, and your documents and settings are stored locally on your device. No advertising or tracking cookies, so there is nothing to opt out of — clearing your browser data removes what is stored.