1. Who we are
Quote Gaffer Ltd provides software that helps tradespeople and other businesses create, send and manage quotes and invoices, maintain a reusable customer directory, and use connected services such as accounting and payment providers. For the purposes of UK data protection law, Quote Gaffer Ltd may act as a controller for information about its own users, website visitors and business contacts. Where a Quote Gaffer user enters or uploads information about their own customers so that Quote Gaffer can provide the service on that user's behalf, Quote Gaffer will generally act as a processor for that customer information and the user will generally act as controller.
We need your email address to create your account and send sign-in codes. If you do not provide the information needed for a feature, we may be unable to provide that feature. Optional marketing consent is not required to use Quote Gaffer.
2. Information we collect
Depending on how the service is used, we may process:
- voice recordings, transcripts, job descriptions and instructions submitted when you use voice or AI-assisted quoting;
- account and profile information, such as name, email address, business details and authentication identifiers;
- billing and subscription information, including plan, payment status and transaction references;
- reusable customer-directory information entered by a user, currently including customer name, email address, phone number and service or billing address;
- quote and invoice information, including historical customer details recorded on the relevant document, line items, pricing, status and document history;
- customer responses to quotes, including acceptance, rejection, optional rejection reason, date and time of response, and relevant audit information;
- connected-account information where a user chooses to connect an accounting or other integration;
- transactional email information needed to send quotes, invoices and service messages;
- support, security, diagnostic and audit information, including records needed to investigate errors, abuse or suspected security incidents; and
- any other information a user chooses to provide through the service or to our support team.
We do not intend Quote Gaffer to be used to store special-category personal data unless this is genuinely necessary for a user's lawful business purpose. Users should avoid entering unnecessary sensitive information into free-text fields.
3. Where information comes from
We may receive personal information:
- directly from a Quote Gaffer user when they create an account, enter customer details, create documents or contact us;
- from the user's customer when they respond to a secure quote link;
- from connected services that the user has chosen to authorise;
- automatically from the operation and security of the service, for example technical logs and error events; or
- from another lawful source where this is necessary to provide the service.
Where a user provides information about their own customer, that user is responsible for ensuring they have an appropriate lawful basis for collecting and using that information and for providing any privacy information required by law.
4. How and why we use information
We use personal information only where we have a lawful basis. Depending on the processing, this may include:
- Contract — to create and administer a Quote Gaffer account, provide subscribed features, deliver quotes and invoices, and support a user's requested integrations;
- Legitimate interests — to operate, secure and improve the service, prevent misuse, maintain audit records, provide customer support and understand service performance where those interests are not overridden by individual rights and interests;
- Legal obligation — where we must retain or disclose information to comply with tax, accounting, corporate, regulatory or other legal requirements;
- Consent — where consent is specifically required, for example for optional marketing or another optional use for which consent is the appropriate basis.
Marketing is treated separately from core service communications. Quote, invoice, security, billing and account messages are transactional messages needed to operate the service and are not treated as marketing merely because they are sent by email.
5. Customer records and documents
Quote Gaffer separates a reusable customer record from the historical customer details stored on an individual quote or invoice. Updating a reusable customer record does not automatically rewrite a previously issued quote or invoice. This preserves the historical record of what was sent at the time.
Archiving a reusable customer record removes it from normal active customer selection but does not automatically delete historical documents where those documents need to be retained for contractual, accounting, evidential or legal reasons. Archived reusable customer records can be restored. Where erasure of the reusable customer record is appropriate, Quote Gaffer can anonymise that reusable record so the current directory identifiers are removed and the record is no longer available for normal customer reuse.
A minimal non-identifying record may be retained where needed to preserve lawful record relationships and accountability. Quote Gaffer also provides a customer-history view that links a reusable customer record to the quotes and invoices associated with that customer. This view is intended to help the Quote Gaffer user navigate their own records.
It uses the link between a customer and their documents to show that history. It does not rewrite the customer details recorded on earlier quotes or invoices. The customer-history view may show document references, job descriptions, document type, status, version and relevant dates, and may allow the user to filter or search that history.
These controls change what is displayed to the authorised Quote Gaffer user; they do not alter the underlying historical records. When reusable customer data is anonymised through the controlled erasure flow, historical quote and invoice snapshots are not automatically rewritten where a separate lawful retention purpose remains. Linked secure quote access tokens are revoked as part of that customer-directory erasure action, and the privacy action is recorded for accountability.
6. Who we share information with
We use third-party service providers to operate Quote Gaffer. Depending on the feature used, these may include providers of:
- database hosting and authentication;
- web hosting and deployment;
- transactional email delivery;
- payment processing and subscription billing;
- error monitoring and security tooling;
- postcode and address lookup;
- accounting integrations selected by the user; and
- AI-assisted functionality where the user chooses to use a feature that depends on it.
We use providers Supabase (database and login), Netlify (hosting), Postmark (email), Stripe (payments), Sentry (error monitoring), Ideal Postcodes (address lookup), OpenAI (voice and AI-assisted quoting) and Xero where you connect your accounting account. We only share information that is reasonably necessary for the relevant service. We may also disclose information where required by law, to protect legal rights, to investigate fraud or security incidents, or in connection with a corporate transaction subject to appropriate safeguards.
7. International transfers
Some suppliers may process personal information outside the United Kingdom. Where UK data protection law requires transfer safeguards, we will use an appropriate mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another legally permitted safeguard. The exact transfer position depends on the supplier, service configuration and processing location and is tracked in our Subprocessor & International Transfer Register.
Our primary application database is hosted in London. Some suppliers, including our email, payment, AI and accounting providers, process information in the United States and other countries. This does not mean all processing stays in the UK.
You can request more information, including a copy of applicable transfer safeguards, by emailing contact@quotegaffer.com.
8. How long we keep information
We keep personal information only for as long as needed. Our retention policy sets different periods for different types of record, shown below.
A review date does not mean automatic deletion. We may need to keep information longer for legal, tax, regulatory, dispute, complaint, fraud, security or investigation reasons.
- Account and profile data
- while the account is active and for 12 months after closure, after which normal operational profile data is deleted or anonymised unless another lawful purpose applies.
- Reusable customer-directory data
- active records are kept while genuinely needed; archived reusable customer records are reviewed after 24 months of inactivity and anonymised where there is no continuing lawful or business reason to retain them.
- Quotes
- draft quotes never sent are reviewed after 12 months from last update; rejected quotes are retained for 2 years after rejection; expired or no-response quotes are retained for 2 years after expiry or last material activity; accepted quotes are retained for 6 years after final material activity.
- Invoices and accounting/tax records
- 6 years from the end of the relevant financial year, unless a longer period is required by law, an enquiry, dispute or other valid hold.
- Transactional email
- email content and attachments processed by our current transactional email provider are retained in line with the supplier setting, 45 days by default; suppression records used to prevent blocked or unwanted email may be kept longer. Our policy sets a 12-month period for Quote Gaffer delivery metadata used for troubleshooting and evidence unless it forms part of a longer-lived record.
- Privacy requests and complaints
- 3 years after the request or complaint is formally closed, with supporting personal data minimised where it is no longer needed.
- Security and audit records
- normal security/audit logs are retained for 24 months; records of confirmed security incidents are retained for 6 years after formal closure.
- Support history
- routine support tickets are retained for 3 years after formal closure, unless they become part of a complaint, dispute, security incident, fraud investigation, legal claim or regulatory matter.
- Marketing records
- consent evidence is retained for 3 years after consent is withdrawn or the marketing relationship ends; a minimal suppression/opt-out identifier is retained for as long as needed to prevent accidental re-marketing.
- Backups
- our retention policy sets a rolling limit of 90 days for production backups that we control. Restore procedures are designed to re-apply erasure/deletion controls so erased reusable personal data is not silently reintroduced.
9. Keeping information secure
We use technical and organisational measures designed to protect personal information, including authenticated access, controls that separate each business's data and limit access to authorised people, encryption provided by our infrastructure suppliers, secure development practices, and audit or diagnostic logging where appropriate. No online service can guarantee absolute security. Users are responsible for protecting their own login credentials, devices and authorised integrations.
Where reusable customer data has been erased, Quote Gaffer's recovery procedures are designed to prevent a database restore from silently reintroducing that reusable personal data. Recovery procedures require erased-customer records to be reconciled and re-anonymised before restored service is treated as complete. We use browser storage for sign-in and service preferences.
If you choose to stay signed in, your login can be remembered on that browser for up to 30 days. You can sign out or clear your browser's stored data to remove that remembered login. Without that option, the login is stored for the browser session.
10. Your privacy rights
Depending on the circumstances and the lawful basis used, individuals may have rights including:
- to be informed about how their information is used;
- to access their personal information;
- to have inaccurate information corrected;
- to request erasure where the law allows;
- to request restriction of processing;
- to object to certain processing;
- to receive certain information in a portable format; and
- to withdraw consent where processing is based on consent.
These rights are not absolute and may be limited where we or the relevant Quote Gaffer user must keep information for legal, contractual, accounting, evidential or security reasons. Where erasure applies only to reusable customer-directory data, Quote Gaffer may anonymise that reusable record while preserving separately retained historical documents where a valid retention purpose remains. If the request concerns information that a tradesperson or other Quote Gaffer user controls about their own customer, we may need to refer the request to that user or assist them in responding.
Where appropriate, Quote Gaffer can provide customer-related information in a structured machine-readable export. The standard customer export may include the current reusable customer record, linked historical quote/invoice snapshots, line items and customer response history. It is designed not to expose secure access tokens or unrelated security credentials, and standard portability exports exclude network/security metadata such as IP address and user agent unless disclosure is specifically required for the applicable request.
Requests can be sent to contact@quotegaffer.com. To exercise these rights or withdraw consent, email contact@quotegaffer.com. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
11. Making a complaint
If you have a concern, contact us at contact@quotegaffer.com so we can investigate. Individuals also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Current ICO contact details are available on the ICO website.
You can also complain directly to the ICO without contacting us first: Make a complaint to the ICO.
12. Voice and AI features
When you use voice quoting, your recording is sent to OpenAI to turn your speech into text. When you ask us to generate or edit a quote, the relevant job description, quote details and your instructions are sent to OpenAI. These may include personal information you put into the recording or quote.
Avoid including unnecessary sensitive information. Review the resulting quote before sending it. Where Quote Gaffer offers an AI-assisted feature, personal information may be processed by the relevant AI service provider only to the extent needed to provide that feature.
Our current OpenAI API organisation is configured with model-feedback sharing, evaluation/fine-tuning data sharing, and API input/output sharing disabled. Supplier retention and international-transfer safeguards are documented in our internal supplier register and reviewed before production use. We do not intend to make solely automated decisions about individuals that produce legal or similarly significant effects without first carrying out the required assessment and providing any legally required safeguards.
13. Marketing choices
We will not treat a customer's presence in a Quote Gaffer user's customer directory as consent to receive marketing. Marketing preferences and core transactional communications must remain separate. Optional marketing is separate from your account.
You can withdraw your marketing consent using an unsubscribe option in a marketing email or by emailing contact@quotegaffer.com.
14. Changes to this notice
We will review this notice as the product and law change. If we materially change how personal information is used, we will update this notice and, where required, bring the change to affected individuals' attention before the new processing begins.