QuotebirdPrivacy Policy
Last updated 9 November 2026
This policy explains what personal information Quotebird collects, why, who we share it with and the choices you have. Quotebird is a trading name of KARAY DIGITAL LTD, a company registered in England and Wales, company number 16931082, registered office Suite 10330, 5 Brayford Square, London E1 0SG, United Kingdom (“Quotebird”, “we”, “us”). You can reach us at [email protected].
If you received a quote or an invoice through Quotebird, the part for you is Customers of businesses that use Quotebird.
The short version
- We don’t sell personal information, show ads or share it for advertising.
- The information you keep about your customers is yours. We hold it for you and use it only to run Quotebird for you.
- When you use AI drafting, the photos and notes for that quote go to our AI provider. It doesn’t use them to train its models.
- You can export everything and delete your account from the app.
Who is responsible for what
- Your account and business. We decide how this information is used, so we are its controller.
- Your customers’ information. The customers, jobs, photos, quotes, invoices, signatures and payments you keep in Quotebird are your records. You decide what to collect and why, so you are their controller and we are your processor: we handle them only on your instructions, under the Data Processing Addendum in our Terms. A few narrow uses are our own, and we list them below.
What we collect about you
| What | Examples | Where it comes from |
|---|---|---|
| Account | Email address, name, your Apple or Google account ID, sign-in sessions (IP address and device) | You, Apple or Google when you sign in |
| Business profile | Business name, address, phone, email, tax and licence numbers, logo, tax and payment settings, payment instructions for your customers | You |
| Onboarding answers | Your trade, how many people work with you, how you heard about us | You |
| Subscription | Plan, store, trial and renewal dates, whether it is active. We never see your card details. | Apple or Google, through RevenueCat |
| Card payments | If you connect Stripe: your Stripe account ID and status, and the amount, fee and refunds of each payment. Stripe checks your identity itself, under its own terms. | Stripe |
| App usage | Named steps such as “finished setup”, “opened plans” or “sent a quote”, with the platform and app version. They carry no customer names, addresses, photos or document text. | The app |
| Error reports | When the app or our servers hit an error: the error, where it happened, device model, system and app version. We remove personal information from them before they’re stored. | The app and our servers |
| Messages | Feedback you send from the app and emails to support | You |
How we use it, and our legal basis
Where UK or EU data protection law applies, each use needs a legal basis:
| Why | Legal basis |
|---|---|
| Run your account: sign-in, sync between your devices, documents, sending, the customer page, reminders, exports | Contract: it’s the service you signed up for |
| Your subscription and the platform fee on card payments | Contract |
| Sign-in codes and emails about your account and our service | Contract |
| Keeping Quotebird secure: rate limits, abuse prevention, investigating problems | Our legitimate interest in a safe, working service |
| Counting how the app is used, to fix and improve it | Our legitimate interest in improving Quotebird. We only use counts, never your customers’ information. |
| Answering feedback and support requests | Our legitimate interest in helping you, or contract |
| Telling you when team features arrive, if you asked | Your consent, which you can withdraw at any time |
| Keeping accounting records and answering lawful requests | Legal obligation |
We don’t send marketing emails unless you ask for them.
AI drafting
When you use AI drafting on a quote, we send our AI provider the photos, voice note and notes you added to that quote, your trade and country, and the names and units of your price book items, so it can suggest lines from your own list. It sends back suggested lines, quantities and assumptions; it never sets a price. Voice notes are turned into text by the same provider.
Our AI provider today is OpenAI. It processes this information for us under a data processing agreement, doesn’t use it to train its models and keeps it for no more than 30 days to check for abuse. We ask it not to store its answers. We don’t use your quotes, photos or notes to test or tune AI ourselves.
You choose whether to use AI drafting, and you can quote without it. If you use it, tell your customers.
Who we share it with
We use a small number of service providers (“sub-processors”) to run Quotebird: hosting in Germany, file storage, email delivery, subscriptions and AI drafting. The full list, with what each one does and where, is in our Terms. They may use the information only to provide their service to us.
Some companies get information because you chose to use them, under their own terms and privacy policies:
- Apple and Google sell and manage your subscription, and handle Sign in with Apple and Google sign-in.
- Stripe processes your customers’ card payments into your own Stripe account, if you connect one.
We may also disclose information if the law requires it, to protect people or our service from harm, or to a buyer of our business, who would have to keep this policy’s promises.
Where it’s processed
Our servers are in Germany, and files (photos, voice notes, documents and logos) are stored in Cloudflare’s Eastern Europe storage region. Some of our providers are in the United States or process information there. When information leaves the UK or the EU, we rely on the UK and EU adequacy decisions, the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the European Commission’s standard contractual clauses with the UK Addendum. Ask us for a copy of the safeguards.
How long we keep it
- Your account and business data: while your account exists. When you delete your account, we delete it within an hour, and our database backups overwrite it within 30 days.
- Data exports: 7 days after they’re made.
- Error reports: 90 days.
- Security logs: as long as we need them to look into a problem, and no more than 30 days.
- Records the law makes us keep, such as our own accounting records: as long as the law requires.
Your documents are your business records, and tax law asks you to keep them for some years. Export them before you delete your account.
Your rights
Depending on where you live, you can ask us for a copy of your information, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable format. Most of this you can do yourself in the app: edit your profile, export your data or delete your account. Otherwise email [email protected]. We’ll answer within a month and may ask you to confirm who you are. If you gave consent, you can withdraw it at any time.
If you’re unhappy with how we’ve handled your information, tell us first and we’ll try to put it right. You can also complain to your data protection regulator: in the UK the Information Commission (ico.org.uk), in Ireland the Data Protection Commission (dataprotection.ie), in Canada the Office of the Privacy Commissioner (priv.gc.ca), in Australia the Office of the Australian Information Commissioner (oaic.gov.au), and in New Zealand the Office of the Privacy Commissioner (privacy.org.nz).
United States. We don’t sell or share personal information for targeted advertising, and we don’t use it to profile you. You can ask us to access, correct or delete it as described above, whatever state you live in, and we won’t treat you differently for asking.
Customers of businesses that use Quotebird
This part is for you if a business (a plumber, electrician, cleaner and so on) sent you a quote, invoice or receipt with Quotebird.
The business is responsible for your information. It decided to collect your details and the job’s photos and to send you the document, so it’s the controller. Ask it first about your information: its name, email and phone are on the document. Its own privacy notice is linked from the document’s page if it added one.
What we do for the business. We store your details, the job’s photos and notes and the documents, and make and send them on the business’s behalf. We show the document on its page and record when it was opened. If you accept or sign, we record your name, signature, the time, your IP address and your device as the record of your agreement, together with the notices you were shown. If the business uses AI drafting, the job’s photos and notes go to our AI provider to suggest the quote’s lines (see AI drafting). We do all of this only on the business’s instructions. If you pay by card, the payment goes to the business through Stripe, which handles your card details under its own privacy policy; we never see your full card number.
What we do for ourselves. A few uses are our own, so for them we are the controller:
- Security. Our servers and our network provider, Cloudflare, see your IP address and browser when you open a document’s page. We use them to protect the page from abuse and keep them for no more than 30 days. Legal basis: our legitimate interest in keeping the service safe.
- Email delivery. If an email to your address can’t be delivered or you mark it as spam, our email provider keeps the address on a list so that no business sends to it through Quotebird again. It stays there until you ask us to remove it. Legal basis: our legitimate interest in reliable email delivery.
We don’t use your information for marketing, sell it or use it to train AI.
How long. The business decides how long it keeps its records, and tax law often asks it to keep invoices for several years. When the business deletes your details or its account, we delete them too, and our backups overwrite them within 30 days.
Your rights. You have the rights described in Your rights. For the information the business holds, ask the business; if you ask us, we’ll pass your request on to it. For the security logs and the email list, ask us at [email protected]. You can also complain to your data protection regulator.
Our website
This website doesn’t use cookies, analytics or tracking, and loads nothing from other sites. Our hosting provider’s servers log requests, including IP addresses, for security.
Children
Quotebird is for businesses. It isn’t meant for anyone under 18, and we don’t knowingly collect children’s information to run accounts.
Changes to this policy
If we make an important change, we’ll tell you in the app or by email before it takes effect. The date at the top shows when it last changed.
Contact
Email [email protected] or write to KARAY DIGITAL LTD, Suite 10330, 5 Brayford Square, London E1 0SG, United Kingdom.