Privacy policy

Who we are

QuotePack is operated by Glide Marketing Ltd, registered in England and Wales (company 15154178), registered office Hammerain House, Hookstone Avenue, Harrogate HG2 8ER. You can reach us at help@quotepack.co.uk.

We are registered with the Information Commissioner’s Office as a data controller, registration number ZB835772, as UK law requires of anyone handling personal data commercially. You do not have to take our word for it: check the entry on the public register.

For anything about your data, including a request to see a copy of it, write to help@quotepack.co.uk. It reaches a person rather than a queue. We have not appointed a data protection officer, and are not required to: we are a small company, we do not monitor anybody on a large scale, and we handle no special category data.

Two different relationships

This matters more than anything else on the page, because it decides who is responsible for what.

• For your data, we are the controller. Your business name, your email address, your VAT number, your branding and your account. We decide how that is used, and this policy explains it.
• For your clients’ data, we are the processor and you are the controller. When you type a client’s name, email or phone number into a quote, that is your relationship with them, not ours. We hold it on your behalf and act on your instructions. Our terms include a data processing agreement covering this.

What we collect

When you build a quote

• Your business details: name, email, phone, website, VAT number
• Your branding: a logo you upload and an accent colour
• Your client’s details, as you enter them: name, contact name, email, phone
• The job, the line items, the prices, and your terms

When your client opens a quote

• The date and time it was first opened. The first view only, not every visit.
• A hashed version of their IP address, salted per document. This is enough to notice a machine opening a thousand quotes and not enough to locate a person, which is the point.
• Their browser’s user agent string
• If they accept: the name and role they type, their confirmation that they can accept on the organisation’s behalf, the time, and a sha256 fingerprint of the exact document version they agreed to

What we deliberately do not collect

• No payment card details, ever. We do not take card payments and, when we do, they will be handled entirely by Stripe on their own pages.
• No passwords. Signing in uses a link sent to your email address.
• No tracking of your client beyond the first open. We do not record every visit, we do not follow them elsewhere, and we do not build a profile.

Why we hold it, and on what basis

The benchmark data, stated plainly

We intend to publish aggregate figures about what UK small businesses charge for particular kinds of work, drawn from quotes sent through QuotePack. We are telling you this now, before it happens, rather than adding it later.

Three commitments, and they are absolute:

• Aggregate only. No figure is ever published unless it is drawn from at least 50 separate jobs.
• Nobody is identifiable. Not you, not your client, not your business. No quote, client name, business name or reference appears in any published figure.
• You can opt out, at any time, by writing to us. It costs you nothing and changes nothing else about the service.

How long we keep it

How it is protected

The full detail is on our security page. The short version:

• Everything is encrypted in transit (HTTPS with HSTS) and at rest.
• Bank details you enter carry a second layer of encryption at the application level, with a key held separately, so a database copy on its own does not expose them.
• We store only a hash of every quote link. We cannot recover a link for you, which is the same reason nobody else can either.
• Your quotes are never indexed by search engines. This is enforced three ways and tested on every deploy.
• We never log the contents of your documents.

Who else touches it

We use a small number of processors, all of them contractually bound and none of them permitted to use your data for their own purposes:

We do not sell your data, and we never will. We do not share it with advertisers and we run no advertising trackers.

Sending data outside the UK

Your data is stored in the UK and the EU. Two of our processors, Anthropic and Resend, may process some data in the United States, and Stripe will once card payments are switched on.

A transfer out of the UK is only lawful with a safeguard in place. For each of these we rely on either the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, whichever that provider offers, together with our own assessment that the transfer is appropriate. Where a provider is certified under the UK Extension to the EU–US Data Privacy Framework, we may rely on that instead.

If you want to know which safeguard applies to a particular provider, ask us and we will tell you.

Automated decisions

We do not make any decision about you by automated means, and we do not profile you. Nothing in QuotePack decides anything about a person without a human involved.

We do use AI in one place, and it is worth being exact about what it does. If you paste an enquiry into the builder, a language model reads it and suggests which fields it thinks are the client name, the job and the price, for you to check and correct. It also drafts wording for parts of the quote. It never calculates a price, a total, a VAT figure or a deposit, which are all computed on our servers, and its output is never sent anywhere without you seeing it first. Your text is not used to train anybody’s model.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing based on legitimate interests, including the benchmarking above. You can also ask for your data in a portable format.

Write to help@quotepack.co.uk. We will respond within one month. There is no charge.

If your client wants their data removed, ask us and we will help. They are your contact, so it is usually quicker for you to tell us than for them to.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first.

Cookies

We use essential cookies only: one to remember the quote you are part way through, and one to keep you signed in. There are no analytics or advertising cookies, and none will be added without asking you first. See our cookie policy.

Changes

If we change this materially we will tell account holders by email before it takes effect. The date at the top is when this version came into force.