Last updated: September 24, 2026
QuoteCrest is operated by QuoteCrest (“we”, “us”, “our”). You can contact our data protection team at privacy@quotecrest.com.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address | Account registration and communication | Contract |
| Password (hashed) | Authentication security | Contract |
| Timezone and locale | Localized experience | Legitimate interest |
| Usage data (sessions) | Security, fraud prevention, support | Legitimate interest |
| Quote and client data you enter | Providing the quoting service | Contract |
| Client payment data (Stripe Connect) | Processing client payments when you have connected your Stripe account. Your client's payment method is handled entirely by Stripe — QuoteCrest never stores card details. QuoteCrest collects a platform fee at the time of payment. | Contract |
| Billing information (Stripe) | Payment processing | Contract / Legal obligation |
| Quote data (QuickBooks / Xero) | Creating invoices in your accounting software when a quote is accepted. Shared only if you connect your QuickBooks or Xero account. | Contract |
| Client and item data (QuickBooks / Xero) | Syncing clients and item catalog between QuoteCrest and your accounting software. Shared only if you connect your QuickBooks or Xero account. | Contract |
| Consent timestamps | Recording your agreement to our terms | Legal obligation |
| Analytics data (with consent) | Product improvement and usage analytics | Consent (can be withdrawn any time in Settings) |
| IP address (registration and quote-creation forms) | Pre-populate country, currency, and region fields using approximate geolocation via ipinfo.io. Your IP address is sent to ipinfo.io when the form loads. | Legitimate interest |
| IP address, approximate location, network operator and browser (every visit) | Protecting the service against abuse and fraud — rate limiting, and blocking networks and regions used for abuse — and diagnosing errors and performance problems. We record each visitor's IP address with its approximate location and network (looked up via ipinfo.io), the browser, and request and error logs. These records are kept by QuoteCrest and are not used for marketing. | Legitimate interest (network and information security) |
| Derived location identifiers (matrixapi.dev) | The country and region code derived from your IP address is used to query matrixapi.dev for reference data (currencies, postal codes, countries) in order to pre-populate form fields. No personally identifiable information beyond the derived location code is sent to matrixapi.dev. | Legitimate interest |
We use strictly necessary cookies (a session cookie that keeps you logged in and a CSRF token that protects against cross-site request forgery) and analytics cookies via Google Analytics (GA4) to understand how visitors use our marketing pages. Google Analytics sets cookies that collect anonymized usage data; no personal data from your account is shared with Google. You can opt out at any time using Google's opt-out browser add-on or by managing your preferences in Account Settings.
Your personal data is held for as long as your account is active. Accounts inactive for more than 3 years are subject to automated deletion after a 30-day warning notice. We retain records of accepted quotes for 7 years to comply with accounting and tax regulations. Anonymized aggregate statistics may be retained indefinitely.
We share data only with the sub-processors required to run the service:
We do not sell your data to third parties.
If you are in the European Economic Area (EEA), UK, or Switzerland you have the right to:
To exercise any of these rights, email privacy@quotecrest.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
Our servers are hosted on AWS in the EU. Some of our sub-processors (e.g. Stripe) operate in the United States. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission.
All data is encrypted in transit (TLS) and at rest. Passwords are stored as bcrypt hashes and are never recoverable. We support two-factor authentication and encourage all users to enable it.
QuoteCrest is a business tool and is not directed at children under 16. We do not knowingly collect personal data from anyone under 16.
We may update this policy. If changes are material, we will notify you by email at least 14 days before they take effect. The “last updated” date at the top of this page always reflects the current version.
Data controller: QuoteCrest
Email: privacy@quotecrest.com