What we know about you,
and what we do with it.

Quotinc is a company registered in Dubai, United Arab Emirates; the team works from Kuala Lumpur. For anything in this policy, write to sales@quotinc.com and a founder reads it.

Two situations are covered here. On this website we decide what is collected, so the responsibility is ours alone. Inside the platform your company is the controller of its workspace and we process that data on your instructions, under these promises and any data-processing agreement we sign.

• The enquiry form. Name, email and whatever you write to us. We use it only to reply and to arrange the demo you asked for. It is never added to a marketing list, and we delete it on request.
• Google Analytics. This website uses it to see which pages get read, in aggregate. The platform at live.quotinc.com carries no Google Analytics.
• Cloudflare. The site is served through Cloudflare, which sees the traffic the way any host does.

Three kinds of data live in a workspace:

• Account data. Your name, work email, role and a password we store only as a bcrypt hash.
• Workspace content. Quotations, supplier rates, clients, contacts, catalog entries, files and the messages your team writes to each other. This is your business, held for you.
• The audit trail. Security-relevant actions such as sign-ins and record changes, with actor, tenant and timestamp, so both of us can reconstruct what happened.

It lives in managed Postgres, encrypted in transit and at rest, with every record tied to your tenant. The full technical picture is on the security page.

We use your data to run the service, support you and bill you. That is the list. Your supplier rates never train a shared model, never benchmark you against another desk, and never get sold.

The AI assistant reads only the quotation you are actively editing and your own catalog, scoped to your tenant on the server. Product analytics, where enabled, records usage events and not the contents of your quotes.

Every third party in the data path is named on the subprocessors page, with what it does and what reaches it: Supabase for the database and sign-in, Anthropic for the assistant, Google Places for venue photos, Microsoft 365 for outbound email, Cloudflare for DNS. If that list changes, the page changes with it, and customers hear about a new subprocessor before it goes live.

Inside Quotinc, access to production data is limited to the people who operate the service, for operating the service, and it is logged.

A quotation you issue travels to your client by a private link built on a long random token that cannot be guessed. Anyone holding that link can open that quotation, so treat the link like the document itself. The buyer page shows what you chose to publish and nothing of your costing.

• The platform sets cryptographically signed, HTTP-only session cookies to keep you signed in. No advertising trackers, no third-party ad cookies.
• This website sets Google Analytics cookies, as described in section 02.

Workspace data is kept for as long as your subscription runs, because that is the service. After it ends you have 30 days to export, and we delete the workspace on request. Enquiry-form details are kept only as long as the conversation is alive. Backups age out on a rolling schedule rather than living forever.

You can ask what we hold about you, have it corrected, take a copy, or have it deleted. Export of workspace content is built into the product, in XLSX, PDF and PPTX, no fee. For everything else, one email to sales@quotinc.com does it, and you will get an answer from a person, without undue delay.

If you believe we have handled your data badly, tell us first so we can fix it. You also have whatever right of complaint your local data-protection law gives you.

When something material changes, we email account owners before it takes effect, and the date at the top of this page moves. Small clarifications just move the date.