QuoteIt Privacy Policy

1) Scope and roles (Controller vs Processor)

1.1 When QuoteIt is a "controller"

QuoteIt acts as a controller for Personal Data we process for:

• account creation and authentication,
• billing and procurement contacts,
• website analytics and marketing operations (where applicable),
• security logs and abuse prevention,
• support communications.

1.2 When QuoteIt is a "processor/service provider"

When an organization (the "Customer") uses QuoteIt to process content (e.g., documents, prompts, persona materials, drafts, approvals) within a workspace, QuoteIt typically processes that content on behalf of the Customer. In those cases, Customer agreements and any Data Processing Addendum (DPA) govern QuoteIt's processing as a processor/service provider.

If you are an end user in a business workspace, requests about workspace content should usually be directed to your workspace administrator or your organization.

2) Personal Data we collect

We collect Personal Data in the following ways:

2.1 Personal Data you provide

• Account information: name, business email, organization, role/title, authentication credentials (including SSO identifiers), workspace settings.
• Billing/procurement information (business): billing contact details, invoices, transaction records, tax details (as applicable). (Payment processing may be handled by third parties; we may not store full payment card details.)
• Support and communications: information you provide in support tickets, emails, feedback, or other communications.
• Marketing access and waitlist: a work email submitted to check access is logged as an unverified access attempt even if you do not join the waitlist. If you separately opt in to waitlist updates, we also collect the name, company, role, notes, source, and consent record submitted with that request. Email confirmation is a separate step; an accepted request or sent email does not mean the address has been verified.

2.2 Personal Data we receive from your use of the Services (Technical Information)

• Log data: IP address, browser type/settings, timestamps, diagnostic logs.
• Usage data: feature usage and actions taken, time zone/country (approximate), access dates/times.
• Device information: device type, OS, browser details, device identifiers.
• Location information: approximate location inferred from IP for security and abuse prevention; precise location only if you choose to provide it where a feature supports it.
• Cookies and similar technologies: used for authentication, preferences, security, and analytics. See our Cookie Notice.

2.3 Information we receive from other sources

• Security partners (fraud/abuse signals),
• identity providers (SSO provisioning and authentication),
• business/marketing partners (where permitted),
• integrations/connectors enabled by your organization (depending on configuration and permissions).

2.4 Customer Content in workspaces

Customers (including agencies acting for their clients) may submit content into QuoteIt workspaces, including documents, prompts, persona materials, drafts, edits, approvals, and related metadata. This content may contain Personal Data. QuoteIt processes this content as described in this Privacy Policy and in Customer agreements and/or a DPA where applicable.

3) How we use Personal Data

We use Personal Data to:

• provide, operate, and maintain the Services (including authentication, account/workspace administration),
• support persona-based drafting workflows (e.g., creating Personas, generating drafts, approvals and versioning),
• build and operate workspace knowledge features (e.g., indexing, retrieval, grounding/verification),
• provide customer support,
• secure the Services, prevent fraud/abuse, and investigate incidents,
• manage billing and procurement operations,
• record access interest and respond to access checks,
• send waitlist updates only after a separate affirmative opt-in and email verification,
• improve reliability, performance, and safety of the Services,
• comply with legal obligations and enforce our terms and policies.

4) AI processing, Personas, and training

QuoteIt is designed to help organizations generate communications in consistent, persona-based voices grounded in verified data and supported by approval workflows. To provide these capabilities, we may process content in several ways.

4.1 Persona creation and Persona Artifacts (core service processing)

Customers may configure Personas (e.g., CEO/CTO/VP/company voice profiles). To implement Personas, QuoteIt may create and store Persona Artifacts derived from workspace content and usage, such as style profiles, style guides, embeddings/vector representations, prompt representations, rules/configurations, adapters (including LoRA), fine-tuned weights, soft prompts, and related metadata.

By default, Persona Artifacts are workspace-specific and used only to provide the Services for that Customer/workspace, unless the Customer enables a separate improvement/training mode described below.

4.2 Data Use Modes for generalized improvement (Standard vs Early Access)

Customers may use QuoteIt under one of the following modes (as specified in an Order Form, plan description, or workspace setting):

• Standard Mode (default for most business customers): We do not use Customer Content, Outputs, or Persona Artifacts from that workspace to train or improve generalized models/services for other customers unless the Customer explicitly opts in.
• Early Access Mode (alpha/beta): We may use certain limited data to improve generalized models/services unless the Customer opts out, as described below.

4.3 Improvement Data (minimized and de-identified)

When generalized improvement is enabled (by opt-in in Standard Mode, or unless opted out in Early Access Mode), we use Improvement Data, which consists of minimized, de-identified excerpts derived from eligible sources. By default, eligible sources are limited to:

• approved Outputs,
• user edits to Outputs and approval/feedback signals,
• de-identified quality signals (e.g., labels about tone/grounding issues).

By default, we do not use raw uploaded source documents for generalized improvement unless a Customer explicitly enables that in writing (e.g., in an Order Form).

We apply reasonable measures intended to minimize and de-identify Improvement Data, and we do not attempt to re-identify it except as required by law.

4.4 How to opt in / opt out of generalized improvement

• Standard Mode: generalized improvement is off by default; Customer must explicitly opt in (e.g., Order Form checkbox or admin setting).
• Early Access Mode: generalized improvement may be on by default for eligible Improvement Data; Customer can opt out via workspace settings or by contacting privacy@quoteit.me.

Changes apply going forward. Opting out does not require us to retrain or remove learning already incorporated into generalized models, except where required by law or expressly agreed.

5) Disclosure of Personal Data

We may disclose Personal Data in the following circumstances:

5.1 Vendors and service providers (subprocessors)

We may share Personal Data with vendors and service providers that support operations (hosting, storage, monitoring, analytics, customer support tooling, email delivery, security monitoring, OCR/layout processing, vector databases, payment processors). These parties process Personal Data under contractual confidentiality and security obligations.

5.2 Third-party services and model providers

If your organization enables Third-Party Services (including third-party model APIs), relevant prompts/context may be transmitted to those providers to generate outputs. Those providers' terms and privacy practices govern their processing. Your organization controls whether such integrations are enabled.

5.3 Business transfers

If QuoteIt is involved in a merger, acquisition, restructuring, bankruptcy, or sale of assets, Personal Data may be disclosed during diligence and transferred as part of the transaction, subject to customary protections.

5.4 Legal and safety

We may disclose Personal Data if we believe disclosure is necessary to comply with law or legal process, enforce our terms and policies, prevent fraud/abuse, or protect the rights, safety, and security of QuoteIt, Customers, users, or the public.

5.5 Affiliates

We may share Personal Data with our affiliates for purposes consistent with this Privacy Policy.

6) Business workspaces and administrators

If you use QuoteIt as an Authorized User within a business workspace, workspace administrators may have the ability to:

• manage users and permissions,
• access, export, or delete workspace content,
• configure integrations, retention settings, and data-use modes (Standard/Early Access where applicable).

If you create an account using an email address belonging to an organization, we may share limited account information with that organization as needed for workspace administration and security.

7) Retention

We retain Personal Data only as long as reasonably necessary to:

• provide the Services,
• maintain security and prevent abuse,
• resolve disputes,
• comply with legal obligations.

Retention may vary based on the nature of the data, sensitivity, legal requirements, and Customer settings. Backups may persist for limited periods.

If you use QuoteIt through a business workspace, retention of workspace content is typically controlled by the Customer's contract/settings and/or a DPA.

For the marketing access and waitlist service, our current operational defaults are: expired abuse-control windows are removed after 48 hours; unverified access attempts and unconfirmed waitlist personal fields are removed after 30 days; cookie receipts and unnecessary user-agent values are retained for no more than 180 days; and command and consent evidence is retained for no more than 365 days.

A confirmed waitlist profile is retained while subscribed. On unsubscribe, we clear nonessential name, company, role, and notes, while retaining the minimum email, suppression, and proof needed to honor that choice for as long as the marketing service can send updates. For correction or removal requests, contact support@quoteit.me.

8) Security

We maintain commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data. However, no system is perfectly secure. You should use appropriate safeguards (SSO where available, strong passwords, careful sharing, and least-privilege access).

9) Your rights and choices

Depending on where you live, you may have rights such as access, correction, deletion, portability, restriction, or objection.

9.1 Enterprise users

If you use QuoteIt in an enterprise workspace, your organization typically controls workspace content. Requests about workspace content should generally be directed to your administrator. QuoteIt will assist Customers as required by contract and applicable law.

9.2 How to exercise rights

Email: privacy@quoteit.me. We may request verification to protect against unauthorized access or deletion.

10) International transfers

QuoteIt is based in India and may process Personal Data in India and other jurisdictions where we and our service providers operate. Where required, we implement appropriate safeguards for cross-border transfers.

11) Children

The Services are not intended for children under 13 (or older if required by local law). We do not knowingly collect Personal Data from children. If you believe a child has provided Personal Data, contact privacy@quoteit.me.

12) Additional U.S. state disclosures (if applicable)

We do not sell Personal Data. We also do not share Personal Data for cross-context behavioral advertising or process Personal Data for targeted advertising, except as may be disclosed in an updated policy if our practices change.

Where applicable, you may have the right to know, delete, correct, and obtain a portable copy of your Personal Data, and to be free from discrimination for exercising privacy rights, subject to legal exceptions.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post an updated version with a revised Effective Date and provide additional notice if required by law.

14) Contact

Privacy: privacy@quoteit.me

Legal: legal@quoteit.me