Quofix operates Quofix (United Kingdom). For UK data protection law, we are the data controller for personal data described in this policy.

Quofix — contact support@quofix.app for operator and correspondence details.

This policy applies to the Quofix website and application. It does not cover third-party websites linked from our service.

Quofix is aimed at UK businesses and tradespeople (drylining, ceilings and related fit-out) using the service for commercial estimating and quotations.

The service is not directed at children. You should not create an account if you are under 18.

We collect only what we need to run accounts, billing and saved job features. Job or client names you type into quotations are stored as part of your workspace content — you should only enter information you are entitled to use for your business.

• Account email address and authentication identifiers (via Supabase Auth)
• Password credentials stored as secure hashes — we do not store plain-text passwords
• Business or trading name, default contact lines and optional WhatsApp handoff number in your workspace
• Takeoff inputs, material lines, quotation text, extras, site instructions and saved job records you choose to store
• Subscription tier, quote usage counts and pay-per-quote payment grant records
• Stripe customer and payment references needed to confirm paid plans (not full card numbers on our servers)
• Support emails you send us and our replies

We rely on different bases depending on the activity:

• Contract — providing your account, saved jobs, quotation features and plan limits you have signed up for
• Legitimate interests — keeping the service secure, preventing abuse, improving reliability, and responding to support (balanced against your rights)
• Legal obligation — where we must retain billing or tax records
• Consent — only where we ask clearly (for example optional marketing if we introduce it in future; we do not rely on consent for core account cookies)

We use personal data to authenticate you, sync saved jobs on eligible plans, apply subscription and pay-per-quote limits, process payments through Stripe, and respond to support requests.

We do not sell your personal data. We do not use your saved quotations to train third-party AI models.

We use trusted service providers (processors) who handle data on our instructions:

• Supabase — Authentication, database hosting and account storage (https://supabase.com/privacy)
• Stripe — Payment processing and subscription billing (https://stripe.com/gb/privacy)
• Vercel — Application hosting and optional aggregate analytics (with consent) (https://vercel.com/legal/privacy-policy)
• Google — Advertising conversion measurement (with marketing consent) (https://policies.google.com/privacy)
• OpenAI — AI Drawing Assist image analysis (Contractor Pro, when configured) (https://openai.com/policies/privacy-policy)

Some providers may process or store data outside the UK (for example in the European Economic Area or United States). Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement and/or EU Standard Contractual Clauses offered by those providers.

Stripe and Supabase publish their own privacy notices and security documentation — review them if you need detail on their practices.

We use essential cookies and local storage for sign-in, calculator drafts and your consent choice.

Optional Vercel Analytics (service analytics) and Google Ads conversion tags load only after you grant the relevant consent in our cookie banner.

See our cookie policy at /cookies for names, purposes and how to withdraw consent.

We keep account and billing records while your account is active and for a reasonable period afterwards for legal, tax, fraud prevention and dispute resolution (typically up to six years where tax or contract records apply, unless a shorter period is sufficient).

Support correspondence is kept only as long as needed to resolve your enquiry and for a short operational archive.

You may delete local browser data at any time; cloud saved jobs remain until you delete them or close your account.

We use HTTPS, industry-standard authentication, and access controls appropriate to a small business SaaS tool. No online service can guarantee absolute security; please use a strong unique password and sign out on shared devices.

Payment card details are entered on Stripe-hosted checkout pages. Quofix does not store full card numbers on our application servers.

Under UK data protection law you may have the right to access, rectify, erase, restrict processing, object to certain processing, and data portability where applicable.

To exercise rights, email support@quofix.app from your account email. We may need to verify your identity before acting on a request.

You may complain to the Information Commissioner's Office (ICO) — the UK supervisory authority — at ico.org.uk if you believe processing infringes the law.

Email support@quofix.app to request account closure and deletion of personal data we control, subject to records we must keep by law (for example completed payment records).

We aim to complete verified erasure requests within one month, in line with UK GDPR timelines.

If you need a B2B summary of processor roles and sub-processors for procurement, see our data processing summary at /data-processing. Formal signed DPAs are available on request where we can support them.

We may update this policy when features, processors or legal requirements change. The “last updated” date at the top will change when we do. Continued use after material changes may mean you accept the updated policy where the law allows.