Privacy Notice

This notice explains how the Quotr application handles personal information. It accompanies Application Terms version 2026-10-22. It is separate from the website privacy notice at get-quotr.com, which covers the public website and not an account.

The application is supplied by Flowra Limited, trading as Quotr. NZBN 9429052916465. Public location: Auckland, New Zealand. Flowra Limited collects the account and job information described below and holds it for the Quotr application. Privacy, access, correction, and deletion requests, and complaints, go to hello@get-quotr.com.

This notice is written for the New Zealand Privacy Act 2020. The Application Terms explain the service.

Depending on what you do in Quotr, we hold:

• Account details: name, email, and phone number.
• A password, which is handled by Supabase Auth. We do not keep a readable copy of the password in company or job records. Supabase Auth keeps it in a protected form used to check later sign-ins.
• Organisation details: company name, address, logo, NZBN, GST number or ABN, and GST choice.
• Team details: names and emails of people you invite, and their role.
• Customer and supplier contacts you enter, including names, emails, phone numbers, and addresses.
• Job notes, measurements, photos and files, estimates, rates, pricing, quotes, and variations.
• Quote acceptance, including a typed or drawn signature and the time it was given.
• Billing references for a subscription, such as the Stripe customer and the plan. Card numbers are entered in Stripe. We do not store the card number.
• Technical logs used to run and protect the service, such as sign-in events and email delivery status.

We use this information to create and protect the account, provide estimating and quoting, send messages you ask us to send, bill for a paid plan, and meet legal duties.

A name, email, password, phone number, and organisation name are required to create an account. Without them, the account is not created. You must confirm the email before the account can be used. The phone number is not used to sign in and is not texted. Nothing in account creation is required by a statute. You choose whether to open an account.

Job details, prices, and customer contacts are needed only for the quote or estimate you choose to prepare. If you leave them out, that quote or estimate cannot be completed or sent. The product-update question is separate. You can create an account whether you answer yes or no.

You can ask us whether we hold personal information about you, ask for a copy, and ask us to correct information that is inaccurate or misleading. Those requests go to hello@get-quotr.com.

Production information is not stored only in New Zealand. The companies below handle it so the application can run. Some act only to do work for us. Others also use information for their own service.

• Supabase stores the Production database and uploaded files in Tokyo, and provides sign-in. It does that for us.
• Vercel hosts the application from the United States. It does that for us.
• Resend sends account, security, team, and quote email for us.
• Stripe takes payment, issues invoices, and applies New Zealand GST on our subscription fees. Stripe handles card details for that payment service, including Stripe’s own payment duties.
• Google returns address suggestions when you search for an address. The words you type are sent to Google for that search. Google provides that search as its own service. You can type an address instead.
• Anthropic receives the text described in section 5, when you use an analysis or assistant feature, and returns a result. That call uses Anthropic’s commercial API.

A person you invite can see the organisation according to the role you give them. A customer, supplier, or other recipient can open a quote, variation, price request, or invitation when you send them the link for it. They do not become a member of the account.

If you run an analysis or assistant feature, the text that feature needs is sent to Anthropic so it can return a result. Stored photos are kept with the job. This notice does not say those photos are sent to Anthropic.

Anthropic’s commercial terms say Anthropic may not train its models on customer content submitted to that API. Anthropic’s commercial privacy statement says that, by default, API inputs and outputs are not used for model training. Anthropic also says it deletes ordinary API inputs and outputs within 30 days, unless the law, a safety review, or a different arrangement requires longer retention. We have not arranged a shorter retention period with Anthropic.

At signup you choose whether you want occasional product updates and practical tips. Yes is stored as consent, with the time of that choice. No is stored as no consent. Either choice lets you create the account. A profile with no recorded choice is not treated as consent.

Signed in, that choice is under Profile → Email preferences. You can opt in or opt out there. You can unsubscribe from those product updates separately from account, security, and service emails. We still send the service emails, including confirmation and password reset.

Loops (loops.so) processes the contact, consent, and account-usage information needed for those optional updates. The same choice covers the First job and rates sequence, which is sending, and optional reminders about unfinished setup, a first estimate, a first Quote, and a trial that is ending. Those reminders are not sending yet. They are separate from billing and service email. It does not receive project, client, or quote contents.

We limit access to what is needed to provide the service, including the people and companies in section 4. No online service can promise that information will never be accessed without permission. If a breach is likely to cause serious harm, we will notify the people affected and the Privacy Commissioner as the Privacy Act 2020 requires.

We keep information while the account is open and while it is still needed for the service, for billing, for a dispute, for security, or for a legal duty. Cancelling a subscription does not close the account and does not delete job information. After the service end described in the Application Terms, existing work remains available to view. There is no download of the whole account, and there is no automatic deletion.

To ask for a copy, a correction, closure of the account, or deletion, email hello@get-quotr.com. Include your name, the account email, and what you are asking for. We may need to check that the request is from you. New Zealand privacy law does not give a general right to deletion. We will delete information when we no longer need it for a purpose in this notice, or when the law requires deletion. Subscription and tax records may be kept for the period New Zealand tax law requires. Job notes, photos, quotes, and customer details are not kept just to meet that tax period. We will respond within the time the Privacy Act requires.

If you are not satisfied, you can complain to us at hello@get-quotr.com, and you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

When you enter a customer, supplier, or teammate, we receive their details from you rather than from them. We still have to handle that information lawfully. Your duty to have a proper reason for entering it, and to tell them why you hold it, sits alongside our duties. It does not replace them.

A quote, variation, price request, or invitation identifies your organisation as the sender. We host the message and the page opened from its link. A recipient can email hello@get-quotr.com about information we hold because that message was sent. Correcting a job record may also need the account holder, because the record is part of that account.