Privacy Policy

QuoteTriage provides AI-powered lead triage and qualification services to service businesses ("Customers"). In providing these services, we process data on behalf of our Customers (acting as a data processor) and we collect data about our Customers and their representatives (acting as a data controller).

This policy covers both categories of data. If you are an end-user whose data was submitted through a Customer's lead form, your data is processed pursuant to that Customer's privacy policy. You should contact that Customer directly for questions about your personal data.

We collect information in the following categories:

Account & Registration Data

• Name, email address, and password when you create an account
• Billing information including payment method details (processed by Stripe)
• Company name, industry, and business size
• Phone number for support and notifications

Service Usage Data

• Lead data submitted through your configured forms (name, email, phone, message fields)
• AI scoring results, triage decisions, and confidence levels
• Webhook configuration details and integration settings
• Feature usage patterns and in-app behavior (aggregated)

Technical & Device Data

• IP address, browser type, operating system, and device identifiers
• Log data including pages visited, time spent, and referring URLs
• Cookies and similar tracking technologies (see Cookies section below)

We use the information we collect to:

• Provide, operate, and improve the QuoteTriage platform and services
• Process and evaluate leads submitted through your configured forms
• Train and refine our AI models to improve triage accuracy (using anonymized, aggregated data only)
• Send transactional communications such as lead alerts, SMS notifications, and billing receipts
• Provide customer support and respond to inquiries
• Monitor for abuse, fraud, and security threats
• Comply with legal obligations and enforce our Terms of Service
• Send product updates and marketing communications (you may opt out at any time)
• Analyze usage trends to improve product features and user experience

We do not sell your personal data. We do not use your lead data to train models for competing products or share it with third parties for their independent marketing purposes.

We share your information only in the following limited circumstances:

Service Providers

We use trusted third-party vendors to operate our services. These vendors are contractually bound to protect your data and may not use it for their own purposes:

• Stripe — payment processing and billing
• AWS — cloud infrastructure and data storage
• Twilio — SMS and phone notifications
• PostHog — anonymous product analytics
• Resend — transactional email delivery

Business Transfers

If QuoteTriage is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, government requests). We will notify you of such requests when permitted by law.

We retain different categories of data for different periods based on business necessity and legal requirements:

• Account data: retained for the duration of your account plus 90 days after closure
• Lead data: retained for 12 months by default; configurable per-account down to 30 days
• Billing records: retained for 7 years to comply with financial regulations
• Server logs: retained for 90 days for security and debugging purposes
• AI model training data: anonymized and aggregated; no individual lead data is retained

You may request deletion of your account and associated data at any time by contacting [email protected]. We will process deletion requests within 30 days, subject to retention requirements imposed by law.

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted via TLS 1.3
• Lead data and account information is encrypted at rest using AES-256
• Access to production systems is restricted by role-based permissions and requires MFA
• We conduct regular security audits and penetration testing
• We maintain a vulnerability disclosure program at [email protected]
• Payment card data is never stored on our servers — handled entirely by Stripe

While we take strong precautions, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to [email protected] before public disclosure.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain uses of your data, including direct marketing
• Restriction: Request that we restrict processing of your data in certain circumstances
• Withdrawal of Consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are located in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

We use cookies and similar technologies to operate our website and services. For a full description of the cookies we use and your choices, please see our Cookie Policy.

In summary, we use: (1) essential cookies required for the service to function; (2) analytics cookies to understand how the product is used (PostHog, anonymized); and (3) functional cookies to remember your preferences. We do not use advertising or cross-site tracking cookies.

You can manage cookie preferences through your browser settings or our in-app cookie preferences panel.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. If you believe we have collected such information, please contact us at [email protected].

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by:

• Sending an email to the address associated with your account at least 14 days before changes take effect
• Posting a prominent notice on our website and in-app dashboard
• Updating the "Last updated" date at the top of this policy

Your continued use of our services after the effective date of an updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using our services and contact us to close your account.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: