Data Processing Addendum

Effective September 22, 2026. This addendum applies when you, an account holder, use Quote and Sign to process personal data of your clients and the GDPR, UK GDPR or a similar law makes you the controller and us the processor. It forms part of the Terms of Service. No signature is needed; it applies automatically.

1. Roles

You are the controller of the personal data in your proposals and of your recipients' data. We are the processor. For our own account data (your email, billing status, security logs) we are the controller and the Privacy Policy applies.

2. Details of processing

• Subject matter: hosting, sending and recording acceptance of proposals.
• Duration: the life of your account, plus the retention of signed records described in the Privacy Policy.
• Nature and purpose: storage, display to recipients, email delivery, PDF generation, engagement counts, acceptance records.
• Data subjects: your clients and the people who open your proposals.
• Categories of data: names, email addresses, business details, prices and terms, IP addresses and browser details of recipients, typed signatures.

3. Our obligations

• Process personal data only on your documented instructions, which are the Terms and your use of the product features, unless the law requires otherwise, in which case we tell you first where we may.
• Keep the data confidential and ensure anyone with access is bound by confidentiality.
• Apply the security measures in section 8 below, and not reduce them during the term.
• Help you respond to data subject requests: the product lets you export and delete, and we assist with the rest within 30 days.
• Tell you without undue delay, and within 72 hours, if we become aware of a personal data breach affecting your data, with the information you need for your own notifications.
• Delete or return the data at the end of the service: you can export everything yourself first, and deleting the account removes it at once from the live system and within 60 days from encrypted backups. Signed records that protect both parties to an agreement, and data under a legal hold, are the only exceptions.
• Make available the information needed to show compliance and allow audits, at your cost and on reasonable notice, no more than once a year unless a regulator requires otherwise.

3a. Webhooks

If you configure a webhook, the messages we send to your chosen address (proposal ids, titles, client names, amounts and timestamps) are sent on your instruction. The receiver is your processor, not our subprocessor, and you are responsible for it.

3b. The Clockify add-on

If you connect the Clockify add-on, what we send to your Clockify workspace (proposal titles, client names, line names, quantities, amounts, currency and a link to the signed proposal) is sent on your instruction. Clockify is your processor, not our subprocessor, and you are responsible for it.

4. Subprocessors

You authorise the subprocessors listed in the Privacy Policy: Cloudflare, Polar and Resend. Google Analytics, when enabled, processes only our own visitor data on the public pages and never your proposals or your clients' data, so it is not a subprocessor under this addendum. We will email account holders at least 14 days before adding a new one; you may object, and if we cannot resolve it you may close your account and export your data.

5. International transfers

Data may be processed in Canada, the United States and the EU. Canada holds an EU adequacy decision for PIPEDA-covered organisations. Transfers to the United States rely on standard contractual clauses in our subprocessors' agreements.

6. Liability

Liability under this addendum is subject to the limitations in the Terms of Service, to the extent the applicable law allows.

7. Contact

The Privacy Officer, Quote and Sign, through the contact form.

8. Security measures

• All traffic over TLS; data encrypted at rest by the hosting provider.
• No passwords to steal: sign-in by one-time emailed links that expire in 15 minutes, sessions that expire after 30 days.
• Every read and write is scoped to the signed-in account; proposal pages use unguessable links, with optional passwords and expiry dates set by you.
• Uploads limited to images, checked by content, size-limited, and served with a policy that stops them running as code.
• Strict content security policy, security headers, and rate limits on sign-in, sending and acceptance.
• Recipients' IP addresses are stored only as keyed hashes, except in the acceptance record where the address itself is the evidence.
• A security log of sign-ins and changes, kept 12 months.
• Nightly encrypted backups kept 60 days; a removed backup leaves history as well.
• Access to production limited to the operator, with the source code public for review under the AGPL.