Privacy Policy

Effective September 22, 2026. This policy explains what Quote and Sign collects, why, and what you can do about it. It is written to meet Canada's PIPEDA, the EU and UK GDPR, and the California CCPA. The service is operated by Quote and Sign, based in Ontario, Canada, which is the controller of the data described here (except your clients' data in your proposals, where you are the controller and we act for you under the Data Processing Addendum). A designated Privacy Officer is accountable for this policy and can be reached through the contact form; their name and a postal address are provided on request.

Who this covers

• Account holders: people who sign in and send proposals.
• Recipients: people who open a proposal link, ask a question, decline or accept.
• Visitors: people who read the homepage.

What we collect and why

Account holders

• Email address, to sign you in with a one-time link and to send you service emails such as "your proposal was opened".
• Business name, color, logo, page style, payment link and team email addresses, to put on your proposals.
• Your proposals: the text, prices, client names and client email addresses you enter.
• Billing status from our payment provider (which plan, whether it is active). Card details never reach us.
• A security log of sign-ins, sends and account changes, with a hashed IP address, kept 12 months. When an account is created through another member's referral link, the hashed address of the sign-up is compared with that member's recent sign-ins so that a person cannot refer themselves.
• If you tick the product-news box when signing up (it is unticked by default), or turn it on later, we record that choice with the time and a hashed IP address, and send you occasional product emails (a few a year). Every one has an unsubscribe link, and the setting is under Settings, Notifications.
• Messages you send through the contact form, with the email address you give, so we can reply.

Recipients

• When a proposal is opened: the time, a hashed IP address, the browser type and country, and how long each section stayed on screen. The sender sees counts and timings, never your IP address. These records belong to the proposal and are deleted with it.
• When you ask a question or decline: the name, email and message you type, sent to the sender.
• When you accept: the name you type, your email address, the time, your IP address and browser, the options you chose and the consent sentence you agreed to. This is the acceptance record. It exists to prove who agreed to what and when, and is shared with the sender and emailed to you. Your IP address is kept in the record because it is part of that proof.

Visitors

Our hosting provider keeps short-lived server logs (IP address, page requested, time) to run the network and stop attacks. On the public pages (the homepage, sign-in, contact and these legal pages) we may also use Google Analytics, but only after you allow it in the cookie notice. If you allow it, Google receives the pages you view, a shortened IP address, and a browser identifier stored in a cookie; we use it to see which pages help people. Google's handling of that data is described in Google's privacy policy. Proposal pages your clients open never carry Google Analytics. No advertising trackers anywhere.

Cookies

Strictly necessary: one cookie keeps you signed in, and one remembers a proposal password you entered. Neither tracks you across sites. Your theme choice is stored in your browser only.

Attribution: if you arrive through a referral or partner link, or an advertisement of ours, a cookie remembers that code or the ad's channel name for 30 days so that, if you create an account, the account can be credited to the person or organisation that referred you, any extra trial days can be applied, and we can tell which channels bring people in. It holds only the code or channel name, never an identifier, is not shared with anyone, and is read only when you request a sign-in link. Separately, we count how many visits arrive through each of our links per day as a plain number, with nothing about the visitor, so we know which channels work. Partners see counts and amounts, never your name or email.

Analytics, only with your consent: if you click Allow in the cookie notice, Google Analytics sets its cookies (names beginning with _ga) for up to two years. Click Decline and none are set. You can change your mind at any time using the "Cookie settings" link at the bottom of any public page, or by clearing cookies for this site.

Legal bases (GDPR)

• Performance of a contract: providing the service to account holders.
• Legitimate interests: security logs, fraud prevention, the acceptance record, service emails.
• Consent: nothing is sent to you for marketing without it. You can withdraw consent at any time.
• Legal obligation: keeping records where the law requires.

Webhooks you set up

Business accounts can give us one web address to notify when a proposal is sent, opened, accepted, declined or countersigned. The message carries the proposal's id, title, client name, currency, total and timestamps, signed so the receiver can verify it came from us. It never carries the client's email address, the proposal content or any IP address. The receiving service is yours: you choose it, you are responsible for it, and you can switch the webhook off or remove it at any time under Settings.

The Clockify add-on

If you install our add-on from the Clockify Marketplace and connect it to your account, Clockify (operated by CAKE.com Inc.) gives us a token for your workspace, which we store encrypted and use only to act on your instruction. When a proposal is accepted we send Clockify the proposal's title, the client's name, the names, quantities and amounts of the accepted lines, the currency, and a link to the signed proposal. We never send the client's email address, the proposal content or any IP address. We receive from Clockify your workspace's id and name, the id of the person who installed the add-on, and your add-on settings. Clockify is your provider, not our subprocessor; its own privacy policy covers what it does with the data. Disconnect at any time from Settings, Advanced or from the panel inside Clockify; uninstalling the add-on deletes the token and the sync history on our side. We are responsible for this processing, not CAKE.com.

Signing in with Google (optional)

You can sign in with your email code or, where it is offered, with "Continue with Google". If you choose Google, Google learns that you are signing in to Quote and Sign, and the Google sign-in button and window are loaded from Google's servers, under Google's privacy policy. Google then sends us a signed note with your email address, whether Google has verified it, and your name and profile picture. We check the note and keep only the email address, which becomes your account email exactly as if you had typed it. We do not keep your name, picture or Google account id, we get no access to your Gmail, contacts or files, and we never post anything to Google. If you would rather Google not know, use the email code instead; both reach the same account. You can remove Quote and Sign from your Google account's connected apps at any time.

Who else sees data

We use three service providers for the product and no others: Cloudflare (hosting, database, image storage and network security; data is encrypted at rest and in transit), Polar (payments; they see your email and billing details), and Resend (email delivery; they see the addresses and content of emails we send). Google (Google Analytics) receives data only from visitors to the public pages who clicked Allow, and never anything from proposals or accounts. We do not sell personal information and we do not share it for advertising. We disclose data when the law requires it or to protect people from harm, and we will tell you if we lawfully can.

Where data lives

Our infrastructure runs on Cloudflare's global network; data may be stored and processed in Canada, the United States and the EU. Transfers out of the EU and UK rely on standard contractual clauses held by our subprocessors.

How long we keep it

• Drafts and unsigned proposals: until you delete them or your account.
• Signed proposals and acceptance records: as long as either party may need them, because they are the proof of an agreement. When an account is deleted, signed records stay readable at their links with the sender's contact details removed.
• Sign-in links: 15 minutes. Sessions: 30 days. Security logs: 12 months. Rate-limit counters: 24 hours. Expired rows are removed by a nightly job.
• Contact form messages: 12 months after the conversation closes.
• Encrypted backups: 60 days, then removed. Anything you delete is out of every backup within that time.
• Deleted accounts: your email address, name, logo and notification addresses are erased at once. An anonymous stub of the account remains only so that signed proposals keep working for your former clients.
• Emails sent through Resend: per Resend's retention, typically 30 days of logs.

Your rights

You can access, correct, export or delete your data. Account holders can do all of this from the Settings page: export everything as one file, or delete the account with a code we email you. Recipients, and anyone else, can ask through the contact form what we hold about them and have it corrected or deleted; we may ask you to confirm the email address the request is about. We answer within 30 days and never charge for it. Nothing changes in how we treat you for exercising a right. You may also complain to your privacy regulator: in Canada the Office of the Privacy Commissioner, in the EU your national authority, in the UK the ICO.

Security

Passwordless sign-in, encryption at rest and in transit, nightly encrypted backups, unguessable proposal links, optional link passwords and expiry, rate limits, strict content security policies, and uploads limited to images checked by content. No system is perfectly secure; if a breach creates a real risk of significant harm we will notify affected people and the regulator as soon as feasible, and in any case within 72 hours of confirming it where the GDPR applies.

Children

The service is for business use by adults. We do not knowingly collect data from anyone under 18.

Changes

We will post changes here with a new effective date and email account holders about material changes.

Contact

The Privacy Officer, Quote and Sign, through the contact form. The officer's name and a postal address are provided on request.