Privacy Policy

01

Who we are

Quote Stack is the trading name under which this service is operated. Quote Stack is the data controller for the personal data described in this policy: the party legally responsible for deciding how and why it's processed.

Contact for anything privacy-related: quotestack@outlook.com. This inbox is monitored and we aim to reply within a few working days.

The full registered legal identity of the operator behind Quote Stack is available on request via that inbox. We're in discussion about registering with the Information Commissioner's Office (ICO), which is required for any UK organisation processing personal data at this scale, and we'll complete that registration before we move beyond the current beta to a general commercial launch. Our ICO registration reference, and the registered legal identity it's held under, will be added here once that's done.

02

What Quote Stack actually does, in plain terms

A contractor tells us what building materials they need, for which job, and by when. We email that request, on the contractor's behalf, to building merchants and suppliers who are likely to stock it. When a supplier replies, we read that reply, including any attached PDF quote, and pull out the prices and line items so we can show them to the contractor side by side and help them pick the best deal. That's the whole product. The two main groups whose data we handle are contractors (our users) and suppliers (the merchants we email on their behalf). A third, smaller group is anyone who submits an enquiry through the contact form on our website — we hold their name, email, phone number and message to respond to them, nothing more.

03

Data we collect for contractors

If you sign up and use Quote Stack as a contractor, we hold:

• Account data: your name, email address, phone number and password you sign up with, handled by our authentication provider. We never see your raw password.
• Business details: company name, VAT registration status, the name you want RFQs sent under (or a note that you'd rather stay anonymous to suppliers), invoicing email, business address and postcode, a logo or avatar if you upload one.
• Billing data: your subscription plan and status and trial dates, plus a reference to your payment record held by Stripe, our payment processor — we don't collect or store your card details ourselves (see section 06).
• Job and order data: site addresses and postcodes, the materials and quantities you request, delivery or collection preference, needed-by dates, your own reference codes and notes, any drawings or spec sheets you attach to a request.
• Quote and purchase data: every quote a supplier sends back against your request, the purchase orders we send out on your instruction, and any invoices you upload or that arrive against an order.
• Preferences: notification settings and marketing opt-in choices, which you control from your profile.

04

Data we collect for suppliers and merchants

We do not ask suppliers to sign up. If you're a builders' merchant or supplier who has received an RFQ from us, here's what we hold about your business:

• Business contact details: your trading name, the email address we send requests to, your postcode and coverage area, your website if public, and the categories of material you're recorded as stocking. Most of this is sourced from a web scrape of publicly available business listings and websites, not given to us directly by you.
• Correspondence: the request for quote (RFQ) email we send you, and the full content of your reply, meaning the email body text and the text of any attached PDF or document. We keep this as a record and as evidence of what you quoted.
• Quote content: the prices, line items, delivery costs, lead times, and terms extracted from your reply, which we show to the contractor who asked for the quote.

Important: we treat this as personal data even where a supplier is set up as a limited company, because we can't always reliably tell from a scrape whether we're dealing with a sole trader, a partnership, or a company, and a sole trader's business contact details count as their personal data under UK GDPR. Applying the stricter standard across the board is a deliberate choice. See our Legitimate Interests Assessment for the full reasoning (available on request).

We do not collect anything about you beyond what's needed to send and process a purchase enquiry. We don't hold your personal life details, and we never ask suppliers for data unrelated to quoting.

05

Why we're allowed to process this data (lawful basis)

Contractor data is processed under contract (UK GDPR Article 6(1)(b)). You've signed up for a service, and we need this data to provide it: there's no service without your job, order, and account details.

Supplier business contact data is processed under legitimate interests (Article 6(1)(f)): ours, the contractor's, and arguably the supplier's own interest in receiving a relevant purchase enquiry for goods they sell. We don't ask suppliers for consent before the first contact, because doing so would be circular: we'd need to contact them to ask permission to contact them. We've written a full three-part Legitimate Interests Assessment covering this, including the arguments against relying on it, at docs/legitimate-interest-assessment.md in our project records, available on request. This lawful basis covers UK GDPR. On the separate question of whether PECR's electronic marketing rules apply to RFQ emails: we don't include a PECR-style opt-out link on RFQs, and instead act on any supplier's request to stop hearing from us reactively, adding them to our permanent suppression list (see section 08).

Where you've opted in to product updates or marketing as a contractor, that specific processing is based on your consent, which you can withdraw at any time from your profile settings.

06

Who we share data with

We use a small number of third-party services to run Quote Stack, grouped below by category. Each is bound by contract to process your data only on our instructions, to provide their service to us, and for no purpose of their own. We'll give you the current list of named providers on request: email quotestack@outlook.com.

• Managed database and authentication providers: host essentially everything described in sections 03 and 04, including contractor accounts, jobs, orders, the supplier directory, quotes, and any files you or a supplier's reply attaches. Our database runs in a UK (London) data region.
• Cloud hosting and application infrastructure providers: host this website and the contractor dashboard, and see the same technical request and traffic data any web host does.
• Background job processing providers: run the automated jobs that send RFQs, chase up suppliers who haven't replied, and process inbound quote emails. They handle the same order and quote data described above while those jobs are running.
• AI language model providers: when a supplier's reply comes in, we send the text of that reply, and the text of any attached PDF quote, to an AI language model provider to extract structured line items and prices. We also send the original list of materials the contractor requested, so the model can match what was asked for against what was quoted. We do not send the contractor's full account or the supplier's full history, just the one reply being parsed, each time. Our AI providers' standard terms confirm that data sent through their business API is not used to train their models.
• Email delivery providers: RFQ emails are sent and received through Resend, our dedicated business email delivery provider, using tokenised addresses so replies match the right request automatically. That means Resend processes supplier email addresses and the full text of RFQ and quote correspondence.
• Payment processing providers: Stripe processes card payments for paid subscriptions and holds your billing and payment-method details on our behalf. We never see or store your card number ourselves.

We do not sell personal data to anyone, and we do not share supplier data with other suppliers or use it for advertising.

07

International transfers

Our core database sits in the UK, hosted with our database provider's London region. Some of the providers listed in section 06, including our AI language model providers, are US headquartered and may process data outside the UK. Where that happens, we rely on the transfer safeguards those providers offer: Standard Contractual Clauses with the UK International Data Transfer Addendum, or an equivalent adequacy mechanism, depending on the provider.

Honestly, at this early stage we haven't yet formally countersigned a Data Processing Agreement with every vendor in section 06. That's on our pre-launch checklist alongside the ICO registration in section 01, and this policy will be tightened once it's done.

08

How long we keep data

• Purchase orders and invoices: kept for 6 years, in line with HMRC record-keeping requirements for business accounts.
• RFQ and quote correspondence (including supplier reply text and attachments): kept while your account is active, so you have a full history of what was quoted and when. Deleted or anonymised on account closure, other than what we're legally required to keep (see above).
• Supplier suppression list: if a supplier asks us to stop contacting them, we keep that record indefinitely. This is the one exception to shorter retention. We keep it precisely so the opt-out is never accidentally lost or overwritten.
• Internal system logs (send and delivery records, AI-parsing quality logs, scrape provenance): kept for as long as needed to run and improve the service, and not used for any other purpose.

We're a small pilot right now, so an account-deletion or data-export request is handled manually rather than by a self-serve button. Email us and we'll action it. See section 11 for timing.

09

Cookies and sessions

The dashboard uses a small number of essential cookies to keep you signed in (set by our authentication provider). We don't run advertising trackers or third-party analytics cookies on this site today. If that changes, we'll update this section and, where required, ask for your consent first.

10

How we keep data secure

• Every database table restricts access so a contractor can only ever read their own jobs, orders, and quotes (Row Level Security).
• Uploaded files (attachments, purchase orders, invoices) sit in private storage and are only ever served back to you through an authenticated request from our own servers, never a public or shared URL.
• Data at rest in our database is encrypted by default.
• Keys that can bypass these protections are held server-side only and are never exposed to a browser.
• Automated decisions: our AI parsing extracts data from a supplier's reply, but it never makes a purchasing decision for you. A human always reviews and chooses before an order is placed, so this processing does not produce a legal or similarly significant automated decision about anyone.

11

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you and get a copy of it (access).
• Ask us to correct inaccurate or incomplete data (rectification).
• Ask us to delete your data, subject to what we're legally required to keep, such as 6-year invoice records (erasure).
• Ask us to limit how we use your data while a query is resolved (restriction).
• Object to processing based on legitimate interests. This applies directly to suppliers whose business contact data we process under section 05. Tell us to stop and we will, and you'll be added to our permanent suppression list.
• Ask for your data in a portable format, where the data is processed by automated means on the basis of contract (portability).
• Withdraw consent at any time for anything based on consent, such as contractor marketing opt-ins.

To exercise any of these, email quotestack@outlook.com. We aim to respond within one month, as required by law. As a small pilot, most requests are actioned faster than that.

12

Complaints

If you're unhappy with how we've handled your data, please talk to us first. We'd rather put it right directly. You also have the right to complain to the UK's independent regulator:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. ico.org.uk/make-a-complaint, or call 0303 123 1113.

13

Changes to this policy

This platform is still being built. We'll update this policy as the product changes, particularly once we complete ICO registration (section 01). Material changes will be flagged to contractor accounts. The date at the top of this page always reflects the latest version.