Privacy Policy
Last updated: 10 September 2026
Who we are
Quomark is a quoting tool for UK tradespeople. We are the data controller for your account and billing information, and the data processor for the customer details you enter into it — those customers are your responsibility and are processed on your instructions. Our Terms of Service set out that relationship, and we offer a data processing agreement to every subscriber.
What data we collect
- Account data: your email address and password (hashed — we never store plaintext passwords).
- Business profile: business name, address, phone, trade type, logo, and VAT details you provide.
- Customer data: names, email addresses, phone numbers and addresses you enter for your customers. You are responsible for having a lawful basis to hold this data.
- Quote data: line items, amounts, and correspondence related to quotes you create.
- Billing data: managed by Stripe. We do not store card details.
Why we collect it
- To provide the quoting service (contract performance).
- To send quote emails on your behalf (legitimate interest / contract).
- To process subscription payments (contract performance).
Who we share it with
- Supabase — database and authentication hosting (EU region).
- Resend — transactional email delivery.
- Stripe — payment processing and card storage (we never see or store full card numbers).
- Vercel — application hosting, in a UK region.
We do not sell your data or your customers' data to any third party.
Sub-processors
These are the companies that process personal data on our behalf. We will give at least 30 days' notice before adding or replacing one, so you can object.
- Supabase — database, authentication and file storage. Hosted in the EU (Frankfurt).
- Vercel — application hosting and serverless functions, pinned to London (UK).
- Stripe — subscription billing, card storage and payment-method management.
- Resend — delivery of transactional email (quotes, reminders, confirmations).
Where a provider processes data outside the UK — Stripe and Resend operate in the United States — we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and we review that transfer before any new provider is added.
Automated reminder emails
If you enable chase reminders, Quomark emails your customer a short reminder on your behalf. Every such email includes an unsubscribe link that we honour permanently for that address.
How long we keep it
We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days.
Customer data you enter is deleted immediately when you delete a customer record, or when you delete your account.
Your rights
Under UK GDPR you have the right to:
- Access a copy of your data — download it yourself from Settings → Your data → Export, or email us at privacy@quomark.co.uk
- Correct inaccurate data (via your business profile settings)
- Delete your data (via Settings → Delete account) — this erases your business profile, customers, quotes, uploaded logo and our payment-provider record
- Object to or restrict processing
- Data portability (the export above is machine-readable JSON)
- Complain to the Information Commissioner's Office (ico.org.uk) — though please raise it with us first so we can put it right
We keep records of when customer data was accessed or exported, so we can account for how personal data is handled.
Cookies
We use one first-party session cookie to keep you logged in. We do not use advertising or tracking cookies.
Security
Data is encrypted in transit and at rest by our providers. Access to customer records is restricted by database row-level security, quote links are unguessable, expire, and can be replaced if one leaks, and card details never reach our servers.
Contact
For any privacy questions or to exercise your rights, email privacy@quomark.co.uk.