Privacy Policy

Last updated 22 August 2026

This explains what GGFlows Ltd does with personal data in QuoteBash. It covers two different things, and it's worth being clear which is which:

Your data as our customer — your name, email, what you pay us. We decide what happens to that, so we are the controller of it.
Your clients' data — the names, addresses and phone numbers you put on quotes and invoices. You decide what happens to that. We only hold it because you asked us to, which makes us your processor and you the controller. The Data Processing Agreement covers that relationship.

What we collect, and why

What	Why	Lawful basis
Your email, name and password (hashed, never stored readable)	To give you an account and sign you in	Performance of a contract
Your business details — trading name, address, phone, VAT number, logo	They go on the quotes and invoices you send	Performance of a contract
Your clients' names, addresses, emails, phone numbers and job details	You put them there. We store them so you can raise documents against them	Processed on your instructions — see the DPA
Two-factor secret, if you turn it on	To check your sign-in code. Encrypted at rest	Performance of a contract
Photos and files you attach to a job	You attached them. Location data is stripped on upload	Processed on your instructions
Sign-in times, failed attempts and lockouts	To keep accounts from being broken into	Legitimate interests — securing the service
Billing details	To take payment. Handled entirely by Stripe — we never see or store a card number	Performance of a contract

What we don't do

There is no analytics, tracking or advertising anywhere in QuoteBash. No Google Analytics, no pixels, no session recording.
We don't sell, rent or share your data with anyone for marketing.
We don't use your data, or your clients' data, to train anything.
We don't read your documents. Support can only see your account when you ask us to look at something and we tell you we're doing it.

Cookies

QuoteBash sets three cookies and they are all strictly necessary: one to keep you signed in, one to keep you signed in after you close the browser if you asked it to, and one that stops other websites submitting forms as you. There are no advertising or analytics cookies, so there is nothing here to consent to and no banner asking you to.

Where your data is held

QuoteBash runs on Railway, and this service is currently hosted in US West (Railway). That means your data — including your clients' details — is transferred outside the UK.

That transfer is covered by the standard contractual clauses in our agreement with Railway, together with the UK Addendum, which is the mechanism UK law provides for exactly this. If you would rather your data did not leave the UK, tell us before you sign up — we would rather have that conversation early than after you've put your client book in.

Who else touches it

Only the companies we need to run the service, and only for that. Every one of them is listed, with what they get and why, on the sub-processors page. We'll tell you before that list changes.

How long we keep it

While your account is open: everything stays, because it's your working record.
Documents you delete: they sit in the bin so you can get them back by mistake, and are purged after 90 days.
After you close your account: we keep your records for 6 years, because HMRC expects business records to be retained that long and you may need them. Ask us to erase them sooner and we will — see below.
Backups: kept for 14 days and then overwritten. Data erased from the live system disappears from backups within that window.

What you can ask for

You have the following rights over your own personal data. All of them are free, and we'll answer within one month.

A copy of it. Export screen, or ask us and we'll produce the lot.
To correct it. Most of it you can edit yourself in Settings.
To have it erased. We delete the account, every record in it, and the files on disk, and tell you exactly what went.
To take it elsewhere. The exports are CSV, which opens in anything.
To object, or to restrict what we do with it.
To complain to the regulator. That's the Information Commissioner's Office at ico.org.uk. We'd rather you came to us first, but it's your right either way and you don't need our permission.

[Contact address not yet configured — set PRIVACY_EMAIL.]

If something goes wrong

If there's a breach that puts your data at risk, we report it to the ICO within 72 hours of becoming aware of it, and we tell you directly if it's likely to affect you. We won't sit on it.

Changes

If we change this policy in a way that affects you, we'll email you before it takes effect rather than quietly editing the page. The date at the top always reflects the current version.

GGFlows Ltd.
QuoteBash is a product of GGFlows Ltd. Last updated 22 August 2026.