Privacy Notice

1. Who we are and how to contact us

PROQUOTAR LTD (company number 16948546) is the data controller for the ProQuotar website, web app and installed (PWA) app. Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under registration number ZC076585 (renewal due 7 January 2027).

Privacy contact: support@proquotar.com. We do not have a statutory Data Protection Officer; the privacy contact handles all data-protection questions and rights requests.

2. When we are the controller and when we are a processor

ProQuotar is built for UK trade businesses. That means personal data reaches us in two different ways:

• We are the controller for the data of people who hold or use a ProQuotar account (business owners and their staff), for website visitors, for our own billing and support records, for in-app usage events, for website analytics and for the merchant partner sharing you consent to.
• We are a processor when a business enters information about its customers, callers, suppliers or staff into ProQuotar — for example a homeowner's name and address on a quote, a caller's number captured by the AI Call Assistant, or a staff member's clock-in time. The business is the controller and decides why that data is used; we process it only to provide the service under our Terms of Service. If you are one of those people and have a question about your data, please contact the business first — we will help them respond.

3. The personal data we collect

• Account and identity: name, email address, password (stored only as a bcrypt hash), business name, phone, business address, website, VAT number, logo and quote/invoice branding, MKM trade account number if you give one.
• Bank details for your invoices: bank name, account name, sort code and account number, if you choose to print them on invoices.
• Subscription and billing: plan, subscription status, Stripe customer reference. Card numbers are entered on Stripe-hosted pages and are never seen or stored by ProQuotar.
• Business records you create: customers, enquiries, jobs, quotes, invoices, receipts, suppliers, materials lists, photos, documents and notes.
• Team data: staff names, emails, roles, permissions, assigned jobs, clock-in/out entries and one location fix at clock-in/out if location access is allowed, tasks, rota and team-chat messages.
• Communications: emails and SMS sent through ProQuotar, support emails and in-app issue reports, push-notification subscriptions.
• Connected accounts: Google or Microsoft OAuth tokens and the connected email address when you link a calendar or mailbox.
• AI Call Assistant (optional add-on): your business number, caller numbers and call transcripts. Audio recording is off by default.
• Technical, security and audit data: IP address and browser user-agent recorded when you accept our Terms; legal-acceptance and account-status audit records; server logs; Cloudflare security cookies.
• Usage and analytics (see section 8): in-app usage events; and, only with your consent, PostHog and Microsoft Clarity analytics, first-party A/B test identifiers and UTM attribution.

We do not ask for, and you should not enter, special-category data (such as health or ethnicity) or criminal-offence data.

4. How we collect it

• Directly from you when you register, complete your business profile, create quotes, jobs and invoices, invite staff, connect integrations or contact support.
• From your use of the service — sign-in times, features used, session length, AI requests, and the technical data our servers and Cloudflare log.
• From your customers and callers when they accept a quote link, submit an enquiry through a form you embed on your website, or call your AI Call Assistant number.
• From merchant partners — if you sign up through an MKM branch link or QR code we record the branch that referred you.
• From third-party services you connect — Google and Microsoft return your calendar email address and access tokens.

5. Why we use it and our lawful bases

• To provide the service you signed up for — running your account, generating quotes, jobs and invoices, sending quotes to your customers, syncing calendars, taking payments. Lawful basis: performance of a contract (Art. 6(1)(b)).
• To keep records the law requires — tax and accounting records for subscription payments, evidence that you accepted our Terms. Legal obligation (Art. 6(1)(c)).
• To run, secure and improve ProQuotar — server logs, security monitoring, in-app usage events, onboarding tips and reports by email (with unsubscribe). Legitimate interests (Art. 6(1)(f)) — you can object at any time.
• To provide the MKM-connected service — sharing the minimum materials-opportunity information with your selected MKM branch. This is a required, defining feature of the service: every trade-owner account must actively accept it before using the application, it is not marketing or cookie consent, and declining means the MKM-connected service cannot be used. You can stop future sharing by deactivating MKM-connected access in Account → Privacy. Performance of a contract (Art. 6(1)(b)).
• Where you opt in — website analytics (PostHog, Clarity, A/B testing, attribution), in-app usage analytics, marketing measurement (Meta Pixel, if ever enabled) and browser push notifications. Consent (Art. 6(1)(a)) — withdraw at any time as described in section 12.

6. Processing activities in detail

The table below lists each category of data, why we use it, the lawful basis, who receives it and how long we keep it.

• Account data — name, email, password (bcrypt hash), business name, phone, address, website, VAT number, logo, quote/invoice branding

  Purpose

  Create and run your account; brand your quotes and invoices; sign you in

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b))

  Recipients

  ProQuotar; Microsoft Azure / MongoDB Atlas (hosting)

  Retention

  While your account is active. Deleted when you delete your account (immediate) or 90 days after a suspension notice if you do not act.

• Bank details you enter for invoices — bank name, account name, sort code, account number

  Purpose

  Printed on the invoices you send to your customers

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b))

  Recipients

  ProQuotar; your customers (on invoices you send)

  Retention

  While your account is active; deleted with your account.

• Subscription and billing — Stripe customer ID, plan, subscription status, payment history

  Purpose

  Take subscription payments, manage your plan and add-ons, handle failed payments

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) for tax and accounting records

  Recipients

  Stripe (payment processor — card details are entered on Stripe-hosted pages and never stored by ProQuotar)

  Retention

  Accounting, company-tax and VAT records are kept for six years from the end of the relevant financial year, or longer where legally required. This six-year rule applies only to those records.

• Business records you create — customers, enquiries, jobs, quotes, invoices, receipts, suppliers, materials lists, photos, documents, notes

  Purpose

  Provide the quoting and job-management service you use to run your business

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)). For your customers’ details you are the controller and ProQuotar processes them on your instructions.

  Recipients

  ProQuotar; Microsoft Azure / MongoDB Atlas; your customers (when you email or share a quote/invoice)

  Retention

  While your account is active; deleted with your account. Quotes marked lost/rejected are automatically purged 30 days after rejection.

• Staff and team data — staff names, emails, roles, permissions, assigned jobs, clock-in/out entries, tasks, team chat messages

  Purpose

  Let business owners manage their team, rota and time on site

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)). The business owner is the controller of their staff’s data; ProQuotar acts as processor.

  Recipients

  ProQuotar; the business owner who invited the staff member

  Retention

  While the owner’s account is active; deleted with the owner’s account.

• Staff location — one GPS fix (latitude/longitude) when a staff member clocks in or out of a job or answers an arrival prompt, if they allow location access in their browser

  Purpose

  Confirm time on site and show the owner where work started and finished

  Lawful basis (UK GDPR Art. 6)

  Contract with the business (Art. 6(1)(b)) — the business owner is controller and is responsible for informing staff. Nothing is captured if location permission is refused.

  Recipients

  ProQuotar; the business owner

  Retention

  Stored with the time log while the owner’s account is active. Retained only for as long as required for the stated purpose and applicable legal obligations.

• AI estimating inputs — job descriptions, room dimensions, materials lists, receipt images, scope text you submit to AI features

  Purpose

  Generate material lists, labour estimates, quote wording and follow-up drafts

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b))

  Recipients

  Anthropic (Claude models) and Google (Gemini, bill-of-materials only) via a managed AI gateway; Perplexity (live merchant web-price look-ups — product names only, no personal data)

  Retention

  Prompts are processed to return a result; AI-generated outputs are stored with your quote or job. Retained only for as long as required for the stated purpose and applicable legal obligations.

• Emails we send you — welcome, onboarding tips, quote follow-up reminders, deletion warnings, P&L and week-in-review reports, partner surveys

  Purpose

  Deliver the service and help you get value from it

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)) for service messages; Legitimate interests (Art. 6(1)(f)) for onboarding tips and reports — you can unsubscribe at any time

  Recipients

  Resend (email delivery)

  Retention

  Delivery logs are held by Resend under its own terms. Retained only for as long as required for the stated purpose and applicable legal obligations.

• Quote emails and SMS to your customers — customer name, email/phone, quote link and message

  Purpose

  Send quotes, follow-ups and acceptance links to your customers on your instruction

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)) — you are the controller of your customers’ details

  Recipients

  Resend (email); Twilio (SMS, only if you use SMS follow-ups); your customer

  Retention

  Stored with the quote while your account is active.

• Connected accounts — Google Calendar and Microsoft 365 OAuth tokens and the calendar email address; Gmail/Outlook sending credentials if you connect them

  Purpose

  Sync scheduled jobs to your calendar; send quotes from your own email address

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)) — you choose to connect

  Recipients

  Google; Microsoft

  Retention

  Until you disconnect the integration in Account → Settings, when tokens are deleted.

• AI Call Assistant (optional add-on) — your business phone number, caller phone numbers, call transcripts (audio recording is off by default)

  Purpose

  Answer calls and take messages for your business when you cannot

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)) — you are the controller of your callers’ data

  Recipients

  Vapi (voice AI); Twilio (telephony)

  Retention

  Transcripts are stored while the add-on is active. Retained only for as long as required for the stated purpose and applicable legal obligations.

• Push notification subscriptions — browser push endpoint and keys

  Purpose

  Send reminders (quote follow-ups, clock-out, morning brief) if you enable notifications

  Lawful basis (UK GDPR Art. 6)

  Consent (Art. 6(1)(a)) via your browser permission prompt

  Recipients

  Your browser’s push service (Google, Apple or Mozilla)

  Retention

  Until you disable notifications or the subscription expires.

• MKM branch materials-opportunity sharing — your trade/business identity and business contact details, selected MKM branch, materials on accepted quotes (name, quantity, unit, SKU, material value), anticipated requirement date, postcode district only (e.g. TQ3), opportunity status, and "materials list copied/prepared" notifications

  Purpose

  Required feature of the MKM-connected service: lets your selected MKM branch prepare for and assist with potential materials orders

  Lawful basis (UK GDPR Art. 6)

  Performance of a contract (Art. 6(1)(b)) — you actively accept this condition before using the application; it is not marketing or cookie consent and cannot be switched off while the MKM-connected account is active. Declining means the MKM-connected service cannot be provided.

  Recipients

  Your selected MKM branch only. MKM head office receives aggregated reporting (totals, trends, product gaps, postcode-district summaries), not individual builder or customer records.

  Retention

  Sharing stops immediately when you deactivate MKM access. Opportunity records (including the branch contact log) are irreversibly anonymised 12 months after the opportunity closes or after its last activity, whichever is later; open opportunities with no activity for 12 months are anonymised too. Only non-identifying aggregate statistics remain. Account deletion anonymises your opportunity records immediately. Information already shared may remain with MKM where it has a lawful reason to retain it.

• In-app usage events — sign-in times, features used, session start/end and duration, enquiries submitted, partner branch

  Purpose

  Improve the product and, for partner trials, report activity to your branch

  Lawful basis (UK GDPR Art. 6)

  Consent by affirmative opt-in (Art. 6(1)(a)) — OFF by default; switch on or off at any time in Account → Privacy → Usage analytics. Switching off stops further optional events immediately

  Recipients

  ProQuotar; activity level shown to your MKM branch only where you have opted in

  Retention

  Retained only for as long as required for the stated purpose and applicable legal obligations.

• Website analytics — PostHog events, Microsoft Clarity heatmaps and interaction data, first-party A/B test variant and visitor ID (ab_variant, ab_visitor_id), UTM/landing-page attribution, CTA and sign-up conversion events

  Purpose

  Understand how the website is used, test page variants and measure marketing effectiveness

  Lawful basis (UK GDPR Art. 6)

  Consent (Art. 6(1)(a)) — Analytics consent in the cookie banner; nothing runs before you opt in

  Recipients

  PostHog (US); Microsoft Clarity; ProQuotar (A/B and UTM data has no third-party recipient). Google Analytics 4 is currently inactive.

  Retention

  Browser storage is removed when you withdraw consent (see Cookie Notice). PostHog and Clarity retain event data under their own terms.

• Marketing measurement — Meta Pixel

  Purpose

  Measure advertising effectiveness

  Lawful basis (UK GDPR Art. 6)

  Consent (Art. 6(1)(a)) — Marketing consent in the cookie banner

  Recipients

  Meta — currently inactive unless a Pixel ID is configured

  Retention

  Not currently collected.

• Security and audit logs — IP address and browser user-agent at Terms acceptance, legal-document acceptance records, account suspension/deletion audit entries, application logs

  Purpose

  Prove acceptance of Terms, investigate security incidents, keep the service running

  Lawful basis (UK GDPR Art. 6)

  Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c)) where records are needed to evidence consent or acceptance

  Recipients

  ProQuotar; Microsoft Azure (hosting and logs); Cloudflare (edge security)

  Retention

  Legal acceptance records are kept for as long as needed to evidence the agreement. Retained only for as long as required for the stated purpose and applicable legal obligations.

• Support communications — emails you send to support@proquotar.com and issue reports you submit in the app

  Purpose

  Answer your questions and fix problems

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f))

  Recipients

  ProQuotar; Resend / ImprovMX (email delivery and forwarding)

  Retention

  Retained only for as long as required for the stated purpose and applicable legal obligations.

• Postcode and address look-ups — postcodes you type into address fields; job addresses for route planning

  Purpose

  Auto-complete addresses and plan routes between jobs

  Lawful basis (UK GDPR Art. 6)

  Contract (Art. 6(1)(b))

  Recipients

  postcodes.io (UK postcode data); OpenRouteService and OpenStreetMap Nominatim (route planning, addresses only)

  Retention

  Not stored by the look-up providers beyond the request; results are saved with your job.

7. AI features and automated decision-making

ProQuotar uses AI models (Anthropic Claude, and Google Gemini for bill-of-materials extraction) to suggest materials, labour estimates, quote wording and follow-up messages from the job details you enter. Perplexity is used to look up live merchant prices for material names only. AI outputs are suggestions for you to review and edit; they are not decisions about any individual.

We do not make solely automated decisions that have legal or similarly significant effects on you or your customers(UK GDPR Article 22). Account suspensions and deletions are actioned by people. A/B test variants are assigned at random and only change which version of a marketing page you see.

8. Analytics, A/B testing, attribution and marketing

• In-app usage events (features used, navigation, session duration) are off by default and recorded only if you switch on "Usage analytics" in Account → Privacy. Switching it off stops further optional events immediately. Essential sign-in, security and audit logs are separate and are not optional analytics.
• PostHog product analytics loads only after you give Analytics consent in the cookie banner. Session replay is disabled.
• Microsoft Clarity heatmaps and interaction analysis load only after Analytics consent.
• First-party A/B testing and attribution — ab_variant, ab_visitor_id, UTM parameters, landing page and referrer, plus page-view, call-to-action and sign-up conversion events — are analytics. They are created only after Analytics consent, have no third-party recipient, and are deleted when you withdraw consent.
• Google Analytics 4 is currently inactive; it only runs if a measurement ID is configured and then only with Analytics consent.
• Meta Pixel is currently inactive; it only runs if a Pixel ID is configured and then only with Marketing consent.

9. Who we share data with

We never sell personal data. We share it only with the service providers (processors) below, with your selected MKM branch as a required part of the MKM-connected service (minimum fields only — see section 6; branches see opportunities for their own branch, head office receives aggregated reporting), with your own customers when you send them documents, and with authorities where the law requires.

• Microsoft Azure

  What they do for us

  Application hosting (App Service), logs

  Location

  United Kingdom (UK South)

  Privacy information

  Microsoft privacy statement

• MongoDB Atlas

  What they do for us

  Primary database

  Location

  United Kingdom (Azure London / UK South)

  Privacy information

  MongoDB privacy policy

• Cloudflare

  What they do for us

  DNS, edge security, bot protection for proquotar.com

  Location

  Global edge network

  Privacy information

  Cloudflare privacy policy

• Stripe

  What they do for us

  Subscription payments and hosted checkout

  Location

  United States / Ireland

  Privacy information

  Stripe privacy policy

• Resend

  What they do for us

  Transactional email delivery

  Location

  United States

  Privacy information

  Resend privacy policy

• ImprovMX

  What they do for us

  Email forwarding for partner @proquotar.com aliases

  Location

  European Union

  Privacy information

  ImprovMX privacy policy

• Anthropic

  What they do for us

  Claude AI models for estimating, quote wording and follow-up drafts (via a managed AI gateway)

  Location

  United States

  Privacy information

  Anthropic privacy policy

• Google

  What they do for us

  Gemini model (bill-of-materials extraction); Google Calendar and Gmail when you connect them

  Location

  United States / global

  Privacy information

  Google privacy policy

• Perplexity

  What they do for us

  Live merchant web-price look-ups (material names only)

  Location

  United States

  Privacy information

  Perplexity privacy policy

• Twilio

  What they do for us

  SMS quote follow-ups and telephony for the AI Call Assistant

  Location

  United States

  Privacy information

  Twilio privacy notice

• Vapi

  What they do for us

  Voice AI for the optional AI Call Assistant add-on

  Location

  United States

  Privacy information

  Vapi privacy policy

• Microsoft

  What they do for us

  Microsoft 365 calendar / Outlook when you connect them; Microsoft Clarity analytics (consent)

  Location

  United States / European Union

  Privacy information

  Microsoft privacy statement

• PostHog

  What they do for us

  Product analytics (Analytics consent only; session replay disabled)

  Location

  United States

  Privacy information

  PostHog privacy policy

• Meta

  What they do for us

  Meta Pixel — currently inactive unless configured (Marketing consent only)

  Location

  United States

  Privacy information

  Meta privacy policy

• postcodes.io

  What they do for us

  UK postcode look-up

  Location

  United Kingdom

  Privacy information

  postcodes.io about

• OpenRouteService / OpenStreetMap

  What they do for us

  Route planning and address geocoding

  Location

  Germany (EU)

  Privacy information

  OpenRouteService privacy policy

Google user data obtained through Google Calendar or Gmail is used only to provide the feature you connected, in line with the Google API Services User Data Policy, including its Limited Use requirements.

10. Where your data is stored and international transfers

The ProQuotar application is hosted on Microsoft Azure (UK South region) and our primary database is MongoDB Atlas hosted on Microsoft Azure, London / UK South, so your account and business records are stored in the United Kingdom (UK South / London).

Some providers in section 9 (for example Stripe, Resend, Anthropic, Perplexity, Twilio, Vapi, PostHog, Microsoft Clarity and Cloudflare's global network) process data in the United States or elsewhere outside the UK. Where that happens we rely on the safeguards permitted by UK GDPR — the provider's standard contractual terms incorporating the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations where the destination is covered. You can ask us for details of the safeguard used for a particular provider. (Internal confirmation pending: the executed UK IDTA / UK Addendum or other transfer safeguard for each applicable overseas provider.)

11. How long we keep data, and account deletion

• While your account is active we keep the data needed to run it.
• Delete your account yourself from Account → Danger Zone. This immediately deletes your user record and your jobs, quotes, invoices, materials, staff records, receipts, clock entries and to-dos from the live database.
• Suspended accounts (for example by a partner branch or administrator) stay in a read-only, export-only state for 90 days with warnings at 60, 30 and 7 days; if not reactivated they are permanently deleted by a daily process.
• Lost or rejected quotes are automatically purged 30 days after rejection.
• Sign-in sessions expire after 30 days.
• Inactive accounts: a scheduled clean-up can remove accounts that never subscribed after 90 days or cancelled more than 180 days ago; it runs only where the ENABLE_AUTO_DB_CLEANUP setting is switched on (internal confirmation pending for the production setting).
• MKM opportunity records: a daily job irreversibly anonymises opportunities 12 months after closure or last activity (whichever is later), and open opportunities after 12 months of inactivity — including the branch contact log. Anonymised aggregate statistics (branch, status, value, postcode district, month) remain. Deleting your account anonymises your opportunity records immediately.
• Legal-record exceptions: accounting, company-tax and VAT records are kept for six years from the end of the relevant financial year, or longer where legally required — this applies only to those records, not to customers, jobs, analytics, location or opportunity data. Records that evidence your acceptance of our Terms and of the MKM data-sharing condition are kept for as long as needed to evidence the agreement. Copies may persist in database backups for a limited period before they are overwritten (backup retention settings: confirmation pending).
• Anything not listed is retained only for as long as required for the stated purpose and applicable legal obligations.

12. Your rights under UK GDPR

You have the right to:

• Access: ask for a copy of the personal data we hold about you (you can also download a JSON export from Account → Privacy → Export my data).
• Rectification: ask us to correct inaccurate or incomplete data — most account details can be edited directly in Account.
• Erasure: ask us to delete your data. You can delete your account yourself from Account → Danger zone; see section 11 for what is kept.
• Restriction: ask us to pause processing of your data while a query is resolved.
• Objection: object to processing based on legitimate interests, for example onboarding emails (unsubscribe link) and server-side security logging where not legally required.
• Portability: receive the data you gave us in a machine-readable format — the JSON export and the CSV exports for jobs, quotes, invoices and customers.
• Withdraw consent: withdraw any consent at any time: cookie consent via "Cookie settings", usage analytics in Account → Privacy, push notifications in your browser. MKM sharing is a contractual condition rather than consent — you end it by deactivating MKM-connected access in Account → Privacy. Withdrawal does not affect processing that already took place.

To make a request, email support@proquotar.com from the address on your account (or tell us how to verify who you are). We respond within one month; if a request is complex we may extend by up to two further months and will tell you why. There is normally no fee.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to resolve your concern first.

13. How we protect your data

• All traffic between your browser and ProQuotar is encrypted with HTTPS/TLS, fronted by Cloudflare's security and bot protection.
• Passwords are stored only as bcrypt hashes; we cannot read them. Sign-in uses expiring, signed session tokens.
• Connected-mailbox credentials are stored encrypted in our database. Card details never touch our systems (Stripe-hosted checkout).
• Access is role-based: staff see only the jobs assigned to them; branch and head-office dashboards see only what you have consented to share.
• Hosting and database services are provided by Microsoft Azure and MongoDB Atlas in the UK, with access limited to the people who need it.

No system can be guaranteed completely secure. If we become aware of a personal-data breach that is likely to put you at risk we will tell you and the ICO as UK GDPR requires. We do not claim any external security certification.

14. Children

ProQuotar is a business tool for UK trades and is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email support@proquotar.com and we will delete it.

15. Changes to this notice

We will update this page and its version number whenever our processing changes. If a change materially affects you we will tell you by email or in the app before it takes effect. The version history is kept in our legal document register.

Related: Cookie Notice · Terms of Service