PRIVACY NOTICE · VERSION 2026-10-01-1

Privacy notice

Effective 1 October 2026

This notice explains how QuercusQuote Ltd, company number 17427337, registered in England and Wales, of 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“we” or “QuercusQuote”) uses personal data through our website, application, support and subscriptions. We are the controller for account, billing, website and service-administration data.

1. When we act as processor

Arborist businesses may enter information about their customers, employees, contractors and job contacts. For that Customer Data, the subscribing business is normally the controller and we act as its processor, using the data only to provide, secure and support the service and follow lawful documented instructions. Questions about Customer Data should normally be directed first to the business that entered it.

2. Information we collect

• Account data: name, verified email address, identity-provider identifier, business name, role and authentication events.
• Workspace data: business costs, staff and contractor labels, job addresses, specifications, quotes, notes, actual outcomes and uploaded or generated records.
• Derived data: margins, forecasts, cost averages and other results calculated from workspace data.
• Subscription data: plan, billing status, transaction references, tax and invoice information. Our payment provider handles full card details.
• Product feedback: survey answers, ratings, willingness-to-pay responses and feature requests.
• Product-usage data: sign-ins and important in-app actions such as cost setup, quote comparison, quote saving, customer-PDF creation and job review. These records use bounded categories, boolean indicators and counts; they do not include quote values, customer names, addresses, references or free-text workspace content. We do not use third-party advertising trackers for these product analytics.
• Support data: messages, requests and information supplied while resolving a problem.
• Technical and security data: IP address, device and browser information, request times, session records, error logs and security events.
• Website preferences: necessary cookies and, where separately consented to, analytics or marketing preferences.

Please do not enter health, biometric, criminal-offence or other special-category information unless we have expressly agreed that use in writing.

3. How and why we use personal data

Our legitimate interests include operating a reliable B2B software service, protecting accounts, understanding service performance and improving features without overriding individual rights. These are UK lawful bases for our controller activities; applicable local consent and notification requirements also apply. Processor instructions are not a separate controller lawful basis. We collect workspace information from the business using the service and account/technical information from you, identity providers and service interactions.

4. Calculations and automated processing

The service calculates quotes, margins, forecasts and suggestions using values supplied by users and recorded job history. These outputs support human decisions. We do not use them to make solely automated decisions about individuals that produce legal or similarly significant effects.

5. Who receives data

We use vetted providers for:

• cloud hosting, databases, storage, backups and security;
• identity, password recovery and multi-factor authentication;
• subscription payments, invoices and billing administration;
• transactional email, customer support and service monitoring; and
• analytics or marketing only where implemented with appropriate notice and consent controls.

Our current and planned providers are listed in the Subprocessor Schedule. Providers may process data under the relevant contractual arrangements. Some providers, including payment merchants, also act as independent controllers for their legal, fraud-prevention and payment obligations. We may also disclose information where required by law, to protect rights or security, or as part of a business sale or reorganisation subject to appropriate safeguards.

We use Resend to deliver application transactional emails. This involves the recipient email address, the service-message content and delivery metadata. Open and click tracking are disabled for these messages.

6. International transfers

Some providers may process data outside the UK. Where the destination does not benefit from UK adequacy regulations, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism, together with supplementary measures where needed. Contact privacy@quercusquote.app for information about the safeguards relevant to your data and how to obtain a copy. The provider schedule describes the services currently used by QuercusQuote; not every processing operation takes place in the UK or EU.

7. Retention, export and deletion

• Account and live workspace data is retained to operate the account. An unpaid trial workspace is locked at expiry and retained for six months from that expiry date so the owner can subscribe and restore access. If no subscription is completed, advance warnings are sent and the application workspace is deleted at the deadline.
• Workspace owners can export structured workspace data and delete the live workspace from Account. Deletion immediately cancels its subscription, but does not delete the Auth0 sign-in identity, all app access/session records, legal acceptance or external provider records.
• The current browser’s workspace copy is cleared during successful deletion; other devices and downloaded copies are not remotely erased. Application restore points are removed with the workspace. Provider recovery copies age out under the relevant provider’s backup and deletion processes; because those schedules differ, we do not promise one universal expiry period.
• Minimal trial-eligibility, deletion, security, legal-acceptance, suppression and dispute evidence may be retained separately where necessary to prevent repeated trials, demonstrate compliance, protect the service or meet legal duties. It is not used to restore deleted workspace content.
• Billing, tax and transaction records may be retained for up to six years after the relevant financial year or longer where law requires.
• Security and support records are retained only for as long as reasonably needed to provide support, investigate incidents, protect the service, establish or defend legal claims and meet legal duties. The period depends on the record and the circumstances, and records are reviewed and deleted or anonymised when no longer needed.

We may retain minimal records of legal acceptance, account deletion, disputes and suppression preferences where needed to demonstrate compliance or respect an opt-out. Contact privacy@quercusquote.app to request identity erasure or access to information beyond the workspace export. We will explain any retained categories, reasons and applicable retention period or the criteria used to determine it.

8. Security

We use encrypted connections, specialist identity services, secure session cookies, server-side workspace membership checks, tenant separation, access controls and platform-backed backups. Access is limited according to role and operational need. No online service can guarantee absolute security; users must also protect their devices and credentials.

9. Cookies and browser storage

Necessary cookies support authentication, security and session continuity and do not require optional consent. If we add non-essential analytics or advertising cookies, we will explain them and request consent where required before they are set. You can change optional choices through the cookie controls when available.

Our product analytics are recorded on our own service when an authenticated user completes a small set of important product actions. They do not depend on advertising cookies, cross-site tracking or device storage used solely for analytics. The app uses localStorage for the requested device copy of workspace data and preferences. Product-usage records can be linked to user and business identifiers and are not anonymous. We rely on legitimate interests to understand whether core workflows operate effectively and to improve the service, using minimised event data. You may object by emailing privacy@quercusquote.app. We obtain consent before using any optional technology where consent is required.

If you allow website analytics, we may send a free-trial signup event when a new 30-day trial workspace is created, a subscription-scheduled event after Stripe confirms a completed subscription setup with a saved payment method and future first payment, and a first subscription payment event after Stripe confirms a paid invoice. These events do not send your account, payment amount, invoice reference, business, quote or customer details to Google Analytics. We use these events to understand how visitors reach and pay for the service. The Google tag in the app runs only with analytics permission. Preferences are shared between our website and app in the same browser; private windows and other browsers have their own choices. You can change or withdraw that choice through Cookie settings on either the website or app.

With your optional marketing-cookie permission for Google, Google receives advertising cookie and ad-click identifiers, technical browser/network data and events for a completed free-trial signup or confirmed scheduled subscription. Scheduling is not a payment. We send no email address, account identity, payment amount, invoice reference, business, quote or customer/job details in these events. We do not enable personalised advertising or enhanced identity matching. This permission is shared between our website and app, is off by default, and can be withdrawn in the website Cookie settings or the app Cookie settings. Global Privacy Control overrides permission. The preference lasts up to six months; Google's advertising cookies may last up to 90 days. Google may process this data internationally as described above.

Marketing cookies

Marketing cookies help us understand which adverts lead to free trials and subscriptions. They are optional, separate from website analytics, and off until you consent in Cookie settings. You can allow or reject all optional cookies, switch both marketing providers together, or customise Google and OpenAI (ChatGPT) separately. You can change or withdraw either choice at any time. Global Privacy Control keeps both off.

With your permission for OpenAI, our server reports confirmed trial starts, scheduled subscriptions and first paid subscriptions through the OpenAI Conversions API. Scheduling a subscription is not a payment. Each event contains a random event identifier, the time of the confirmed event, our public app URL and an ad-click identifier when available. We do not load an OpenAI tracking script or use automatic identity matching. We do not send your name, email address, account identity, device IP address, browser user agent, payment amount, invoice reference or customer/job records in these events. We mark events to opt out of future user-level personalised advertising. OpenAI also receives the network information inherent in our server-to-server request.

After you consent, our website stores the ad-click identifier supplied in a ChatGPT ad landing URL in the first-party __oppref cookie for up to 30 days. It is shared with our app for server-side conversion reporting. We do not create a separate OpenAI browser-reference cookie. Your provider choices last up to six months. Browser restrictions may shorten cookie lifetimes; these lifetimes are separate from providers’ conversion-data retention periods. Withdrawal stops new conversion reporting and removes the attribution cookie; it cannot recall a request already sent. OpenAI may process data internationally; see OpenAI’s privacy policy and the international-transfer section above. Google’s processing is described in Google’s privacy policy.

10. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time where consent is the basis. These rights can be limited by law and by our role as processor. Contact privacy@quercusquote.app. We may need to verify your identity proportionately. Workspace export is not a complete response for all personal information held across providers. We normally respond to UK rights requests within one month, subject to applicable lawful extensions; local deadlines may differ.

You may complain to the UK Information Commissioner’s Office at ico.org.uk, or your applicable local privacy authority. You may also complain to privacy@quercusquote.app. We acknowledge privacy complaints within 30 days, keep you informed and respond without undue delay. Contacting us does not remove your right to complain to a regulator.

11. Children

The service is for business users aged 18 or over and is not directed to children.

12. Changes and contact

We may update this notice as the product, providers or law changes. Material changes will be communicated through the service or by email. Privacy questions may be sent to privacy@quercusquote.app or by post to 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.