QuoteRunwayThe short version
- Each company's data is in its own separate database.
- We use your data to run QuoteRunway for you, and for nothing else. We don't sell it, and we don't show ads.
- No advertising, analytics or third-party tracking scripts in the app or on your customers' quote pages.
- Card details go to Stripe and never reach us.
- An unconverted trial is deleted 30 days after it ends. An unpaid account is deleted no sooner than 90 days after it's locked, with warnings first.
Who we are
QuoteRunway is provided by [Legal entity name], [Registered address]. Contact us at support@quoterunway.com.
There are two roles here:
- For our customers' business data (their quotes, their customers and contacts, their staff's use of the app), the company using QuoteRunway decides what's collected and why. It's the controller; we're its processor, under our Data Processing Agreement. If you're a customer of a company that uses QuoteRunway, contact that company first about your data.
- For our own records (sign-ups, billing contacts, support requests, the website's contact form), we're the controller.
What we collect
Companies and their people
- Account details: company name and address, people's names, work email addresses, roles, and optional title, phone and signature.
- Sign-in security: passwords (stored only as one-way hashes), authenticator secrets (encrypted), single-use recovery codes (hashed), and sign-in times.
- Business data you put in: quotes, products and prices, templates, files, notes, follow-ups and settings.
- Keys for systems you connect (mail, PSA, distributors): stored encrypted, used only to do what you ask, and never sent back to the browser.
- An audit log of what's done in your account: who, what, which record, the names of the fields changed (not their values), the network address and the browser. Your admins can read it.
Your customers, when they open a quote link
When a company sends a quote, its customer gets a private link. On the quote page, QuoteRunway records for that company:
- when the email was opened (where the email app allows it), and when the quote page and PDF were viewed, with the network address, browser and device;
- how long the page was open and which parts were looked at;
- the answer: accept or decline, the name typed, the choices made, and the device used, sealed as evidence of the answer.
This is for the company that sent the quote: so it knows the quote arrived and has a record of the answer. It isn't used for advertising, isn't shared with other companies, and isn't combined across companies.
If an admin turns on mail sync (Microsoft 365), QuoteRunway reads message details (sender, recipients, subject and time) from the chosen sales mailboxes to match replies to quotes. It never stores message bodies.
Help requests
When someone uses Help in the app, we keep what they write, any screenshot they attach, and the details they choose to include (the app version, the page, their browser, the time and recent error references). These are stored on our platform, tagged with the company, and emailed to our support team.
Billing
Payment is handled by Stripe. We keep the Stripe customer and subscription ids, the plan, the billing period and payment status. We never see or store card numbers.
The website
quoterunway.com doesn't use analytics or advertising cookies today. If we add analytics, it will be a privacy-friendly, cookie-free kind that collects no personal data. Messages sent through the contact form (name, email, company, message, network address and browser) are kept so we can answer them.
Cookies
The app uses only the cookies it needs to work: your sign-in session, a short-lived cookie for the admin pages' extra code check, and similar ones during sign-up. No advertising or tracking cookies. The browser also keeps a few preferences (such as your theme) on your device.
How we use it
- to run QuoteRunway: sign-in, quotes, emails through your own mail system, connections you set up;
- to keep it secure: sign-in checks, rate limits, the audit log, finding and fixing errors;
- to send account email: sign-in links, invites, security notices, trial and billing notices;
- to answer support requests;
- to bill for subscriptions.
Our staff don't look at a company's business data except to give support the company asks for, to keep the service running and secure, or when the law requires it.
Where it's kept, and how it's protected
- QuoteRunway runs on Render (Ohio, USA). Data is stored in MongoDB Atlas (AWS, North Virginia, USA). See subprocessors.
- Each company has its own database. Every request is tied to one company by its address, and a sign-in for one company doesn't work on another.
- Data is encrypted in transit (HTTPS) and at rest. Keys for connected systems and authenticator secrets are encrypted again inside the database.
- Everyone signs in with a password and an authenticator code; admin pages ask for the code again.
- Company backups are encrypted (AES-256-GCM with a passphrase the admin chooses) and need the authenticator code. [Platform backups: confirm the database provider's backup schedule, retention and encryption before QuoteRunway opens.]
- Server logs keep the names of fields sent, never their values, and never customer link tokens.
How long we keep it
| What | How long |
|---|---|
| A trial company that doesn't subscribe | Its database is deleted permanently 30 days after the trial ends (warnings 7 days and 1 day before). |
| A company that stops paying | Locked, nothing deleted. Still unpaid 30 days after the lock: deleted 60 days after that (day 90), with warnings 30, 7 and 1 days before. Quote links stop 30 days after the lock. |
| A company that cancels | Kept [N] days so a backup can be downloaded, then deleted. |
| Customers' network addresses and browser details on quote activity | Removed a year after the quote was sent, except on answered quotes, where they're part of the sealed evidence of the answer. |
| Recent activity in the app | 1 year. |
| Audit log | 2 years. |
| Help requests and contact-form messages | [Retention period, e.g. 2 years after the last reply] |
| Server logs | [Log retention at the host, e.g. 30 days] |
| Billing records | As long as tax and accounting law requires. |
Everything else a company keeps is kept while its account is active, and deleted with it.
Who we share it with
Only the service providers that help us run QuoteRunway (our subprocessors), under contracts that limit what they can do with it; the systems a company connects itself, at that company's instruction; and authorities when the law requires it. We'll tell the company first unless the law forbids it.
Your choices and rights
- Staff of a company: you can see and change your own details under My settings. For anything else, ask your company's admins: they manage your account.
- Customers of a company: contact the company that sent you the quote. We'll help it answer.
- Anyone else (sign-ups, contact form): email support@quoterunway.com to see, correct or delete what we hold about you.
Depending on where you live, you may have further rights (for example under the GDPR, UK GDPR or US state privacy laws), including complaining to a data protection authority. [Legal review: region-specific rights and transfer mechanism wording.]
Children
QuoteRunway is for businesses and isn't meant for anyone under 18.
Changes
If we change this policy in a way that matters, we'll email company admins before it takes effect and update the date at the top of this page.
Contact
[Legal entity name], [Registered address]. Email support@quoterunway.com.