Privacy policy

Sensitive data — acceptable use

Qwotio V1 does not support intentional collection of special-category personal data or criminal-offence data. Do not ask customers for health information (including allergies or intolerances revealing health information), racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or identifying biometric data, sex life, sexual orientation, criminal convictions, offences or allegations.

Who we are and how to contact us

Flowstox Ltd (FLOWSTOX LTD), 46 Nova Road, Croydon, England, CR0 2TL, United Kingdom, operates Qwotio. We are responsible for the personal information used to run our website, manage Qwotio accounts and administer our service.

For privacy questions or to exercise your rights, email privacy@qwotio.com or write to the address above, marked Privacy. Please provide enough information for us to identify your request; do not send passwords or verification codes.

Information we use

Account and profile information includes your email, first and last name, profile name, account status and access permissions. We also handle invitations, early-access requests, business names and intended-use information that you choose to provide. An invitation may be initiated by a Qwotio Platform Administrator, who supplies your contact details.

Business information includes business identity, ownership and membership, Quote Builder configuration, products/services, prices, publication history, plan settings and administrator notes. Published Quote Builders are accessible through their public links. Please avoid adding personal information to content intended for public display.

Authentication and security information includes protected credentials handled by Supabase Auth, sessions, verification attempts, security timestamps, access limits, audit records and trusted-device records. Rate limiting uses keyed hashes of relevant identifiers; hosting and service providers may also process connection information such as IP addresses in their operational logs.

Support and service communications may include the information you send us, the recipient address, message content and delivery status. We do not ask for your password by email.

Quote Builders, visitors and analytics

The public Quote Builder calculates an estimate from published configuration. Before sending, answers and contact details stay in page memory. When you choose Send request, the active answers, selected products, prices and your contact details are sent to the Business offering the Quote Builder and stored as a historical request. The Business can review, accept or decline it. Acceptance creates a quote and a private PDF for delivery by email. Refreshing before sending can discard your answers.

If you allow optional Quote Analytics, we record a random session identifier, visited step and route identifiers, timestamps, completion/activity flags, currency and the calculated estimate. We do not include customer names, email addresses, field answers, IP addresses or device fingerprints in this analytics record. Reports show aggregated activity, not identified customers. Random session identifiers should not be treated as a guarantee that all associated technical data is legally anonymous.

A page view alone does not start an analytics session. Tracking starts with meaningful interaction after your permission. You can refuse or withdraw permission through Cookie preferences without affecting your quote. Withdrawal stops future collection; it does not automatically erase statistics already received.

The Business offering the Quote Builder uses the information to review and respond to your enquiry and is responsible for explaining its own purposes and retention. Qwotio processes requests, private documents and service communications on the Business's instructions. Submitting does not consent to marketing or optional Analytics. If an Analytics session exists with your permission, submission links it to the request; analytics dashboards do not display contact details.

Purposes and legal bases

We use information to provide requested account access and quoting tools, assess early-access requests, administer businesses and invitations, maintain service communications, prevent abuse and investigate security issues.

The applicable legal basis depends on the relationship and purpose. Contractual necessity applies where processing is needed to perform a contract with you or take steps you request before one. Where you act for a business rather than contracting personally, account and service administration may instead require a legitimate-interests assessment. Security and abuse prevention may also rely on legitimate interests, subject to necessity and the effect on individuals. These bases are not interchangeable and do not authorise unrelated use.

Optional Quote Analytics is enabled only after your choice to allow it. Consent can be withdrawn as easily as it is given. Where a specific law requires us to retain or disclose information, the relevant legal obligation may apply. Contact us for the basis relevant to a particular use of your information.

Service providers and disclosures

The current service uses Supabase for database and authentication services; Vercel for application hosting and delivery; and Resend for transactional email delivery. These providers process information relevant to their functions, such as account/database information, web requests or email recipients and message content. We limit access through server-side permissions and use provider services rather than selling customer information.

Authorised Qwotio staff can administer accounts and provide support. Business members can access information according to their permissions. Support access to a business is separate, time limited and audited. We may disclose information where required by a valid legal obligation or to address a security incident, limited to what is appropriate.

The application does not install advertising pixels, an external web-analytics SDK or a payment processor. Fonts are served with the application; using Google Fonts at build time does not make a visitor's browser request those fonts from Google.

International processing

Our providers may process information outside the United Kingdom, including through their infrastructure and subprocessors. The locations and safeguards depend on the deployed service and the contractual arrangements in place. We do not represent that every record stays in the UK or that a particular transfer mechanism covers every provider.

Where a restricted transfer occurs, an applicable lawful transfer arrangement is required, such as an adequacy arrangement or appropriate contractual safeguards with any necessary assessment. Contact privacy@qwotio.com for information about the arrangements relevant to your data and how to obtain details of applicable safeguards.

Retention and security

We retain information for the purpose for which it is needed, taking account of account/service administration, security investigations, applicable legal requirements and backup lifecycle. Account and business records, published configuration, audit records and communications do not currently have a single automatic deletion period. Contact us about a specific record or an erasure request.

A trusted-device permission expires after 30 days and is revoked when you revoke it or change/reset your password. Expiry or revocation stops its use for login; it does not currently automatically delete the server record. Authentication attempts and grants expire independently. Analytics has bounded session activity, but no automatic server-side retention cleanup is currently deployed. Browser-storage durations are listed in our Cookies & storage notice.

We use access controls, server-only privileged operations, secure authentication, protected cookies and hashed trusted-device secrets. Sensitive changes are audited. No security measure can eliminate every risk; keep your password private and use trusted-device recognition only on a device you control.

Your rights and complaints

Depending on the circumstances and applicable law, you may request access, correction, erasure, restriction or portability of your information, object to processing, and withdraw consent where processing relies on it. These rights have conditions and exceptions. We may need proportionate information to verify your identity before responding.

Contact privacy@qwotio.com to make a request. You may complain to the UK Information Commissioner's Office (ICO) and, where applicable, your local supervisory authority. You do not need to contact us first to exercise that right.

Changes to this notice

We will update this notice when relevant service practices change and show the revision date above. Where a significant change requires more direct information or a new choice, we will provide it at the appropriate time. Our Cookies & storage notice explains the browser technologies used alongside this policy.