Privacy Policy

Last updated: June 2026

Quoty ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and store personal information when you use the Quoty mobile application, the web dashboard at quoty.com.au, and any related services (together, the "Service"). It also describes how we handle the information that your customers provide when they review or accept a quote online.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What information we collect

1.1 Information you give us directly

When you create an account or use the Service, you may provide:

• Account information: email address and password (hashed; we never see your plain‑text password).
• Company details: business name, ABN, phone number, email address, physical address, logo, and default pricing preferences (GST rate, labour rates, coat defaults).
• Customer records: your customers' names, phone numbers, email addresses, physical addresses, ABNs, and notes.
• Quotes: site addresses, job descriptions, line items (descriptions, areas, hours, coats, rates), expenses (titles, amounts), GST settings, notes, and PDF generation preferences.
• Paint products: product names, brands, barcodes, purchase prices, unit sizes, and notes.
• Photos: job‑site photos you attach to quotes.

1.2 Information from your customers

When a customer opens a quote link, they may provide a signature (captured as an image). We do not require your customers to create an account or provide any personal information beyond the signature.

1.3 Information collected automatically

When you visit the quoty.com.au website or use the web dashboard, our hosting provider (Netlify) and backend provider (Supabase) may automatically log technical information such as your IP address, browser type, operating system, and the pages you visit. We do not use tracking cookies, analytics scripts, or advertising pixels on the Service.

2. How we use your information

We use the information we collect to:

• create and maintain your account;
• provide the core Service — storing and syncing your quotes, customer records, products, and photos across your devices;
• generate PDF quotes and display them on customer accept pages;
• capture and store customer signatures;
• push accepted quotes to Xero as invoices (only when you have connected your Xero organisation and explicitly initiate the push);
• communicate with you about your account or the Service;
• improve, debug, and secure the Service; and
• comply with our legal obligations.

3. Who we share your information with

We do not sell, rent, or trade your personal information.

We share information only with the following service providers, and only to the extent necessary to operate the Service:

• Supabase (supabase.com) — provides authentication, database hosting, and file storage. Your account details, quote data, customer records, photos, and signatures are stored on Supabase's infrastructure (hosted in Australia on AWS Sydney).
• Netlify (netlify.com) — hosts the quoty.com.au website and customer accept pages. Netlify may process access logs (including IP addresses) as part of its CDN and hosting service.
• Xero (xero.com) — if you connect your Xero organisation, we send invoice data (customer name, line items, amounts, and your business details) to Xero's API when you choose to push an accepted quote. We do not store your Xero credentials; we use OAuth tokens that you can revoke at any time from within Xero.
• Google Fonts (fonts.googleapis.com) — the quoty.com.au website loads the DM Sans typeface from Google Fonts. Google may log the request (including your IP address) as part of serving the font files. We do not use any other Google services.

We may also disclose information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect our rights or the safety of others.

4. Data storage and security

Your data is stored on Supabase servers located in the ap‑southeast‑2 (Sydney) AWS region. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access. This includes:

• encryption of data in transit (TLS) and at rest;
• Row‑Level Security on our database — you can only access your own data;
• hashed and salted passwords (we cannot see your plain‑text password); and
• access controls that limit who within Quoty can view backend systems.

While we do our best, no online service is 100% secure. You should protect your own devices and keep your login credentials confidential.

5. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal information, customer records, quotes, photos, and signatures within a reasonable period (typically 30 days). We may retain anonymised or aggregated data that cannot identify you for analytical or record‑keeping purposes. Customer signatures and quote data associated with a deleted account are also deleted.

If a customer's quote link has expired or the quote has been superseded by a revision, the original quote data remains accessible to you (the account holder) but the public accept page will no longer display it.

6. Your rights

Under Australian privacy law, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or out‑of‑date information.
• Deletion: request that we delete your account and associated data.
• Complaint: lodge a complaint with us (and, if unsatisfied, with the Office of the Australian Information Commissioner).

To exercise any of these rights, email us at hello@quoty.com.au. We will respond within 30 days.

7. Cookies

The Service does not use tracking or advertising cookies. The web dashboard and customer accept pages use a session token stored in your browser's local storage (not a cookie) to keep you logged in. Google Fonts may set a short‑lived cookie when serving font files — this is controlled by Google, not by us. You can disable fonts in your browser settings if you prefer.

8. Children's privacy

Quoty is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the Service. The "Last updated" date at the top of this page will reflect the most recent changes.

10. Contact and complaints

If you have questions, concerns, or wish to make a complaint about how we handle your personal information, please contact us at:

Email: hello@quoty.com.au
Website: quoty.com.au

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.