Privacy Policy

Quoteface is operated by HOPES & CO. ACCOUNTING LIMITED. For data protection purposes we are the controller of the personal data described here, which means we decide what is collected and why, and we are answerable for it.

This policy covers the Quoteface website, the editor where you lay out a proposal, and the emails we send you about your account. It does not cover other websites you reach from links here; those have their own policies and we do not control them.

Quoteface is a document layout tool. It does not carry out accounting, tax or legal work, does not issue invoices, and does not collect payments on your behalf.

We collect four kinds of information, and no more than we need for each.

We do not collect special category data, we do not build advertising profiles, and we do not buy personal data from anyone.

We never see or store your full card number, its expiry date or its security code. Those are entered on the encrypted pages of our payment provider and never reach our servers.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not. You can ask us to explain that assessment, and you can object to the processing.

This is the commitment that matters most on a site like this one, so it is stated plainly and without qualification.

The contents of your quotes — the description of the work, the scope, the terms, the dates and every amount — are not used to train, fine-tune, evaluate or improve any model, ours or anyone else's. Neither are the reference images you upload.

Your text is processed to produce the structure and the pages you asked for, and that is the end of it. Where a processor is involved in that step, we require by contract that your content is not retained for training or any other purpose of theirs, and that it is deleted after processing.

If we ever wanted to change that, we would have to ask you for specific, separate, opt-in consent, and continuing to use the service would not count as consent. We have no plans to ask.

You can delete an individual proposal at any time from your account, and you can ask us to erase your whole account. Where we must keep something to meet a legal obligation, we tell you what it is and why rather than quietly keeping it.

We do not sell personal data. We do not share it for anyone else's marketing. We use a small number of processors, each under a written contract that limits them to acting on our instructions:

• A hosting and infrastructure provider, which runs the site and stores your data.
• A payment provider, which handles the card transaction and holds the card details we never see.
• An email provider, which delivers account and receipt emails.
• A model provider, where one is used to produce a page layout, under a contract that forbids retention or training on your content.

We may also disclose data where the law requires it, to establish or defend legal claims, or to protect the safety of a person. If a court order or similar demand arrives, we will tell you unless we are legally prevented from doing so.

If the business is ever sold or reorganised, your data may transfer with it. You would be told before that happened, and the new controller would be bound by this policy until it lawfully changed it.

Quoteface is sold worldwide, and some of our processors operate outside the United Kingdom. Where personal data is transferred out of the UK or the European Economic Area, we rely on one of the following:

• A determination that the receiving country provides an adequate level of protection.
• The International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses.
• The European Commission's standard contractual clauses, where the transfer is from the European Economic Area.

In each case we assess whether the safeguard is effective in practice for that destination, and we apply additional measures such as encryption in transit and at rest. You can ask us for a copy of the safeguard used for a particular transfer.

If you are in the United Kingdom or the European Economic Area, the UK GDPR and the General Data Protection Regulation give you the following rights. We honour them for everyone, wherever you live, because operating two standards would be worse for everybody.

• Access — ask what we hold about you and get a copy.
• Rectification — have anything inaccurate corrected.
• Erasure — have your data deleted, where no legal obligation requires us to keep it.
• Restriction — have us pause processing while a dispute about accuracy or lawfulness is resolved.
• Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, including any profiling.
• Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing already carried out.
• Automated decisions — we do not make decisions about you by automated means that produce legal or similarly significant effects.

To exercise any of these, write to us. We will answer within one month. If a request is complex we may extend that by two further months, and we will tell you why within the first month. We do not charge for this unless a request is manifestly unfounded or excessive, and we will explain if we ever think one is.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents specific rights. We extend them as follows.

• To know what categories of personal information we have collected, the sources, the purposes, and the categories of third parties it is disclosed to. All of that is set out above.
• To access the specific pieces of personal information we hold about you.
• To delete personal information we have collected, subject to the exceptions the law allows.
• To correct inaccurate personal information.
• To limit the use of sensitive personal information. We do not collect sensitive personal information as that term is defined, so there is nothing to limit.
• Not to be discriminated against for exercising any of these rights. We do not offer a worse price or a worse service to anyone who does.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in that Act. We have not done so in the preceding twelve months.

You can make a request yourself or through an authorised agent. We will verify a request against the email address on the account before we act on it, because acting on an unverified request is itself a privacy failure. We also honour the Global Privacy Control signal: if your browser sends one, we treat it as an instruction to run only strictly necessary storage.

Quoteface is for adults. You must be 18 or over to create an account, and you confirm that when you sign up. The service is not directed at children, is not designed to appeal to them, and we do not knowingly collect their personal data.

If you believe a child has given us personal data, write to us and we will delete the account and the data without asking you to justify the request.

We use strictly necessary browser storage to keep you signed in, to protect the site from abuse and to remember your cookie choices. Anything beyond that — measurement and interface preferences — runs only if you switch it on.

Rejecting is exactly as easy as accepting: the two controls sit side by side, at the same size, on the same screen. You can change your mind at any time using the Cookie preferences link in the footer. The full detail is in the Cookie Policy.

Every page and every request is served over HTTPS. Passwords are stored as salted hashes, never in a form we could read. Access to production data is limited to the people who need it to run the service and is logged.

No system is perfect, and we will not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

If we change this policy we will update the effective date at the top and, where the change is material, tell account holders by email before it takes effect. We will not apply a materially different use of data you have already given us without asking you first.

Write to support@hopescoaccounting.com, call +44 7955013910, or write by post to HOPES & CO. ACCOUNTING LIMITED, 14 Chanonry Road South, Elgin, Scotland, IV30 6NG.

If you are not satisfied with how we have handled your personal data, you can complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to come to us first, although we would rather you did so we can put it right.

If you are in the European Economic Area you may instead complain to the supervisory authority in the country where you live, where you work, or where the issue arose.