Privacy Policy

When you use Quotla, we collect information you provide directly to us:

• Account information (name, email, password)
• Business information (company name, address, logo)
• Quote and invoice data you create
• Client information you add to the platform

We also collect certain information automatically:

• IP address for geolocation-based currency detection (processed via ipapi.co)
• Audit logs tracking changes to your data for security purposes
• Consent records documenting your privacy preferences

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Develop new features and services

We take reasonable measures to protect your personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Your data is encrypted in transit (TLS 1.3) and at rest (AES-256) using industry-standard encryption protocols.

We retain your information for as long as your account is active. When you delete your account, all personal data is permanently removed within 30 days. We may retain anonymized data for analytics purposes after account deletion. Audit logs are retained for 12 months for security purposes.

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

We use essential cookies to maintain your session and preferences. We do not use tracking cookies for advertising purposes. You can control cookie settings through the cookie consent banner.

IP-based geolocation: We use your IP address to detect your country and suggest the appropriate currency. This data is processed by ipapi.co and is not stored permanently. You can opt out of this feature in your browser settings.

We use the following third-party services that process your personal data:

• Convex: Database hosting and authentication (USA)
• Vercel: Application hosting and CDN (USA)
• Resend: Email delivery for verification and transactional emails (USA)
• Google OAuth: Authentication via Google Sign-In (USA)
• ipapi.co: IP-based geolocation for currency detection (USA)
• fxratesapi.com: Live exchange rate data (USA)

Each of these services has its own privacy policy and data processing agreements in place. We ensure appropriate safeguards for international data transfers, including Standard Contractual Clauses where required.

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].