Privacy policy

1. Who we are and our roles

Quote Bench Pro is operated by Ondřej Bárta, a sole trader entered in the Czech Trade Register, company ID (IČO) 74140850, place of business: Poštolčí 678, 182 00 Prague, Czech Republic. Privacy contact: privacy@quotebenchpro.com. The service is intended for businesses (B2B) and is not directed at children.

We act in two roles. As a controller under Regulation (EU) 2016/679 (GDPR) we process website, account, security, support, and billing data. As a processor we process job, end-customer, quote, and communication data that a contractor (our customer) submits to the service — the contractor is the controller of that data. If you are a contractor’s customer, direct your requests to that contractor; we will forward or assist with requests we receive.

We announce material changes to this notice in advance in the application; the version you are reading is identified by the last-updated date above. Where a related contractual change to the Terms or the DPA requires renewed acceptance, the service will present the applicable document for affirmative acceptance. We do not rely on acceptance of this notice as GDPR consent.

2. Data we process as controller

• Account (name, email, organisation role; source: you, or the organization owner who invited you; via Clerk) — if the customer is a sole proprietor and you are that proprietor: performance of contract, Art. 6(1)(b) GDPR; for every user acting for a legal entity or other organisation, including its organization owner: our legitimate interest and the customer’s interest in providing, administering, supporting, and securing the service the customer requested, Art. 6(1)(f). Provision is required to use the service. Retained while you belong to an active organisation; when you leave it or it closes and you belong to no other Quote Bench Pro organisation, deleted within 30 days. If your organization invites you, we provide this notice with the first invitation.
• Acceptance records (document identifier and version, content hash, the exact assent sentence displayed, the customer’s legal business name, the accepting user’s ID and role, tenant ID, timestamp, IP address, and user-agent string) — legitimate interest in establishing, exercising, and defending legal claims, Art. 6(1)(f); retained 6 years after account closure. These records contain no end-customer data.
• Security and operational logs (IP address, user agent, request time, authentication and session events, correlation identifiers, short-lived rate-limit counters) — legitimate interest in security, abuse prevention, and service operation, Art. 6(1)(f); logs are kept in a short rolling window and in no case longer than 30 days, and rate-limit counters expire with their window — one minute on most endpoints, up to one hour for data-export requests.
• Security and contract-evidence records derived from operating the service (the two entries above) — we keep these for our own security and legal-claims purposes as controller. By contrast, the organization audit trail (user identifier, action, object identifier, and timestamp) that the contractor sees in the application is kept on the contractor’s instructions as part of the service — we process it as processor and it is described in section 3; it is retained for 24 months while the organisation is active and is deleted together with the organisation’s data on organisation deletion.
• Billing (paid plans only; name, email, billing address, payment method held by the payment provider) — if the customer is a sole proprietor and you are that proprietor, performance of contract, Art. 6(1)(b); if you act as a billing contact for an organisation, our and the customer’s legitimate interest in billing and subscription administration, Art. 6(1)(f); for tax invoices, compliance with a legal obligation, Art. 6(1)(c) — accounting records 10 years.
• Support (the content of your communication with us) — if the customer is a sole proprietor and you are that proprietor, performance of contract, Art. 6(1)(b); if you contact us for an organisation, our and the customer’s legitimate interest in resolving the request, Art. 6(1)(f); kept until the matter is resolved and for 12 months afterwards, unless needed for a documented legal claim.

Required and optional data. Account fields and the fields the owner submits when accepting the documents are required to create an organisation and use the service — without them we cannot give you access or form the contract. Security and operational logs are generated automatically and are necessary to operate and secure the service. Support content is optional, but without the relevant details we may be unable to resolve your request. For paid plans, billing fields will be required at checkout by the payment provider and by applicable tax law. None of this data is required by statute as a condition of providing the service itself.

We carry out no decision-making based solely on automated processing that produces legal effects within the meaning of Art. 22 GDPR — prices are computed by a deterministic engine from your own rates, and every quote is reviewed and approved by a user before sending.

3. Data we process as processor

On the contractor’s instructions we process: job descriptions (typed or dictated) including voice-dictation transcripts, end-customer contact data (name, email, phone, project address), quote line items, prices and versions, the recipient and delivery metadata of sent quotes, the organization audit trail (user identifier, action, object identifier, timestamp), and configuration data (price lists, rates, margins). The contractor is the source and determines the scope. The terms of this processing are set by the data processing addendum.

4. How the service handles data (current pilot)

• Quote and job data is stored in a Postgres database in Frankfurt (Render).
• Voice dictation is sent for transcription to Microsoft Azure AI Speech (Germany region) and the audio is not stored — only the text transcript is kept.
• Quote PDFs are generated on demand and are not stored by the application; for delivery we pass the recipient email address, message metadata, and the generated PDF attachment to our email provider (Resend) — a copy naturally exists in the delivered email and with its recipient.
• Object storage (Cloudflare R2, EU jurisdiction) holds the contractor’s logo and branding and data-export archives.
• During the pilot the service does not process job attachments or photos.

Disabled and future features: the Gmail integration (reading and sending email from a connected account, processor Google LLC) is hard-disabled during the pilot and Google is not currently our processor. If the feature is enabled, we will update this document and the processor list in advance.

5. Retention and deletion

The controller chooses between an export followed by deletion and immediate deletion: on ordinary termination an export is produced on request for 30 days and the data is then deleted, while owner-directed organization deletion is an instruction to delete immediately, ending access and the export right at once. On either path, active service copies of customer content are deleted no later than 30 days after the triggering event, and the organization audit trail is deleted with them. Point-in-time backup copies expire on the ordinary backup cycle (currently approximately 3 days) measured from the deletion of the corresponding active copy, and are not restored except for disaster recovery. Acceptance records are retained 6 years after account closure (to establish, exercise, or defend legal claims), accounting records 10 years, and security logs in a short rolling window (days). At vendors: the AI provider (Anthropic) ordinarily deletes request inputs and outputs within 30 days; its terms may permit longer retention for specified legal, safety, or policy-enforcement reasons, and under our commercial terms and account configuration it does not use them to train its general-purpose models, which does not rule out the trust-and-safety review its terms permit — if its automated safety systems flag a request, Anthropic may retain the flagged input and output for up to 2 years and the associated trust-and-safety classification score for up to 7 years, and may retain data where law requires it; the speech-to-text provider (Microsoft Azure AI Speech) does not retain audio once the transcript is returned and, under its data processing agreement, does not use it to develop its own products; data-export archives in object storage are deleted with the organisation; the email provider (Resend) retains sent content and delivery records for 30 days; for account information where the identity provider (Clerk) acts as an independent controller (see section 6), Clerk determines retention under its own privacy notice; when you delete your user account, or the organisation closes and you belong to no other Quote Bench Pro organisation, we instruct Clerk to delete the identity data it processes on our instructions, and Clerk returns it on request and deletes it no later than 90 days after termination of our Clerk agreement under its data processing agreement. A legal obligation may suspend deletion of specific data (legal hold) — only for the affected data.

The self-service deletion command immediately and irreversibly disables access and queues deletion; it does not instantly erase backup copies (which expire on the cycle above), vendor copies (deleted on the schedules above), or emails and PDFs already delivered to recipients.

6. Recipients and international transfers

(1) Subprocessors under the data processing addendum — this list (version 2026-08-10) is the one covered by the general authorisation in section 5 of the addendum:

• Render Services, Inc. (US) — application and database hosting; data stored in Frankfurt, Germany.
• Cloudflare, Inc. (US) — R2 object storage under EU jurisdiction (logo, exports).
• Clerk, Inc. (US) — identity and sign-in, for the personal data it processes solely on our documented instructions. In its other role — the account information it determines itself — Clerk is an independent controller and appears in list (2) below.
• Anthropic, PBC (US; the contracting entity for EEA customers is Anthropic Ireland, Limited) — AI model that converts job requests and revision instructions into structured fields; it does not select or set prices (the text of job requests and quote revisions; Anthropic ordinarily deletes inputs and outputs within 30 days — its terms may permit longer retention for specified legal, safety, or policy-enforcement reasons — and under our commercial terms does not use them to train its general-purpose models, which does not rule out the trust-and-safety review its terms permit).
• Microsoft Ireland Operations Limited (Ireland; part of Microsoft Corporation, US) — speech-to-text via Azure AI Speech, processed in the Germany West Central region. Engaged only when an authorized user activates voice dictation; the audio is sent once for transcription and is not retained.
• Plus Five Five, Inc. d/b/a Resend (US) — email delivery (recipient address, message metadata, the quote PDF attachment).

Chapter V GDPR transfer mechanisms, recipient by recipient:

• Render Services, Inc. — processor; US (data stored in Frankfurt, Germany) — Standard Contractual Clauses (Decision (EU) 2021/914) incorporated in the Render DPA.
• Cloudflare, Inc. — processor; US (storage under EU jurisdiction) — safeguards under the Cloudflare Customer DPA v6.4 (effective April 3, 2026), including Standard Contractual Clauses.
• Clerk, Inc. — independent controller for account information / processor; US — EU–U.S. Data Privacy Framework certification with Standard Contractual Clauses as the fallback mechanism under the Clerk DPA.
• Anthropic — processor; US (the contracting entity for EEA customers is Anthropic Ireland, Limited) — Standard Contractual Clauses incorporated in the Anthropic DPA (Commercial Terms effective June 17, 2025).
• Microsoft Ireland Operations Limited — processor; Ireland (audio is processed in the EU, Germany), so ordinary operation involves no third-country transfer. Any transfer outside the EEA within the Microsoft group (support and operational activities) is covered by the Standard Contractual Clauses, processor-to-processor module, under Decision (EU) 2021/914 between Microsoft Ireland Operations Limited and Microsoft Corporation, incorporated in the Microsoft Products and Services DPA (May 2026 version); Microsoft is also certified under the EU–U.S. Data Privacy Framework.
• Plus Five Five, Inc. d/b/a Resend — processor; US — Standard Contractual Clauses incorporated in the Resend DPA.

For a US recipient we rely on the EU–U.S. Data Privacy Framework only while the recipient’s active certification covers the transferred data; otherwise we use Standard Contractual Clauses under Commission Decision (EU) 2021/914 in the module appropriate to the parties’ roles, with completed annexes and any required supplementary measures. We reassess the mechanism if certification or law changes. A copy of the applicable safeguards is available on request at privacy@quotebenchpro.com.

(2) Other recipients — independent controllers (not subprocessors): Clerk, Inc. (US) for account information (name, e-mail, sign-in credentials, and related account-administration data) that it processes for its own account-administration, service-operation, security, and legal purposes under its own privacy policy; our disclosure of that data rests on Art. 6(1)(f) GDPR (operating secure sign-in) and on the transfer mechanism listed above. In addition: if paid plans are enabled, payments are processed by Lemon Squeezy as merchant of record — it receives only paying-user data (name, email, billing address, payment method), never any data about your end customers, and acts partly as an independent controller for payment, tax, and fraud-prevention purposes. No payments are processed during the free pilot.

7. Your rights

Subject to the conditions and exceptions in applicable law, you have the rights of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interest. Portability applies only where Art. 20 GDPR does — automated processing based on consent or on a contract to which you are a party — so it does not reach every category described above. We do not base processing on consent; should we ever rely on consent, it can be withdrawn at any time. Exercise your rights by emailing privacy@quotebenchpro.com — we respond without undue delay, within the timelines required by applicable law. If you are a contractor’s end customer, direct your request to the contractor first (see section 1).

8. Cookies and telemetry

We do not use advertising or analytics services and we do not sell personal data or share it for targeted advertising — a technical scan of the public site (2026-08-10) contacted only our own domain and our identity provider’s (Clerk) domain, with no analytics or advertising scripts. Cookies and similar storage observed: Clerk sign-in state cookies on our domain (e.g. `__client_uat` and the instance sign-in token; up to 1-year lifetime), a Clerk configuration entry in local storage, and — because the Clerk identity script loads from Clerk’s infrastructure — bot-protection cookies set by its CDN (Cloudflare `__cf_bm`, ~30 minutes, and `_cfuvid`, session) for security. If you manually switch the public site language, a language-preference cookie is set (180-day lifetime; inactive while only English pages are published). For security and operation we collect IP address, user agent, request time, authentication and session events, correlation identifiers, and short-lived rate-limit data. Clerk may process session and security information as described above when its identity component loads; we run no cross-site tracking for advertising. Because no advertising tracking takes place, GPC/DNT signals do not change our processing. Cookie names and lifetimes may vary with the identity provider’s instance configuration; the scan date above records when we last verified this inventory, and we update it when the configuration changes. The substantive commitment — no advertising or analytics technologies — does not depend on that inventory.

9. Supervisory authority

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz) or with another competent EEA supervisory authority — including the authority of your habitual residence, your place of work, or the place of the alleged infringement.