This Privacy Policy explains how Up Top Technologies ("QuotaFlo", "we", "us") collects, uses, and shares information when you use the QuotaFlo AI application and website (the "App").
Contact: support@quotaflo.com
Operator / data controller: Up Top Technologies, Greymouth, West Coast, New Zealand
The App is intended for business users (sole traders and tradespeople). You may enter information about your clients (names, addresses, phone numbers, job details, prices). You are responsible for having a lawful basis to enter that information and for telling your clients how their information is used (for example, under the NZ Privacy Act 2020 (IPP 3/3A), the Australian Privacy Act 1988 (APP 5), the GDPR / UK GDPR, or POPIA, where those apply to you). For that client information, you are the controller and we act as your processor, processing it only to provide the App's features to you.
Our legal basis (where the GDPR / UK GDPR applies). We process your account data (email, name, company, hashed password, subscription status) to perform our contract with you (Art. 6(1)(b)); we process limited technical and AI-usage data to operate, secure and meter the service under our legitimate interests (Art. 6(1)(f)); and we rely on your consent (Art. 6(1)(a)) for optional device permissions such as location, camera and microphone, which you can withdraw at any time in your device settings.
The following is stored in your browser's local storage on your device and is not sent to our servers by the App in normal use:
This data stays on your device unless you choose to (a) use a feature that sends specific data to a third party (Section 3.2), (b) create a backup (Section 7), or (c) share a quote for approval (Section 3.3).
When you use an AI feature, the relevant input is sent over an encrypted (HTTPS) connection to our server, which forwards it to a third-party AI provider, and the result is returned to you:
| Feature | What is sent | Sent to |
|---|---|---|
| Voice → quote | A text transcript of your speech (see voice note below) and the quote details | Our server → Anthropic |
| Generate quote / AI assistant / JSA | The job/quote text and details you provide | Our server → Anthropic |
| Safety pack | The job details you provide and any site photos you attach (for hazard detection) | Our server → Anthropic |
| Scan invoice | The photo you capture and the data extracted from it | Our server → Anthropic |
| Snap & Quote (plan / notes take-off) | The photo of your handwritten notes, plans or job site that you capture, and the data extracted from it | Our server → Anthropic |
| Scan receipt (expenses) | The photo of the receipt you capture and the data extracted from it (vendor, date, total, tax) | Our server → Anthropic |
| Read-aloud (text-to-speech) | The text to be spoken | Our server → ElevenLabs |
If you send a client a quote-approval link, the quote and an approval status are stored in our database (Supabase) so the client can approve it from their device. This may include the client's name and the quote contents.
If you create an account, we (via Supabase) collect your email address, your name and company name (which you enter at sign-up), and a securely hashed password to sign you in. Our server also stores your subscription/trial status and simple AI-usage tallies (counts of AI actions only, used to enforce fair-use limits) against your account — never the content of your quotes or jobs.
Subscriptions are processed by Stripe via a hosted checkout page on our website. We do not receive or store your full card details; Stripe handles payment information under its own privacy policy. We receive a subscription status.
If you enable weather or mileage tracking, the App uses your device location to:
You can decline the location permission; those features then do not work, but the rest of the App does.
Both are only accessed when you actively use those features.
With your permission, the App may show notifications on your device (for example, a reminder to chase an unsent quote or that a job is due). These are generated locally on your device — we do not operate a push-notification server and no notification data is sent to us or any third party. You can turn notifications off at any time in your device/browser settings.
We may process limited technical data necessary to operate the service (e.g. request metadata to our API). Product analytics is optional and off by default. Only if you opt in (in the App's Settings, or when we ask you once) does the App send anonymous usage events — which features you use (for example, “quote sent”), never your names, client details, or the contents or amounts of your quotes and invoices — to PostHog. These events are processed in the EU; PostHog is configured not to store your IP address; and we do not identify you (an anonymous, random device identifier is used). You can withdraw consent at any time in Settings. Separately, crash-reporting (Sentry) is wired into the code but currently disabled — with no project key configured it fetches nothing and sends nothing; before enabling it we will update this policy and our app-store privacy disclosures to name Sentry as a sub-processor and its data region.
We do not sell your personal information. We do not use your business data or your clients' data to train our own models. AI providers process it to return a result; their use is governed by their terms (Section 5).
| Provider | Purpose | What they receive |
|---|---|---|
| Anthropic | AI generation (quotes, assistant, safety, invoice scan) | The text/photo you submit to those features |
| ElevenLabs | Text-to-speech | The text to be spoken |
| Supabase | Account sign-in and quote-approval storage | Email, your name and company name, hashed password, quote-approval records, subscription status, AI-usage counts |
| Stripe | Subscription payments | Payment details (collected directly by Stripe) |
| Open-Meteo | Weather | Precise coordinates |
| BigDataCloud | Reverse geocoding (locality name) | Precise coordinates |
| CARTO, RainViewer & OpenStreetMap | Map tiles (weather radar & mileage trip maps) | Precise coordinates (via tile requests) and IP address |
| unpkg | Hosts the map library (Leaflet) | IP address (standard request data) |
| Your browser vendor (e.g. Google) | Speech-to-text (Web Speech API) | Your voice audio, via the browser |
| Google (Gmail email delivery) | Sending notification emails to you (e.g. when a client approves a quote) and occasional product updates | The email content (e.g. a client's name and the total on an approved quote) and the recipient address |
| Render & GitHub Pages | Hosting the API and the App | Standard request data |
| PostHog (EU) | Product analytics — only if you opt in (off by default) | Anonymous events for which features you use (e.g. “quote sent”); no names, client details, or quote/invoice contents or amounts; IP not stored |
Each provider acts under its own privacy policy (linked above).
The App is for business use and is not intended for anyone under 18. We do not knowingly collect information from children.
QuotaFlo is operated from New Zealand, and some features send personal information to service providers located in other countries — primarily the United States (Anthropic for AI generation, ElevenLabs for text-to-speech, Stripe for payments, Render for API hosting), and to our database provider Supabase, which stores your account and quote-approval data in a region we select. Other providers listed in Section 5 may also be located overseas. This includes information you enter about your clients.
We make these transfers under each provider's data-processing terms, which require them to protect the information with safeguards comparable to those in your local law (for example, the NZ Privacy Act 2020 (IPP 12) for New Zealand users and the Australian Privacy Principles (APP 8) for Australian users — under which we take reasonable steps to ensure overseas recipients protect your information to a comparable standard — and Standard Contractual Clauses or equivalent mechanisms under the GDPR / UK GDPR (Arts. 44–49) and POPIA (s72) where they apply). Where comparable safeguards are not available for a particular transfer, we will either not make it or will first ask for your express, informed consent on the basis that the overseas recipient may not be required to protect the information in a way comparable to your local law.
We may update this policy. We will change the "Last updated" date and, for material changes, provide notice in the App.
Up Top Technologies
Greymouth, West Coast, New Zealand
support@quotaflo.com