Privacy policy

1. Data controller

The data controller under Regulation (EU) 2016/679 (GDPR) is Quote Bench Pro s. r. o., seated in Prague, Czech Republic. Contact for privacy questions: privacy@quotebenchpro.com.

2. Data we process

We process the following categories of data:

• Account: name, email, organisation role (via Clerk).
• Operational data: job descriptions (typed or dictated) including voice transcripts, customer contact data, job details (scope, location, dates), quote line items and prices, attachments and photos; when Gmail is connected, also email inquiries and replies.
• Configuration: material price lists, labour rates, margins, and calculation defaults.
• Audit log: who did what and when.
• Telemetry and operational logs (no individual tracking — see “Cookies”).

3. Purpose and legal basis

We process data to (a) deliver the service under contract — Art. 6(1)(b) GDPR; (b) comply with legal obligations (accounting) — Art. 6(1)(c) GDPR; and (c) on the basis of legitimate interest in improving the service and preventing abuse — Art. 6(1)(f) GDPR.

4. Retention

Operational data is retained for the duration of the service. On termination, full deletion occurs within 30 days, except for data we are legally required to keep (e.g. accounting records — 10 years). Audit logs are retained for at least 1 year.

5. Recipients

We rely on the following processors:

• Render Services, Inc. — application and database hosting in Frankfurt.
• Cloudflare, Inc. — attachment storage (R2) under EU jurisdiction.
• Clerk, Inc. — identity and sign-in (Standard Contractual Clauses for the US).
• Anthropic, PBC — AI model for understanding job requests and drafting revisions (Standard Contractual Clauses).
• Deepgram, Inc. — speech-to-text transcription of voice dictation (Standard Contractual Clauses; only engaged when the operator records audio).
• Resend, Inc. — outbound system email.
• Google LLC — Gmail API for reading and sending from the customer’s connected mailbox (only when the customer connects Gmail).
• Lemon Squeezy (merchant-of-record) — subscription payment processing and invoicing. We share only paying-user data (name, email, billing address, payment method) — never any data about your end customers. Standard Contractual Clauses for the US.
• Plausible Analytics — aggregate traffic on public pages (no cookies, no personal data, IP-anonymised at ingest). Hosted in Germany.

A current processor list is in the data processing addendum.

6. Your rights

You have the right of access, rectification, erasure, portability, restriction, and objection. Exercise these by emailing privacy@quotebenchpro.com — we respond within 30 days.

7. Cookies

We use only strictly necessary cookies: sign-in (Clerk session) and — if you manually switch the public site language — a language-preference cookie (180-day lifetime, no tracking). For traffic analytics we use Plausible Analytics — a cookie-less, EU-hosted product that does not track individuals.

8. Supervisory authority

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).