Privacy Policy

Who We Are

QuoteAndBuild is a trading name of QuoteAndBuild Ltd, a company registered in England and Wales under company number 17343803, with its registered office at Flat 6, Block 6 Gresham Place, London, United Kingdom.

QuoteAndBuild is a technology platform connecting tradespeople with customers across the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller is QuoteAndBuild Ltd, contactable at info@quoteandbuild.co.uk.

Data We Collect

2.1 Tradespeople

When you register as a tradesperson on QuoteAndBuild, we collect:

• —Full name, email address, and phone number
• —Business name, trade type, and operating location
• —Accreditation body and registration number (e.g. NICEIC, Gas Safe, NAPIT)
• —Profile photo (if provided)
• —Account credentials managed securely via Clerk
• —Job records, quotes, invoices, and certificates you create on the platform
• —GPS location data — only when you actively enable "On My Way" tracking for a specific job

2.2 Customers

When you submit a job request or access a job tracking page, we collect:

• —Full name and email address
• —Property address
• —Description of the work required
• —Star rating and review comment (if you choose to leave a review)

2.3 Technical Data

We automatically collect limited technical data including browser type, device type, and pages visited, for the purpose of maintaining platform security and performance. We do not use this data for advertising or profiling.

2.4 Payment & Billing Data

If you subscribe to a paid plan, your subscription payments are processed by Stripe. We do not see or store your full card number — Stripe handles card details directly as an independent payment processor. We retain limited billing records (such as your Stripe customer reference, plan, subscription status, and payment dates) for accounting and tax purposes. Where a customer chooses to pay a tradesperson's invoice by card, that payment is likewise processed by Stripe.

How We Use Your Data

Data Sharing

We do not sell your personal data. We share your data only in the following circumstances:

• —With the tradesperson you have requested a quote from (your name, email, address, and job description)
• —With customers of a tradesperson (their name and address, for certificate and invoice delivery)
• —With our service providers who process data on our behalf, including: Supabase (database hosting), Clerk (authentication), Stripe (payment processing), Twilio (SMS delivery and the AI phone receptionist), ElevenLabs (AI receptionist voice), Resend (email delivery), Anthropic (AI diagnostics and writing tools), PostHog (privacy-friendly product analytics, EU-hosted and consent-gated), Vercel (application hosting), and Upstash (rate limiting)
• —Where required by law, court order, or regulatory authority

All third-party processors are contractually bound to process your data only on our instructions and in accordance with applicable data protection law.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

• —Tradesperson account data: retained for the duration of your account, plus 6 years after closure (for legal compliance)
• —Job records, certificates, and invoices: retained for 6 years from the date of creation (UK legal requirement for business records)
• —Customer job request data: retained for 2 years from job completion
• —GPS location data: not stored beyond the active tracking session — coordinates are overwritten in real time and not logged historically
• —Billing and subscription records: retained for 6 years to meet UK accounting and tax requirements
• —Push notification subscriptions: retained until you unsubscribe or the subscription expires

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• —Right of access — you may request a copy of the personal data we hold about you
• —Right to rectification — you may ask us to correct inaccurate or incomplete data
• —Right to erasure — you may ask us to delete your data, subject to legal retention obligations
• —Right to restriction — you may ask us to restrict how we process your data in certain circumstances
• —Right to data portability — you may request your data in a structured, machine-readable format
• —Right to object — you may object to processing based on legitimate interests
• —Rights related to automated decision-making — we do not make solely automated decisions that have legal or similarly significant effects on you

To exercise any of these rights, email info@quoteandbuild.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies & analytics

We use essential cookies required for the platform to function, including authentication session cookies managed by Clerk. These are always on.

With your consent, we also use privacy-friendly product analytics (PostHog, hosted in the EU) to understand which features are used so we can improve the app. Analytics load only after you accept our consent banner; we identify you by an anonymous account ID (never your name or email); and we do not use advertising or ad-tracking cookies. You can withdraw consent at any time from Profile → Privacy & data.

You can also control cookie settings in your browser, but disabling essential cookies will prevent you from logging in to the platform.

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• —Encrypted data transmission (HTTPS/TLS)
• —Row-level security on our database
• —Authentication handled by Clerk, an industry-standard identity provider
• —API routes protected by authentication and authorisation checks
• —Service role keys never exposed to the browser

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.

International Transfers

Some of our third-party service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms, to protect your data to the same standard required under UK GDPR.

Children

QuoteAndBuild is not intended for use by persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where the changes are significant, notify registered users by email. Continued use of the platform following notice of changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us: