Privacy policy

Who processes your data

Controller: Alexis Zanotti Orellana, tax ID PENDIENTE: 61132808G, registered at Calle La Ribera 1, Puerta 7 Torrente, Valencia, España CP 46900. Contact for any data protection matter: info@quoteprocess.com.

This policy explains the processing of personal data on the website www.quoteprocess.com and in the QuoteProcess application.

Two different roles, worth keeping apart

QuoteProcess is the controller of your account data and of our commercial relationship: who you are, which address you sign in with, which plan you are on and how you use the service.

For the data inside your mailbox — your customers emails, their names, their addresses and their goods — you are the controller. We act as a processor and only handle that data on your instructions, under the Data processing agreement that forms part of your contract with us.

What we process and where it comes from

• Account: name, email address, profile picture and identity provider, as returned by Google or Microsoft at sign-in. Only the openid, email and profile scopes are requested.
• Company: trading name, email, phone, language, reply template and the rate rules you configure.
• Mailbox connection: the address of the connected mailbox and its access credentials, always encrypted with AES-256-GCM. We never store or see your Google or Microsoft password.
• Message content: for emails the filter identifies as transport requests we store sender, recipient, subject, body, the provider message and thread identifiers, and the date. For discarded emails no content is stored at all, only how many were reviewed.
• Data extracted from each request: origin, destination, distance, weight, pallets, packages, volume, pickup date, goods, and the name and contact details of the person who sent it.
• Quotes: amount, breakdown, draft reply, sent date and your feedback on whether the quote was right.
• Operational metrics: how many emails were reviewed, discarded, processed and failed on each poll. Aggregate counts only, with no content and no addresses.
• Billing: the customer identifier at the payment provider. Card details are handled directly by Stripe and never reach our servers.
• Public demo: the IP address, for up to one hour, solely to enforce the ten-use limit, plus the text pasted into the form.

Purposes and legal bases

There is no automated decision-making with legal effects: no quote leaves the system without a person reviewing it and pressing send.

• Providing the contracted service — reading the mailbox, extracting the data, pricing it and drafting the reply: performance of the contract (art. 6.1.b GDPR).
• Accessing your Google or Microsoft mailbox: your explicit consent, given on the provider consent screen and revocable at any time (art. 6.1.a GDPR).
• Billing and meeting accounting and tax obligations: legal obligation (art. 6.1.c GDPR).
• Security, abuse prevention and the demo usage limit: legitimate interest in protecting the service (art. 6.1.f GDPR).
• Improving the product from aggregate metrics and your feedback on quotes: legitimate interest (art. 6.1.f GDPR).

Mailbox access: exactly which permissions we ask for

To work, QuoteProcess needs to read incoming mail and send the reply from your own address. These are the permissions, and there are no others:

• Google: https://www.googleapis.com/auth/gmail.readonly to read messages and https://www.googleapis.com/auth/gmail.send to send the reply. We do not request permission to delete, to modify labels, or to reach contacts, Drive or Calendar.
• Microsoft: Mail.Read to read, Mail.Send to reply, User.Read to know which mailbox the connection belongs to, and offline_access so polling can continue without asking you to sign in every hour.
• Polling is scheduled, not continuous: one daily pass, plus any you trigger manually from the application.
• You can revoke access at any time, from the application itself or at myaccount.google.com/permissions and myapps.microsoft.com. Once revoked we immediately lose the ability to read anything new.

Google Limited Use

The use and transfer of information received from Google APIs to any other app by QuoteProcess will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Plainly: data obtained from Gmail is used only to provide user-facing features of the service; it is never sold or transferred to third parties; it is not used for advertising or to train general-purpose AI models; and no human reads it, except where you explicitly ask us to, where it is strictly necessary for security or to resolve an incident, or where the law requires it.

Artificial intelligence

The text of emails identified as requests is sent to a language model to extract the logistics data and draft the reply. We use Anthropic (Claude) models through the Vercel AI gateway. Under that provider commercial terms, content sent through its API is not used to train models.

The model never calculates the price. It returns structured data that is validated before being stored, and the amount is computed by a deterministic engine from your own rules, in whole cents, with the breakdown in plain sight.

Before the model is called, a filter discards mail that is obviously not a request. Nothing from those messages is sent to any AI provider.

Who we share data with

Only with the providers needed to run the service, all of them under a processor agreement with the guarantees of article 28 GDPR. The full list, with each purpose and location, is on the subprocessors page and is kept up to date.

We do not sell personal data and do not share it for advertising. Beyond those providers, data is disclosed only where required by a legal obligation or a request from a competent authority.

International transfers

Some providers are established in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission standard contractual clauses together with any necessary supplementary measures. The database is hosted in the European Union, in the Frankfurt (Germany) region.

How long we keep data

• Processed emails, requests and quotes: while the account is active and for thirty days after it is closed. They are deleted after that.
• Account and company data: while the account is active, plus thirty days.
• Invoices and accounting records: six years, as required by commercial and tax law.
• Mailbox credentials: until you disconnect the channel or delete the account, at which point they are erased.
• Public demo IP: one hour at most, the length of the rate-limit window.
• Aggregate polling metrics and the cache of distances between towns: kept indefinitely, as they contain no personal data.

Security

• All traffic is encrypted in transit with TLS.
• Mailbox access credentials are stored encrypted with AES-256-GCM, under a key that does not live in the database.
• Every company is isolated: every database query is scoped by its company identifier.
• Access to production systems is limited to the people who need it and protected with two-factor authentication.
• The application is not indexed by search engines and private routes require an active session.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time, by writing to info@quoteprocess.com from the address linked to your account. We will respond within one month.

If you believe your request was not handled properly, you may complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.

If your data sits in the mailbox of a QuoteProcess customer — because you emailed them for a quote, for instance — please contact that company, which is the controller. If you write to us, we will put you in touch with them.

Minors

QuoteProcess is a professional service aimed at companies and self-employed professionals. It is not intended for minors and we do not knowingly collect their data.

Changes to this policy

If anything material changes — a new purpose, a new provider, a different retention period — we will give at least thirty days notice by email. The date of the latest revision appears at the top of this page.