QuoForm Privacy Policy
Draft. Last updated: [OWNER: date].
This policy explains what personal data QuoForm handles, why, where it goes and how long it is kept. QuoForm is provided by [OWNER: legal company name], [OWNER: registered address]. Privacy contact: [OWNER: email]. Data protection officer, if one is appointed: [OWNER: name and email, or "none appointed"].
QuoForm is used by Shopify merchants. Two groups of people have data in it, and we play a different role for each:
- Merchants (the people who install QuoForm): we are the controller of the account data described in section 1.
- Merchants' customers and visitors (people who fill in a form or ask for a quote on a merchant's store): the merchant is the controller and we are the processor, acting on the merchant's instructions. Section 2 applies, together with the Data Processing Agreement. If you are a customer of a store, contact that store first about your data; we will help the store answer you.
1. Merchant account data (we are the controller)
| Data | Why | Notes |
|---|---|---|
| Shop domain, store name, owner and contact email, currency, time zone | Provide the app, contact you, support | Received from Shopify at install |
| Shopify access token | Act on your store as you authorised | Stored encrypted; deleted on uninstall |
| Plan and subscription status | Billing and plan limits | Billing runs through Shopify; we receive no card details |
| Settings, forms and templates you create | Provide the app | |
| Team members you add (name, email, role) | Let them use the app for your store | |
| Support messages and the notes we keep about them | Answer you | Our support staff see account metadata, not your customers' data, unless you give a time-limited, logged permission |
| Aggregate usage counts (forms, quotes, limits reached) | Run plans, find faults, improve the app | Counts per shop, not personal data of your customers |
2. Customer and visitor data (the merchant is the controller)
When a visitor submits a form, requests a quote, chats, places a bid or makes an offer on a store that uses QuoForm, QuoForm stores, for that merchant:
- what the visitor entered: for example name, email, phone, address, company, VAT number, free text, selected products and quantities, and consent answers;
- files they upload and signatures they provide (the typed name, the drawn image, and a record of the text they agreed to);
- the quote and its history, messages exchanged, and the merchant's notes;
- technical data needed to protect the form: the IP address (stored encrypted) and a hash of the browser identification string. A hash of the email address is kept for duplicate detection; the plain address is not used for that.
What the app does with it: delivers it to the merchant, lets the merchant reply and quote, keeps the quote link working for the visitor, filters spam, and, if the merchant turned AI on, helps the merchant draft replies (section 5).
Storefront scripts. QuoForm's storefront scripts set no cookies and do not fingerprint. They use the browser's session or local storage only for functional state such as form progress, a quote list and how often a popup shows. Form analytics keep only counters per form and day: no identifiers, no IP address and no entered values. A merchant may add tracking pixels of their own; those load only after the visitor's consent and are the merchant's responsibility.
3. Where the data lives and who else handles it
QuoForm runs on servers we operate, with the services below as sub-processors. The same list appears in the Data Processing Agreement.
| Sub-processor | Used for | Data | Optional | Location |
|---|---|---|---|---|
| DigitalOcean | Hosting of the app, its database and queue | All app data (shop settings, submissions, quotes, messages), encrypted fields as in SEC-030 | No | [OWNER: region, decided in Q-055] |
| Cloudflare R2 | Storage of uploaded files, quote PDFs and email images | Files uploaded by buyers and generated quote documents | No | see provider settings |
| Resend | Sending and receiving email | Recipient and sender addresses, message content, delivery status | No | see provider settings |
| Cloudflare Turnstile | CAPTCHA on forms the merchant turned it on for | Visitor IP address and the challenge token | Yes, only when used | see provider settings |
| Anthropic | AI features the merchant uses (reply help, form generation, the help assistant) | Text the merchant sends to an AI feature; fields marked sensitive are removed first | Yes, only when used | see provider settings |
| OpenAI | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| Groq | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| OpenRouter | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| GlitchTip | Error tracking | Error reports with ids and codes only, no personal data (SEC-060) | No | see provider settings |
| Google reCAPTCHA | CAPTCHA on forms, only when the merchant chooses it with the merchant's own keys | Visitor IP address and browser signals sent by the visitor's browser to the provider | Yes, only when used | see provider settings |
| hCaptcha | CAPTCHA on forms, only when the merchant chooses it with the merchant's own keys | Visitor IP address and the challenge token | Yes, only when used | see provider settings |
| Browser push services | Notifications to team members who turn them on | A push subscription (endpoint and keys) and the notification text | Yes, only when used | provider's own |
Integrations a merchant chooses to connect, such as CRMs, Google Sheets, Dropbox, Google Drive, Slack and Zapier, are the merchant's own processors and not ours.
Shopify Inc. provides the platform the app runs on. [OWNER: confirm how Shopify is described here: as a separate controller or as a platform provider.]
We do not sell personal data and do not use it for advertising. We use no automated decision that has a legal or similarly significant effect on a person.
[OWNER: transfers outside the EEA or UK and the safeguard used (for example standard contractual clauses), once the hosting and provider regions are confirmed.]
4. How long we keep it
- Customer submissions, quotes, messages, partial entries, chat transcripts and files: deleted automatically after the retention period the merchant sets in the app (30 to 1,095 days, default 365). Quotes still open (sent, viewed, countered, accepted, converted) are not swept.
- Spam quarantine: 30 days.
- Technical records: the email queue, 7 days after dispatch; webhook de-duplication records, 30 days; job records, 30 days; the merchant's audit log, 365 days.
- Erasure requests: when Shopify sends a customer data request or a customer or shop erasure request, we complete it within the time Shopify requires (30 days at most; our target is 24 hours). Erasure removes or irreversibly anonymises the data; financial records of payments are kept without personal data.
- After uninstall: the shop's data is deleted 48 hours after Shopify reports the uninstall, and in any case within the time above.
- Backups: [OWNER: backup retention, once backups are configured]. Data deleted from the live system leaves backups when they expire.
5. AI features
AI is off for every store until the merchant switches it on, with a notice on screen explaining what is sent. When it is on, text from forms and quotes (except fields marked sensitive) is sent to the AI provider in section 3 to produce drafts and scores. Input is shortened first. Drafts are never sent to a visitor without the merchant's confirmation. We use the provider's service under terms that [OWNER: confirm the provider's data use terms, including that prompts are not used to train models].
6. Security
- Personal data fields and access tokens are encrypted with AES-256-GCM; traffic is over HTTPS.
- Every store's data is separated from every other store's, and tests check that one store cannot read another's.
- Logs contain identifiers and codes, not personal data.
- Our staff sign in with a strong password and a second factor. Console screens show metadata, not customer data; viewing a store's customer data needs a stated reason and a time-limited permission, and every such action is written to an audit log we cannot edit.
- Uploaded files are scanned for malware and served only by short-lived links.
- Backups: [OWNER: describe the encrypted, off-server backups and the restore test once they exist; see the security notes].
- If a personal data breach affects you we will tell the merchant without undue delay, and the merchant can then meet their own duty to notify. See also
docs/security/INCIDENT-RESPONSE.mdfor the internal procedure.
7. Your rights
If you are a customer of a store: you can ask the store to give you a copy of your data, correct it or delete it. The store can export and erase a customer's data from the app, and Shopify's customer data requests reach us as well. If you are a merchant: you can export all your data and delete it from Settings, Privacy, or by uninstalling. You may also complain to your data protection authority. To use a right with us directly, write to [OWNER: privacy email].
8. Children
QuoForm is for businesses and is not directed at children. [OWNER: add if your lawyer requires a statement.]
9. Changes
We will post changes here and tell merchants in the app or by email before a material change takes effect. Last updated: [OWNER: date].
10. Contact
[OWNER: company name, address, privacy email, DPO if any].