Privacy notice

• Kwote is run by Janke Breugem, trading as Kwote, in the Netherlands ("we").
• Contact: kwoteapp.za@gmail.com.
• Kwote's server, backups and sign-in run on Amazon Web Services (AWS) in Frankfurt, Germany.
• The sign-in page at auth.kwoteapp.com is delivered through Amazon CloudFront, AWS's worldwide network, so your connection to it may pass through an AWS location near you. Your sign-in account itself is kept in Frankfurt.
• Our mailbox is Gmail (see "If you email us").

• kwoteapp.com sets no cookies, stores nothing on your device and runs no analytics.
• It loads nothing from other companies, not even fonts.
• Our server uses your IP address only to send you the page.
• We keep no access logs. If a request fails, an error log may hold its IP address until the next deploy, when the log is cleared.
• Legal basis: our legitimate interest in a working, secure website (GDPR art 6(1)(f)).

• We use your name, email address and message to answer you.
• If you ask to join, we also use them to set up your company in Kwote.
• Legal basis: steps you ask for, before an agreement or under one (art 6(1)(b)). Otherwise, our legitimate interest in answering you (art 6(1)(f)).
• We keep the email in which a company accepts our beta terms. It shows what was agreed. Legal basis: our legitimate interest (art 6(1)(f)).
• Our mailbox is Gmail. Google may process it outside the EU, for example in the United States, under the EU-U.S. Data Privacy Framework.
• Please don't email us your clients' details.

• The form at app.kwoteapp.com/request asks for your business name, your name and your email address.
• We use them to answer your request. If we accept it, we use them to set up your company in Kwote and send your invitation.
• Legal basis: steps you ask for, before an agreement (art 6(1)(b)).
• Your request stays on our server in Frankfurt. It is never in our off-site backups; the server's own snapshots keep it for up to 7 more days.
• We get a short alert email that a request is waiting. It does not hold your details.
• We delete the request when we accept or decline it, or after 30 days. If we accept it, your details become your Kwote account (see "Kwote accounts").

What we keep

• Your name, email address and role in each company (owner, admin or staff). If you were invited, your company's owner or admin gave us these.
• Your sign-in at Amazon Cognito: email, name, password, authenticator app and, if you add one, a passkey (a public key and the device's name; the private key never leaves your device). Kwote never sees your password or your codes.
• Your signed-in devices: a label such as "Chrome on Windows", when you signed in and when you last used it. We keep no IP address: the app keeps no access logs either.
• An activity log: invitations, role changes, people paused or removed, support access, backup downloads, imports and restores. Each entry says who, what and when.
• Our own log: devices you signed out, and changes we make to companies.

You need an email address and an authenticator app to have an account.

Why we keep it

• To let you sign in.
• To keep each company's data separate and safe.
• To show your company who has access and what changed.

Legal basis

• If you run your business in your own name and accept our beta terms: the agreement (art 6(1)(b)).
• For everyone else (the people a company invites, and the owner who accepts for a company): the legitimate interest of that company and of us in secure access (art 6(1)(f)).
• For everyone's logs and device records: that same legitimate interest (art 6(1)(f)).

Who sees it

• Your company's owners and admins see its people, invitations and activity log.
• Only you and we see your devices.
• Only we see our own log.
• We open a company's data only when its owner turns on support access or asks us, or when we must do so to keep Kwote running.
• You sign in on Amazon Cognito's pages.
• Amazon also sends the invitation and password-reset emails.

Cookies and browser storage

Name	What it does	How long
__Host-kwote_cloud	Keeps you signed in (a random code)	At most 12 hours, or 30 days on a device you mark as your own
__Host-kwote_login	Completes your sign-in	10 minutes
kwote_reloaded	Says your last click did not go through because Kwote was just updated	60 seconds
kwote-unsaved-… (session storage)	Keeps work you were saving if an update reloads the page	Until the save finishes or you close the tab
kwote-preview-… (local storage)	Shows unsaved changes in the print and theme previews. It holds that document, client details included	Removed the next time you make or open a preview once it is more than an hour old. Until then it stays in your browser

• All of these are strictly necessary for the service you ask for. So they need no consent (Dutch Telecommunications Act, art 11.7a(3)), and there is no cookie banner.
• None of them track you.
• Session storage and local storage stay in your browser. Our server never reads them.
• Amazon Cognito's sign-in pages set their own cookies. Sign-in needs them.
• On a shared computer, sign out and clear the browser when you are done.

• Companies use Kwote to keep their clients, contacts, quotes, invoices and sent emails.
• The company is in charge of that data. It is the controller, or "responsible party" under South Africa's POPIA.
• We handle that data only on the company's instructions, under our beta terms. We are its processor ("operator" under POPIA).
• Are you a client of such a company? Then ask the company. It must tell you how it uses your information.
• If you write to us, we pass your request on.
• Documents a company emails from Kwote go out through that company's own mailbox, not ours.

• AWS in Frankfurt: our server, backups and sign-in (Amazon Cognito). The sign-in page is delivered through Amazon CloudFront (see "Who we are").
• Google: our Gmail mailbox.
• A company's own mail provider: the documents that company sends.
• Authorities: only when the law requires it.
• We don't sell data, show ads or use data to train AI.

• We keep Kwote's data in the EU.
• Most users are in South Africa, so data reaches them there when they use Kwote.
• South Africa has no EU adequacy decision: the EU has not declared its data protection adequate.
• For company data, our beta terms with each company include the EU standard contractual clauses (2021, module 4). Company data here includes the team details that a company's owners and admins see.
• Ask us for a copy.

What	How long
Website IP addresses	Only while the page is sent; a failed request's error log until the next deploy
Emails to us	2 years after the conversation ends
Invite requests	Until accepted or declined, or 30 days; server snapshots: 7 days more
A company's email accepting our terms	5 years after the agreement ends
Your Cognito sign-in	Deleted when you are removed from your last company
Passkeys	Until you remove them, or with your Cognito sign-in
Your account record, and a sign-in from an invitation you did not accept	Deleted at our monthly check once you belong to no company
Signed-in devices	Until that sign-in ends
Invitations	While the company uses Kwote
Activity log	While the company uses Kwote, including what you did before you left
Our own log	2 years
Company data	While the company uses Kwote; deleted within 30 days after it leaves
Backups: server snapshots	7 days
Backups: daily copies, and copies made before an update	35 days
Backups: monthly copies	400 days (about 13 months)

Off-site backup copies are gone for good 7 days after their period ends.

• HTTPS everywhere.
• Everyone signs in with a password and an authenticator app.
• Each company has its own database.
• Kwote checks your role on every request.
• Mailbox passwords and sign-in tokens are stored encrypted.
• Off-site backups are encrypted at rest and stay in Frankfurt.
• Only Janke Breugem can reach the server.

You can ask us to:

• show you your data;
• correct it;
• delete it;
• limit its use;
• give you the data you gave us in a reusable file.

You can also object to any use based on legitimate interest.

• To use a right, email us. We answer within a month.
• We make no automated decisions about you.
• You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.
• If you are in South Africa, you may also complain to the Information Regulator: inforegulator.org.za.

• We update this notice when something changes.
• We email account holders about important changes.