Privacy notice

1. What information do we collect?

2. Where does information come from?

We receive information directly from you when you register, upload documents, use the service or contact us. We also receive information from services used for authentication and payments.

Information about suppliers or other people may come from quotations uploaded by a user. If your information appears in an uploaded quotation, you can contact us even if you do not have a WhatQuotesBest account.

3. How do we use information?

We use personal information to:

• Create and manage accounts.
• Process quotations and produce summaries, comparisons, questions and reports.
• Store projects and make results available to the account holder.
• Process purchases and manage subscriptions and usage allowances.
• Answer support enquiries and investigate problems.
• Protect accounts and the service against misuse.
• Maintain necessary business and payment records.
• Handle privacy requests and legal obligations.

Where processing is necessary to provide a service you requested, the relevant basis may be taking steps at your request or performing a contract. Necessary security, support and service administration may involve legitimate interests, where those interests are not overridden by your rights. Legal obligations may apply where records must be kept or a lawful requirement must be answered.

The operator must identify and document the lawful basis that applies to each purpose and circumstance. Where processing requires consent, we will explain the specific purpose and ask separately. Accepting this notice is not blanket consent to every use of personal information.

Information about people who are not parties to a customer contract requires its own appropriate lawful basis. A customer uploading a document does not, by itself, provide consent from everyone named in it.

4. How are quotations processed?

When you upload a quotation, the application extracts selectable text from PDFs using PDF.js. For scanned PDF pages and uploaded images, it prepares the image locally and uses Tesseract OCR on the application server. The inspected quotation-processing path does not send uploaded quotation files to an external OCR or generative-AI service.

The service organises quotation information into summaries, comparisons, source references and questions to ask suppliers. Processing can misread, omit or misclassify information. Check important details against the complete original quotation before relying on a result.

Automated quotation processing helps you understand documents. It does not select a supplier or make a decision for you. Downloaded reports may remain on your device or wherever you choose to save them.

5. Which services help us operate WhatQuotesBest?

The service uses providers for application hosting, authentication, file storage, payments, database infrastructure and support communications. The application is hosted on Replit and uses Replit App Storage for uploaded quotation files. Clerk provides sign-in through the application’s Replit-managed authentication integration. Stripe processes payments and subscriptions. The monitored support and privacy address uses Microsoft Outlook.

The application stores account, project, quotation and billing records in a PostgreSQL database. The database host and region are not identified in the application code or available deployment configuration.

Providers receive information relevant to their services. Their legal roles can differ by activity; the arrangements that apply to this service need to be confirmed. Information may also be disclosed where necessary to comply with law, respond to a valid legal request, or establish, exercise or defend legal claims.

6. Where is information processed?

The hosting, authentication, payment, storage and email providers may process information in more than one country, including through their support teams and subprocessors. The locations and transfer safeguards that apply to this service have not been verified. Email whatquotesbest@outlook.com to ask about arrangements relevant to your information.

7. Cookies and browser storage

The Clerk sign-in integration uses browser session technologies. The application also saves a preference cookie when its sidebar is opened. Stripe-hosted checkout and other providers may use cookies or similar browser technologies when you use their services.

No separate analytics or advertising integration was found in the application code inspected; this does not establish what technologies providers use. You can manage cookies through your browser settings, but blocking technologies needed for sign-in or security may prevent parts of the service from working.

8. How long is information kept?

The application does not currently have a verified, published retention schedule for account records, projects, quotation files, support messages, billing records, logs or backups. Information may remain in the application while it is needed to provide the service or until it is deleted using the available controls. Provider retention and backup arrangements are separate.

A paid project’s 30-day processing window is a usage limit. It does not mean that uploaded information is automatically deleted after 30 days; existing results may remain available while stored.

A pending upload reservation expires after 14 minutes, after which it can no longer be completed. The application code inspected does not include an automatic cleanup job for expired or abandoned upload files, so that expiry is not a promise that the file itself is deleted.

Please download reports you wish to keep. The service is not a permanent document archive.

9. Exporting and deleting information

The signed-in dashboard provides a ZIP export of account profile fields, projects and quotations, application billing metadata, pending upload records, uploaded quotation files and files associated with pending uploads. The export does not include sign-in sessions or storage object paths.

You can delete an individual quotation or project, or request account deletion by typing DELETE in the dashboard. Account deletion attempts to stop related Stripe subscriptions and open checkout sessions, remove application records and files, and delete the Clerk sign-in identity. If billing cancellation or file removal fails, deletion stops before application records are removed; some earlier steps may already have happened, and you can retry. If sign-in identity deletion fails after application data has been removed, retrying may be needed to finish.

Deleting an account does not refund previous payments. Stripe and other providers may retain separate payment records, logs or backups under their own legal and operational arrangements. Deleting a project does not cancel a monthly subscription; use the billing-management route or contact support to stop future renewals.

Before deleting a project or account, download information you want to keep. If deletion fails or needs further action, email whatquotesbest@outlook.com for assistance.

10. How is information protected?

The application requires sign-in for account, project and quotation routes and checks account ownership. Uploaded quotation files are assigned private access controls; the application does not provide public sharing of customer projects or quotation files. Upload links are time-limited, and access to stored files is checked by the application.

No online system can guarantee absolute security. We do not make a blanket claim about encryption, provider backups or access by provider personnel. Email whatquotesbest@outlook.com if you believe your account or information has been accessed without permission.

11. Your privacy rights

Depending on the circumstances and the law that applies, you may have rights to:

• Obtain access to your personal information.
• Correct inaccurate information.
• Request deletion or restriction of use.
• Object to processing in circumstances provided by law.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent.

12. Complaints and contact

For privacy questions or requests, email whatquotesbest@outlook.com. This inbox is monitored. Do not send passwords, sign-in codes, full payment-card details or quotation files by email.

Depending on the law that applies to you, you may be able to complain to a data protection regulator. If UK data protection law applies, the Information Commissioner’s Office provides information about making a complaint.

13. Changes to this notice

We may update this notice when the service or the way information is handled changes. The current version will be posted on this page. If a change requires notice under applicable law, we will provide it as required.