Privacy policy

1. Who is responsible

Quotea is a trading name of Blue Ocean Code Ltd, company number 11626451, registered at C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, England, BH21 7SB.

Blue Ocean Code Ltd is the controller for account, billing, marketing, security and service-administration information. Contact us at [email protected].

When a trade business places its customer’s information in a quote, that trade business is normally the controller and we process the information on its behalf. Customer recipients should contact the trade business first about the content of a quote or their privacy rights. Our data-processing terms govern that relationship.

2. Information we use and why

For shared quotes, Quotea records a qualified open only after the quote has rendered in a visible browser for a short period. We exclude obvious scanners and preview tools and deduplicate rapid reloads. This tells the trade business that the quote link was opened; it does not identify who opened a forwarded link, and we do not use browser fingerprinting for this purpose.

3. Automated drafting and website lookup

When you ask Quotea to draft a quotation, the job notes are sent to Amazon Bedrock so a model can produce suggested structured wording. You must review that wording before it is shared. Quotea does not use this process to make legal or similarly significant decisions about people.

If you provide a business website during setup, Quotea retrieves the public page and linked branding assets to suggest business details, a logo, colour and trade category. You choose whether to use the result.

If you choose voice input, including while trying the homepage preview before signup, your browser sends the recording to Quotea and Amazon Transcribe turns it into literal notes in British English. Voice input does not create, change, save or send a quote by itself. We do not run a second AI writing pass over the transcript; you can check and edit the notes before asking Quotea to draft a quote.

4. Where information comes from

We receive information:

• directly from you when you join, sign in, set up a business or create a quote;
• from Google when you choose Google sign-in;
• from public business websites you ask us to examine;
• from Stripe about subscriptions and payments;
• from quote recipients when they view or accept a shared quote; and
• automatically from your browser or device when needed for security and consented advertising measurement.

5. Who we share information with

We use a small number of providers to run Quotea:

• Amazon Web Services for server hosting, encrypted backups, transactional email, Bedrock quote generation and temporary voice transcription;
• Cloudflare for domain services, secure traffic routing and protection;
• Stripe for subscriptions, payment processing and VAT invoices;
• Google for optional Google sign-in and, only after marketing consent, Google Ads conversion measurement;
• Loops for historical launch-list email delivery while those earlier registrations remain relevant; and
• professional advisers, insurers, courts, regulators or authorities where reasonably necessary or legally required.

We do not sell personal information. We do not give quote-customer information to data brokers or use it for Quotea’s own advertising.

6. International transfers

Quotea uses UK and EEA infrastructure. Voice recordings are processed temporarily by Amazon Transcribe in AWS's Ireland region (eu-west-1). Some providers may process information in other countries. Where UK-protected personal data is transferred outside the UK, we use an applicable adequacy decision or contractual and organisational safeguards required by UK data protection law. Contact us if you want more information about the safeguard used for a particular provider.

7. How long we keep information

We keep information only for as long as it is reasonably needed for its purpose:

• account, business and quote information is generally kept while the account is active and for a limited period afterwards to support recovery, disputes and deletion requests;
• an unclaimed homepage preview expires after 24 hours and is removed by routine cleanup; when you keep it, its quote and brand are moved into your account and duplicate job and customer content is removed from the preview record;
• historical launch-list information is kept only while that earlier relationship remains relevant or until you unsubscribe or ask us to remove it;
• expired authentication, rate-limit, temporary brand-import and email-delivery records are removed through operational cleanup;
• voice recordings and Amazon Transcribe output are normally deleted as soon as the transcript has been delivered or discarded; a one-day storage lifecycle is the final cleanup safeguard, and non-content job metadata is removed after 31 days;
• billing, VAT and accounting records are normally retained for at least six years where UK law requires it; and
• deleted live information may remain in encrypted, access-restricted disaster-recovery backups until those backups are retired. Backup copies are not used for ordinary product activity.

The exact period can vary where we need information to establish or defend a legal claim, resolve a dispute, prevent fraud or comply with law.

8. Security

We use access controls, encryption in transit, restricted server and database roles, encrypted sensitive email payloads, rate limits, security logging and encrypted off-server backups. No online service can promise absolute security, but we design Quotea to minimise access and retain only what the product needs.

9. Cookies and advertising

Necessary browser storage remembers your cookie choice. Google Ads code does not load and no Google conversion is sent unless you grant marketing consent. If you consent and then successfully create your first Quotea business by keeping a homepage quote, we may send Google your normalised account email using Enhanced Conversions to measure the advert. Google handles the required processing; we do not put the email in URLs or ordinary analytics properties.

Read the Cookie policy or use Cookie settings in the footer to change your choice. Withdrawing consent stops future optional tracking from Quotea on that browser.

10. Your rights

Depending on the circumstances, UK data protection law gives you rights to:

• be informed about processing and access your personal information;
• correct inaccurate or incomplete information;
• ask for erasure or restriction;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format; and
• withdraw consent at any time without affecting earlier lawful processing.

Email [email protected] to exercise a right. We may need to verify your identity. If the request concerns a quote sent by a trade business, contact that business first; we will assist it as processor.

You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the chance to resolve the concern first.

11. Children

Quotea is a business service and is not intended for children. Do not create an account if you are under 18.

12. Changes and contact

We may update this policy as Quotea changes. We will make material changes clear in the service or by email where appropriate.