Privacy Policy
We collect only what we need to run your account and provide the service. We do not sell your data. We do not run ads. Your quote data and customer information belongs to you. Payment details are handled entirely by Stripe. We never see or store your card number. You can request a copy of your data or ask us to delete it at any time.
- 1. Who we are
- 2. What data we collect
- 3. How we use your data
- 4. Legal basis for processing (PIPEDA & GDPR)
- 5. Data we do not collect
- 6. How we store and protect your data
- 7. Data retention
- 8. Third parties and sub-processors
- 9. Your rights
- 10. Cookies
- 11. Children's privacy
- 12. Changes to this policy
- 13. Contact us
1. Who we are
SimplyQuoting (“we”, “us”, “our”) is a cloud-based quoting platform operated by SullySoft. SimplyQuoting is the product name and service brand, while SullySoft is the business that provides, manages, supports, and bills for the platform.
This Privacy Policy explains how SullySoft collects, uses, stores, and protects personal data when you use SimplyQuoting, including our website at simplyquoting.com and our application at simplyquoting.app.
This policy applies to all account holders, trial users, and visitors to our website. By creating an account or using the platform, you agree to the practices described in this policy.
2. What data we collect
We collect only what is necessary to provide and operate the service.
| Data type | What it includes | When collected |
|---|---|---|
| Account data | Name, email address, password (hashed), business name, phone number, country | On registration |
| Billing data | Subscription plan, billing cycle, invoice history. Card data is handled by Stripe, we never store it | On subscription |
| Quote data | Quotes you create, including line items, pricing, notes, and customer contact details you enter | During platform use |
| Engine input data | DXF files uploaded for WaterJet quotes; dimensions and specifications entered for Construction quotes | During quote creation |
| Usage data | Log data, feature usage, pages visited, browser type, IP address, session timestamps | Automatically, during use |
| Communications | Emails you send to our support team and our responses | When you contact us |
We do not collect payment card numbers, CVCs, or bank account details. All payment processing is handled by Stripe. See Section 8 for details.
3. How we use your data
We use your data only for the following purposes:
- To create and manage your account and provide access to the platform
- To process your subscription and manage billing through Stripe
- To operate the quoting engines and generate quote outputs on your behalf
- To send transactional emails: including quote submission alerts, account notifications, and billing receipts
- To respond to support requests and resolve account issues
- To improve the platform through anonymised usage analysis
- To comply with legal obligations where required
We do not use your data for advertising. We do not sell your data. We only share data with service providers needed to operate, secure, support, and bill for the platform, or where required by law.
4. Legal basis for processing (PIPEDA & GDPR)
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we rely on your consent (given at account creation) as the basis for collecting and using your personal data.
For customers located in the European Economic Area (EEA), we process your data under the following lawful bases under GDPR:
- Contract — processing necessary to provide the service you have subscribed to
- Legitimate interests — improving the platform, preventing fraud, and securing the service
- Legal obligation — retaining records as required by applicable law
- Consent — for any optional communications such as product updates or newsletters
5. Data we do not collect
To be explicit about what we do not do:
- We do not collect, store, or process payment card numbers, expiry dates, or CVCs
- We do not run advertising or tracking pixels on our platform
- We do not build advertising profiles or sell data to data brokers
- We do not collect sensitive personal data such as health information, government ID numbers, or financial account details
- We do not knowingly collect data from children under 16
6. How we store and protect your data
All data is stored on secure servers hosted by Cloudflare in North America. We apply the following safeguards:
- All data in transit is encrypted using TLS 1.2 or higher
- All data at rest is encrypted using AES-256
- Passwords are hashed using a one-way algorithm, we cannot retrieve your password
- Access to production systems is restricted to authorised personnel only
- We conduct regular security reviews and apply patches promptly
No method of transmission over the internet or electronic storage is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.
7. Data retention
We retain your data for as long as your account is active. Specific retention periods are as follows:
- Account & quote data — retained while your subscription is active and for 60 days following cancellation or termination. After 60 days, all data is permanently and irrecoverably deleted.
- Billing records — retained for 7 years as required by Canadian tax and accounting regulations
- Support communications — retained for 2 years to allow resolution of follow-up issues
- Usage logs — retained for 90 days for security and debugging purposes, then deleted
It is your responsibility to export any data you wish to retain before your 60-day post-cancellation window closes. We strongly recommend exporting your quote history before cancelling.
8. Third parties and sub-processors
We use a small number of trusted third-party services to operate the platform. These sub-processors are contractually bound to handle your data securely and only for the purposes we specify.
| Provider | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing and subscription billing | Name, email, billing address, subscription details. Card data goes directly to Stripe, we never receive it. |
| Resend | Transactional emails (quote alerts, receipts, notifications) | Name, email address, email content |
| Cloudflare | Cloud infrastructure and data storage | All platform data, stored encrypted |
| Google Analytics | Anonymised usage analytics | No personal data. Anonymised page views and feature usage only |
| Microsoft Clarity | Session recording and heatmap analytics to understand how visitors use the site | No personal data. Anonymised interaction data (clicks, scrolls, page navigation) |
We do not sell your data. We only share data with service providers needed to operate, secure, support, and bill for the platform, or where required by law.
9. Your rights
You have the following rights with respect to your personal data. To exercise any of these rights, contact us at privacy@simplyquoting.com. We will respond within 30 days.
10. Cookies
We use a minimal set of cookies necessary to operate the platform:
- Session cookies — to keep you logged in during your session. These are deleted when you close your browser.
- Preference cookies — to remember settings such as your billing toggle preference. These persist for 30 days.
- Analytics cookies — anonymised usage data only, with no personally identifiable information. You can opt out at any time.
We do not use advertising cookies, tracking pixels, or third-party behavioural cookies of any kind. You can control cookies through your browser settings at any time.
11. Children's privacy
SimplyQuoting is a business tool intended for use by adults operating a business. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us immediately at privacy@simplyquoting.com and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email at least 14 days before they take effect.
The date at the top of this page indicates when the policy was last updated. We encourage you to review it periodically. Continued use of the platform after changes take effect constitutes your acceptance of the updated policy.
13. Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:
Attn: Privacy Officer
Ontario, Canada
Email: privacy@simplyquoting.com
We aim to respond to all privacy-related requests within 30 days. For complaints that cannot be resolved directly, you may contact the Office of the Privacy Commissioner of Canada.
Note: This Privacy Policy is provided as a starting point tailored to Canadian law (PIPEDA). If you have customers in the EU/EEA, additional GDPR obligations may apply. SimplyQuoting recommends having a qualified legal professional review this policy before publishing.