GDPR, and what actually happens

The right to be informed

Our Privacy Notice says what we hold, why, and for how long, and it is linked from every page. A trader's customer is told, on the quote itself, that it is being sent through QuoteNod and who the trader is.

The right of access

A trader can export everything on their account from Settings, at any time, without asking us. Their customers ask them; the customer record page puts every quote, contract, invoice and payment for one person on a single screen, so the answer does not take an afternoon.

The right to rectification

A quote is editable until it is sent. Customer details are edited on the customer record and follow through to everything not yet signed.

The limit: A signed quote cannot be altered — that is the point of the signature. It is corrected by issuing a new one, and both are kept.

The right to erasure

A trader can erase a customer from inside QuoteNod. It destroys the name, contact details, every address, the wording of the quotes, all signatures including the drawn image, and every PDF, deleted from storage. It is permanent: we hold no copy to restore from and support cannot undo it. The trader signs the instruction; we record that they did, and record nothing about the person erased. A whole trader account is deleted the same way from Settings.

The limit: Invoice rows survive, carrying a number, a date and an amount, with no name on them. A business must keep its records for six years, and Article 17(3)(b) says the right to erasure does not override a legal obligation. Nothing that survives identifies anybody.

The right to restrict processing

Revoking a share link stops a quote being opened by anybody while a dispute is settled, without deleting it. A closed quote is read-only.

The right to data portability

The export in Settings is machine-readable, and the PDFs are ordinary PDFs. Nothing needs our permission or our software to be read afterwards.

The right to object

Nothing in QuoteNod is marketing to a trader's customers. Every email a customer receives exists because they did something — a quote was sent to them, they signed it, they were invoiced. Our own marketing to traders carries an unsubscribe link in every message.

Rights around automated decision-making

There is none. No profiling, no scoring, no automated decision that produces a legal or similarly significant effect. The in-app helper answers questions about using QuoteNod and decides nothing.

Storage limitation

A notification that has been read is put away after 30 days and deleted after 60, so an account does not accumulate a running commentary on somebody’s jobs for ever. One that has not been read is left alone however old it is — a notice about an unanswered quote is the one thing that should not quietly disappear while a trader is away. Deleting a notification deletes the notification and not the event behind it, because that is the job’s history.

Integrity of the evidence

A copy of a signed document is the sealed file itself, sent again unchanged. QuoteNod does not regenerate it, re-date it or stamp anything across it — the hash held against that file is what makes it evidence, and a document rebuilt in order to be sent again is no longer the document that was signed. That it is a copy, and every date involved, is said in the covering message instead, and each copy is recorded against the job with the address it went to.

Data minimisation

A quote nobody answers closes after 30 days, and its link and access code are destroyed — so a stranger's name and address are not held for years because of a job that never happened. The trader is warned a week beforehand and can keep it open.

Integrity and confidentiality

A share link carries 192 bits of randomness and, on its own, opens nothing: the customer is emailed a six-digit code separately, and it is stored only as a hash — the trader cannot see it and neither can we. That is deliberate. A signature that the trader could have produced themselves would prove nothing. The same code guards everything a customer signs: the quote, the confirmation that the work is done, and any change to a payment plan.

Protecting the trader’s account

Every customer record sits behind the trader’s sign-in, so that sign-in is where the protection has to be. Traders can switch on two-factor authentication — a six-digit code from an authenticator app alongside the password — and are told by email of any sign-in from a new device, any run of wrong codes on their documents, and any change to their two-factor settings. Recovery codes and the app’s secret are stored so that neither QuoteNod nor anyone reading the database can use them.

Putting a mistake right

A trader who mistypes a customer's email can correct it, and doing so revokes the link that went to the wrong address and destroys the code with it. QuoteNod tells them, at that moment, that a wrong address may have disclosed data to somebody who should not have had it — because the trader is the controller and that is their call to make, not something to be quietly tidied away.

Accuracy

Every signed document is bound to the quote content by a cryptographic hash. If a stored quote is altered after signing, verification fails loudly rather than quietly showing a document that no longer matches what was agreed.

Storage limitation

Records of quotes, signatures, invoices and payments are business records and are kept for six years, the period the law requires; they are not removed from an open account, though a trader can erase a customer at any time. A closed account is kept intact for three months so it can be reopened by logging in, with every customer record still there; after that it is purged, signatures included, and backups expire on a fixed schedule. Interest registrations are kept until launch and up to 12 months after, or until somebody unsubscribes.

Accountability

Every erasure is recorded with the name of the person who instructed it, the date, and what was destroyed. Every quote carries its own history — sent, opened, signed, paid — which is what an enquiry actually asks to see.