Version 2026-10-10
QuoteNod Privacy Notice (v2026-10-10)
Who we are. QuoteNod Ltd ("QuoteNod", "we") provides quote approval and invoicing for trade businesses. We are a company registered in England and Wales, company number 17446525, with our registered office at 124 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office under reference ZC242574. You can reach us at contact@quotenod.co.uk.
For trader account data we are the controller. For customer data traders enter, the trader is the controller and we are their processor. For the details a trader holds about the people on their team, the trader is the controller — those are their employment records — and we are their processor.
What we collect. Trader accounts: email, password hash, business details, usage records. Customer records (on behalf of traders): names, contact details, site addresses, what was quoted, invoiced and paid, messages exchanged on a job, photographs and files put on a job, and — when a quote is approved — a signature image with timestamp and technical metadata. Team records (on behalf of traders): each team member's name, email address, work telephone number, position, photograph, role, rota, holiday and sickness records, hours worked, pay rate and the pay the trader recorded; a team member's own password hash and two-factor secret, held for them as for a trader.
Your business's legal details. If you give us your business's legal details we keep them with your account and print them on the documents, pages and emails your customers receive. A certificate or card you upload is kept for your own records and is not shown to your customers. Both are in your records download and are deleted with your account.
Business customers. If a trader tells us you are a business they may record its name, its VAT number, its Companies House number and your reference for their invoice. These print on your quote, invoice and receipts and are erased with the rest of your record.
Your team's data, if you are a team member. If your employer has given you a sign-in to their QuoteNod account, the details above are held on their account under their instructions, and they are the controller: questions about what is held, and requests to see, correct or erase it, go to them, and we help them answer. What you do while signed in — the quotes you write, the jobs you clock, the photos you put on a job — is recorded on their account as their business record. Your password and two-factor secret are yours; nobody else can read them. Your name, position, work number and photograph are shown to a customer when you are on your way to their job, in an email your employer chose the words of.
Why (lawful bases). Providing the service (contract); service emails, security and fraud prevention (legitimate interests); updates about QuoteNod to people who registered their interest or hold an account (consent, or legitimate interests where the law allows it for an existing customer).
Emails about QuoteNod. Interest registrations are stored so we can tell you when QuoteNod launches and, after launch, send occasional updates about the product. Every one of those emails carries a one-click unsubscribe link that works without signing in and takes effect straight away; we keep a record that you unsubscribed so that you are not contacted again. You can also object at any time by replying to any email or writing to contact@quotenod.co.uk. Service emails about your own account and documents are not marketing and continue while your account exists.
Taking payment through a trader's own Stripe or GoCardless account. A trader can connect an account they hold with Stripe or GoCardless so that their customers can pay online. That account is the trader's, under the trader's own agreement with the provider, and the provider acts for the trader, not for us. To keep the connection working we hold the provider's reference to the account and, for GoCardless, an access token, which is encrypted before it is stored, is never written into a page, a log or an error message, and is destroyed when the trader disconnects or deletes their account. When a customer presses Pay we send the provider only what it needs to take that payment: the amount, a description naming the trader's business and the quote reference, and a reference of our own so the payment can be matched. We send no customer name, email address, postal address or signature. The customer enters their own bank or card details on the provider's page, and the provider holds them as its own controller; we never see them. Back from the provider we receive whether the payment succeeded, whether it was made by bank or card, and the provider's own reference for it. Our lawful basis is the performance of our contract with the trader, who asked us to take payment this way.
Moving a trader's data to another QuoteNod account. A trader can ask for everything in their account to be moved to another QuoteNod account, which must accept. To do that we check that an open account exists for the email address they give, and we show them the business name on it, so that they can confirm the details are right. Both accounts are then emailed and notified at each step. When the transfer runs, the trader's customers' details, quotes, signatures and payment records are moved — not copied — to the receiving account, whose holder becomes the controller of that customer data. We keep a record of the transfer (the two accounts, when it was asked for, accepted and run, and how many records moved) for as long as either account exists. Our lawful basis is the performance of our contract with each trader.
Billing a trader's contract fees. When a customer signs a quote we keep a billing record for QuoteNod's contract fee: the quote reference, the job title, the customer's name as it appears on the quote, the date and time of signing, and whether the fee was charged. It is kept so the trader can see what each charge was for, and it stays even if the trader later deletes the quote, because the fee does. It is deleted with the trader's account, and nothing about the customer is sent to our payment processor — the line on the trader's bill gives only the number of contracts. Our lawful basis is the performance of our contract with the trader, and our legitimate interest in being able to show why a fee was charged.
Emails we send to a trader's customers. Where a trader uses QuoteNod to collect payment, we email their customer about that job on the trader's behalf: the payment link when the quote is approved, a reminder the day before each payment is due and on the day, up to three reminders after a date has passed, and then no more. Receipts, completion certificates, access codes and anything else the job needs are sent the same way. The trader is the controller for these; QuoteNod is their processor, and the customer agrees to them in the contract terms they approve. They carry the trader's business name, they are about that job only, and they are never marketing — neither ours nor the trader's. We do not use a customer's address for anything else and never pass it to anyone for their own marketing. A customer who does not want reminders should tell the trader, who can turn them off for that job by settling or changing the schedule; the duty to pay is unaffected either way.
Nod, the in-app helper. Signed-in traders and their team can open Nod and ask questions — about using QuoteNod, and about their own account. It is an AI assistant provided by Google LLC. What you type, the rest of that conversation, our help articles, your first name and trade, and a short briefing of the account — the live jobs with their references, titles, status and amounts; today's diary; open tasks; the team and their roles — are sent to Google, who generate the answer and return it.
What Google does not see. Before the briefing and your question leave QuoteNod, every customer's name and every colleague's name in them is replaced with a token (CUSTOMER_2, PERSON_1), and email addresses and phone numbers are taken out. Google sees the tokens; the real names are put back into the answer on our servers, and they are shown to you highlighted so you can see what was filled in. Signatures, documents, photographs, site addresses, bank details and your customers' contact details are never sent at all. The same veil sits in front of the owner's own Nod, which reads QuoteNod's business figures: trader names, addresses and the words of support tickets go out as tokens, never as themselves.
Read this part before you use it. We use Google's no-cost tier, and Google's terms for that tier allow Google to use what is sent and what is returned to provide, improve and develop their products and services, including their AI models. In plain terms: treat anything you type into Nod as leaving QuoteNod's control, even with the veil in front of it. Do not put passwords, card numbers or bank credentials into it — we will never ask for them. Google's terms are at ai.google.dev/gemini-api/terms.
What Nod can do. Nod can propose an action on your account — book a signed job, put a photo on a job, hand a job to a colleague, add a task — and shows it to you as a card. Nothing happens until you confirm the card, and the card and your answer are kept on your account with the conversation.
Nothing is sent unless you ask a question: if you would rather not use the helper, do not open it, and no data of yours reaches Google. We keep the conversation on your own account so you can pick it up on another device and so a ticket carries what was already said; it is deleted with your account. Separately, the helper keeps a shared list of the questions it has been asked and the answers it gave, so that a question somebody else has already had answered can be answered instantly without being sent to Google again. That list is not linked to any account; email addresses, phone numbers, postcodes and long numbers are removed from a question before it is kept; and it is reviewed by us, who can delete any entry. Answers can be wrong — the helper is not advice, and anything it cannot answer is passed to a person.
Referrals. If you use your referral link, we record which account signed up through it and when their subscription started, so that a free month can be earned. Somebody who follows your link is not told who sent it before they sign up, and you are never told the name or email of anyone who joined through your link — you see only how many have reached three months. If you signed up through somebody else's link, we record that fact against your account so their referral can be counted; it changes nothing about your price, your trial or your data. This is a service the two of you are in, so the lawful basis is our legitimate interest in running it, and you can ask us to detach a referral record from your account at any time.
Signatures. Signature images are personal data. They are stored encrypted, bound to the signed quote by a cryptographic hash, and shared only with the trader who sent the quote and the customer who drew it. Proof of a signed contract. Either party to a signed quote can ask us for proof that it was signed and of what was signed — the signed PDF, the date and time, the details given at signing and the integrity check — and we give it to them exactly as the record holds it, on the basis of the contract between them and our legitimate interest in the record being usable as evidence by the people it belongs to. We give the same to a court, ombudsman or regulator that lawfully requires it. We do not give it to anybody else.
Reports about traders. Anyone can report a trader to us from the website. We keep the report — the reporter's name if given and email address, the trader's business name, the quote number where given, and what was said — for as long as the trader's account exists and for six years after it closes, as our record of how a complaint was handled. The reporter's identity is not given to the trader. A trader's strikes, appeals and the evidence attached to an appeal are kept on the same terms. Screenshots and files attached to a report are the exception: they are deleted 30 days after the report is decided, and the report itself — who, what and the decision — is kept as above. The email address of a banned account is kept on a list the sign-up form checks, for as long as the ban stands, and that list is the one thing about a banned account that survives its deletion.
Retention. Interest registrations are kept until launch and for up to 12 months afterwards, or until you unsubscribe or ask us to delete them.
Account data is kept while the account is open. Records of quotes, signatures, invoices and payments are business records — the trader's, and where they record what we charged the trader, ours — and are kept for six years, the period the law requires such records to be kept. We do not remove them from an open account. A trader can erase a customer's record at any time, and the section on erasure below says exactly what that destroys and what survives it.
A closed account is kept intact for three months (90 days). Nothing in it is deleted in that time, including the records of the trader's customers, and the trader can reopen it by logging in. Where a trader closes an account while their customers still owe them money, the account does not close on the day they ask: for 30 days it continues as normal, then narrows to collecting only — finances, accounting, the outstanding payments and the trader's own bank details, and nothing else — until the last payment clears, and the three months run from that day. That period is capped at six months from the day the trader asked to close, extendable once by three months on request, after which the account closes whether or not the payments have arrived — so no account, and no customer record inside it, is held open indefinitely by an unpaid instalment. Throughout that period we hold the customer records the outstanding payments belong to, because without them the payment cannot be taken or accounted for, and we process them for that purpose alone. After three months it is purged — every row and every file, signatures included — and cannot be recovered; a trader who asks can have it purged sooner. Our own invoices to the trader survive the purge for six years, as our accounting records, and carry the trader's business name and the amounts and nothing about their customers. Backups are kept for fourteen days and then deleted, so a purged account is gone from every backup within fourteen days of the purge.
Quotes nobody answered. A quote that has been sent and not answered is closed automatically 30 days later. Its link stops working and the customer's access code is destroyed. The trader is emailed seven days beforehand and can keep it open for a further 30 days, as many times as they need. A closed quote stays in the trader's own account, marked as closed, so they can still see what they quoted; the customer can no longer open it.
Customer records and erasure by the trader. Where a trader holds a record for one of their customers, they can erase it from within QuoteNod. Erasure destroys the customer's name, email address, telephone number, every address held, the wording of the quotes and contract terms, all signatures including the image of the customer's own hand, and every PDF generated for that customer, which is deleted from storage. There is no undo and no copy from which QuoteNod can restore it — not by asking support, and not from any archive. What survives is a set of invoice rows carrying only a number, a date and an amount, with no name attached, because the trader must keep business records for six years and UK GDPR Article 17(3)(b) provides that the right to erasure does not apply where processing is necessary for compliance with a legal obligation. The trader signs the instruction with their own name; QuoteNod records that signature, the date and the counts of what was destroyed, and records nothing identifying the person erased.
Your rights. Access, rectification, erasure, portability, objection. Traders: export and deletion are self-service in Settings. If you signed a quote, contact the trader who sent it (the controller); we assist them as processor, and they can carry out an erasure themselves from their own screen. How each of these works in QuoteNod, feature by feature, is set out at /gdpr.
Access codes. Everything a customer signs — the quote, the confirmation that the work is finished, and any change to a payment plan — is opened with a six-digit code emailed to them separately from the link itself. The code is stored only as a cryptographic hash: neither the trader nor QuoteNod can read it. The email that carried it is kept in our outgoing mail record for seven days after it was sent, so a delivery problem can be looked into, and its contents are then removed — only the address, the subject line and the time remain. It exists so that a signature is evidence that the customer signed, and not merely that somebody holding the link did. A new code is issued each time a fresh link is sent, and only the most recent one works.
Sending by WhatsApp. A trader can send a quote link to a customer on WhatsApp. QuoteNod does not send that message and does not transmit anything to WhatsApp or to Meta: the trader's own device opens their own WhatsApp with the message written out, and they send it themselves. We use the customer's telephone number, where the trader has entered one, only to address that message. The access code never travels this way — it goes by email, precisely so that it arrives by a different route from the link.
Two-factor authentication. A trader can add a second step to signing in: a six-digit code from an authenticator app on their phone, alongside the password. When it is on, we store the app's shared secret encrypted, and ten one-use recovery codes as hashes — we cannot read either back. Wrong codes, sign-ins with a recovery code, switching it on or off, and any reset by our support team are written to the account's audit log and the trader is emailed, so a change they did not make is one they hear about. We recommend it to every trader: the account holds their customers' names, addresses and signed contracts, and it is the difference between a stolen password being a nuisance and being a breach.
How long notifications are kept. A trader's Activity list is built from events that already exist on their quotes; what is stored alongside is only whether they have read, filed or dismissed one. A notification that has been read is archived after 30 days and deleted after 60. An unread one is kept until it is dealt with, because a notice about an unanswered quote is the one thing that should not quietly disappear while somebody is away. Deleting a notification deletes the notification, not the event behind it.
Copies of documents. A trader can send a customer a further copy of a document, and can download that customer's whole set as one archive. The file sent is the sealed original, unchanged — it is not regenerated, re-dated or stamped, because the cryptographic hash held against it is what makes it evidence, and a file that is rebuilt to be sent again is no longer the file that was signed. The fact that it is a copy, and the dates involved, are stated in the covering email. Each copy is recorded against the job, with the address it was sent to, so there is an account of who was sent what and when. Where a trader uses WhatsApp for this, QuoteNod transmits nothing to WhatsApp or to Meta: the trader's own device opens their own WhatsApp with the message written out, the document itself goes by email, and the message says which address it went to.
Our own mailbox. QuoteNod Ltd runs its own email through this software, and keeps a contact list of the people it writes to — a name, an address and a short note. That is QuoteNod acting as controller of its own business correspondence, not processing on behalf of any trader. If you have written to us, your address may be in it. Ask at contact@quotenod.co.uk and we will tell you what is held and remove it.
If you write to us. Messages to our support desk and through the contact form, and our replies, are kept for two years after the last message in the conversation and then deleted. We keep them to answer you and to pick up where we left off if you write again: our legitimate interest in running a support desk or, for a trader, the contract with them. Copies in our mailbox are deleted on the same timetable.
Correcting a mistyped address. A trader can correct a customer's email address or telephone number after a quote has been sent. Correcting an email address revokes the link that was issued and destroys the code that went with it, so anything delivered to the wrong address stops working immediately, and a fresh link and code are sent to the corrected one. Where an address was entered incorrectly, the trader is the controller of that data and is responsible for deciding whether the disclosure is reportable; QuoteNod records that the correction was made and tells the trader, at the moment they make it, what they may need to consider.
Your books, and what leaves with them. A trader can write a period's invoices, payments, costs and customers out of QuoteNod as spreadsheets, either plainly or in the layout an accounting package imports from. QuoteNod sends these nowhere: the files download to the trader's own device.
They carry their customers' personal data — names, email addresses, what each was charged, and on the customer file their telephone numbers and addresses too. That is what an accountant needs, and more than anybody else has any business with. Two things follow, and the page says both before anything is downloaded. A downloaded file should be treated like a paper file: sent to the person who needs it, and deleted off a shared computer afterwards. And once a file has left QuoteNod, an erasure here cannot reach it. Erasing a customer destroys everything QuoteNod holds about them and nothing at all in a spreadsheet already sitting in somebody's downloads folder or imported into their accounting software. Deleting those copies is the trader's to do.
What goes into the files is the period the trader picked and no more: only the customers who had an invoice raised or a payment received in it, never the whole address book, and never a customer who has already been erased. The downloads are marked not to be cached, so they do not linger in a shared computer's browser store.
When something breaks. If a page or a background job fails while you are using QuoteNod, we record the fault so we can fix it: the time, the kind of request, the error message, and the first few lines of the technical trace. This applies to everyone's use of the service.
Before any of that is written down it is put through the same filter we use elsewhere, which removes names, email addresses, phone numbers, postcodes, card and bank details, and any access token or tokenised link, replacing each with a marker. What is left describes the fault, not the person. We keep it for 90 days and then delete it. Our lawful basis is legitimate interests — keeping the service working and secure — and because the record carries no identifiers, it cannot be used to look up what any one person did, including by us.
Announcements and what you say under them. When you comment on an announcement we store the comment, the name you chose to comment under, when you wrote it, and which account wrote it. Other signed-in traders see the comment and that name; they do not see your email address, your business name unless you chose it as your commenting name, or which account it came from. Nobody outside QuoteNod sees any of it — announcements are not public.
Whether you reacted for or against is stored against your account so it is counted once and can be changed if you change your mind. How you reacted is never shown to another trader. Only we see the totals, and we see them as totals.
A comment we remove stays on our systems, marked as removed, so that a moderation decision can be reviewed if you challenge it; its place in the thread shows only that something was removed and why. Where an account has been stopped from commenting we record that, and for how long, because otherwise it cannot be lifted. All of it goes when you delete your QuoteNod account.
Connecting your accounting software. Where QuoteNod offers a direct connection to an accounting package, it goes to an account the trader holds with that provider, under the trader's own agreement with them. QuoteNod is carrying out the trader's instruction to send it, which is not the same thing as appointing a sub-processor: once the data arrives it is held by that provider for the trader, under their terms, and it is the trader who decides what happens to it there. Our sub-processor list at /legal/sub-processors says this in the same words, and names the packages rather than leaving them off it.
Nothing is sent until a trader connects one, and we tell them what will be sent before they do. To keep a connection working we hold an access token for their account: stored encrypted, limited to what the connection needs, destroyed when they disconnect or delete their QuoteNod account, and revocable from the provider's side at any time.
Photographs, files and certificates on a job. A trader can put photographs, drawings, certificates, files and hazard records on a job, and their team can from the phone camera on site. They are stored encrypted with our file-storage provider (see the sub-processor list), shown to the customer only where the feature says so — a finished job's photographs in the customer's portal, a certificate the trader sends — and destroyed with the job or with the customer's record when the trader erases it. A small copy of each photograph is made for galleries and destroyed with the original.
The diary and driving times. A booking carries the job's address so that travel between jobs can be shown. To work that out we send the two postcodes to postcodes.io, a free UK postcode look-up, and — where a routing service is configured — the two map positions, as coordinates only, to OpenRouteService (run by the Heidelberg Institute for Geoinformation Technology, Germany). Neither receives a name, a house number, a reference or anything else about the job. Each answer is kept for 90 days so the same pair is not asked twice. Both are on the sub-processor list, and the diary works without the routing service, with a rougher estimate.
"On my way" messages. When a booked job is on its way, QuoteNod emails the customer on the trader's behalf with the name, position and work telephone number of the person coming, their photograph where one is held, and an estimated arrival time, in the words and layout the trader chose. The trader is the controller of that message; the photograph reaches the customer as a picture inside the email, at a signed address that cannot be guessed.
Messages, the customer portal and reviews. A customer can write to the trader on a job from the link they were sent, and the thread is stored on that job. With their access code a customer can open a portal listing their own quotes, invoices, receipts, photographs and messages with that trader, and nothing belonging to anybody else. After a job is signed off we may email the customer once, on the trader's behalf, asking for a review. A review is stored against the job and shown publicly — with the customer's first name and town — only if the customer ticks that they agree when they leave it. The trader can answer it publicly, and can take it down only for one of the reasons QuoteNod lists, which is recorded. The customer can ask the trader, or QuoteNod, to take it down at any time, and QuoteNod does so within 24 hours.
Connections. On the Firm package a trader can have their jobs, payments and invoices read by a spreadsheet, post events to Zapier or Make, and have every invoice and receipt copied to an accountant's address. Each is the trader's instruction to send their data somewhere they chose, under their own agreement with that service, as the Terms (section 20) and the sub-processor list explain; what is sent is named there. The spreadsheet addresses carry customers' names and amounts and open without a sign-in, which is why they are shown only to the trader and can be replaced in one click. The sample shown while a Zapier or Make connection is set up is made up: no real customer's details are used for it.
Device information. We read your browser's reported device type to adapt the site to your screen and, on phones and tablets, to show the right add-to-home-screen instructions for your device. This is used in the moment and is not stored or used to profile you. If you add QuoteNod to your home screen, your device may keep an offline copy of the app's pages; that copy stays on your device and can be removed by deleting the app icon.
Data breaches. If something goes wrong with data we hold, we follow our Data Breach Policy: we contain it, investigate it, and report it to the ICO within 72 hours and to the people affected where the law requires. Where your customers' data is involved, we tell you without undue delay, and in any event within 48 hours of confirming it. If you suspect a breach involving your account, email contact@quotenod.co.uk at once with DATA BREACH and your QuoteNod User ID in the subject.
Complaints. If you are unhappy with how we handle your data, contact us at contact@quotenod.co.uk. You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk — our registration reference is ZC242574.