Privacy Policy

1. Who we are

Kwotly is a software platform that helps removal and man & van operators create and manage customer quotes. Our contact email is info@kwotly.co.uk.

The service is operated by Kwotly Ltd (company no. 17027075), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office, registration ZC212778.

2. Data we collect

We collect the following personal data:

• Account information: name, email address, and password when you register.
• Company information: business name, contact details, and branding preferences.
• Quote data: customer names, addresses, phone numbers, photos of items, and quote details submitted through the platform.
• Payment information: processed securely by Stripe. We do not store your full card details.
• Usage data: pages visited, features used, and device/browser information to improve the service.

3. How we use your data

• To provide and maintain the Kwotly service.
• To process quotes and facilitate communication between operators and their customers.
• To process payments and manage subscriptions via Stripe.
• To analyse photos using AI providers (such as Anthropic Claude and Google) to detect items for quoting purposes.
• To send service-related emails (quote notifications, account updates).
• To improve the platform based on usage patterns.

Voice notes sent over WhatsApp are not transcribed or analysed. They are stored and passed to the operator to listen to.

4. Lawful basis for processing

We process your data on the following bases:

• Contract: to provide the service you signed up for.
• Legitimate interests: to improve and secure the platform.
• Consent: where required, such as for marketing communications.

5. Third parties

We share data with the following third-party services, only as necessary to operate the platform:

• Stripe: payment processing. See Stripe's privacy policy.
• Anthropic (Claude): AI-powered photo analysis for item detection.
• Google: maps, distance calculation, and optional AI vision services.
• Clerk: account sign-in and authentication.
• Twilio: WhatsApp and SMS messaging between operators and their customers.
• Resend: sending transactional emails (quote notifications, password resets).
• Railway: hosts the application and its database, where your account, quote and customer data is stored.
• Vercel: hosts the website, and counts visits to it (see section 7).
• PostHog (EU hosting): product analytics, so we can see where the website and the operator dashboard confuse people and fix it. On the public website and on quote and tracking pages it records which pages and form steps are used, and stores nothing on your device. If you have an operator account, it also links your use of the dashboard to your account and records your sessions, with everything you type and all text on screen blanked out. Private quote and tracking links are stripped out before anything is sent.
• Cloudflare: sits in front of our website to keep it fast and block attacks. Your requests to the site (including your IP address) pass through it. Cloudflare also stores our nightly database backups (Cloudflare R2, held in the EU). Each backup is encrypted before it leaves our servers, and Cloudflare cannot read it.
• Sentry: error monitoring. If something breaks, a technical crash report is sent so we can fix it, only if you agree when asked, and with names, contact details, addresses and photos stripped out before anything is sent.

We do not sell your personal data to any third party.

If you are an operator using Kwotly with your own customers, our Data Processing Agreement covers these providers as sub-processors.

6. Data retention

Where a business offers saved enquiries, we save your form details so you can continue later and the business can follow up. Personal resume links expire after 14 days, and expired draft records are automatically removed. Photos are not retained in saved drafts; you will need to add them again when returning. Submitted quotes and the business’s contact lead records follow their separate retention arrangements.

We retain your account data for as long as your account is active. Quote data is retained for the duration of your subscription. Customer photos are deleted within 12 months of a quote being completed, declined, expired or cancelled; photos sent over WhatsApp are stored with the quote in the same way and follow the same 12 months.

WhatsApp works slightly differently, so here is exactly what happens. While an enquiry is being handled we keep a working record of the conversation; that record is deleted 7 days after the conversation goes quiet. Separately, every WhatsApp message between you and the business is kept as a chat history in the business's dashboard, so they can look back at what was said; each message in that history is deleted 12 months after it was sent. Files the business sends you over WhatsApp are stored with the business's account. Twilio, who carries the messages, keeps its own copy of them and of anything you send, under its own terms. The messages themselves are also copied into the quote's message thread in the operator's dashboard, so the operator can see what was said — that copy is kept with the quote, as are any voice notes, video or documents sent in the thread. Deleting the working record does not delete the copy on the quote.

If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it.

7. Cookies and analytics

Essential cookies. We use cookies to keep you signed in and to keep your session secure. The site does not work properly without them, so they are always on. We do not use advertising cookies, and we do not share what you do on our site with advertisers.

Vercel Web Analytics. To see how many people visit our website and which pages they read, we use Vercel Web Analytics. It sets no cookies and stores nothing on your device. It records the page you viewed, the site that linked you to us, your country and the type of device, and it does not identify you. Private links, such as the link to your quote or your move tracking page, are stripped out before anything is sent.

PostHog (product analytics, hosted in the EU). We use PostHog to see where the website and the operator dashboard confuse people, so we can fix them.

• If you are not signed in (visiting our website, or filling in a quote form or tracking page sent by a business), PostHog records which pages you view and, on our own website, which buttons and links you click. Words on the page are blanked out of those click records. On quote forms and tracking pages it records only page views and which form steps are used. It does not store anything on your device, it does not record your screen, and private quote and tracking links are stripped out before anything is sent.
• If you are signed in to an operator account, PostHog stores an identifier in your browser (a cookie and local storage) so it can link your use of the dashboard across visits to your user account, business name, plan and role. It also records your dashboard sessions, with everything you type and all text on screen blanked out. When you sign out, the identifier is cleared and recording stops.

Turning it off. There is no setting in Kwotly to switch PostHog off yet. If your browser or a content blocker stops it loading, Kwotly carries on working normally and nothing is sent. You can also clear our cookies and site data in your browser settings at any time.

Crash reports. If something breaks, we ask before sending a technical crash report to Sentry. Nothing is sent unless you say yes, and your answer is remembered.

8. Your rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data.
• Data portability: receive your data in a structured format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at info@kwotly.co.uk.

9. Data security

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, hashed API keys, rate limiting, and tenant-isolated data storage. Uploaded photos are accessible only via time-limited signed URLs.

10. International transfers

Several of our third-party providers are based in, or may process data in, the United States: Anthropic, Google, Clerk, Stripe, Twilio, Resend, Railway, Vercel, Sentry and Cloudflare. The full list, with what each one does, is in our Data Processing Agreement. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email or through the platform. The "last updated" date at the top of this page indicates when it was last revised.

12. Contact

If you have questions about this privacy policy or wish to exercise your data rights, contact us at info@kwotly.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.