Privacy policy
Last updated 2026-10-17
1. Controller
Qutiba Nassli, Cobenzlgasse 28, 1190 Wien, Austria, hello@quotenio.com, is the controller for the personal data of people who visit this website, sign up and use Quotenio accounts.
For the business data your company puts into Quotenio (for example your customers' contact details in RFQs and quotations), your company is the controller and we act as its processor under Art. 28 GDPR: see section 8.
2. What we process and why
- Account data (name, username, email, company, role): to provide your account and the service (Art. 6(1)(b) GDPR).
- Billing data (company name, billing address, VAT number, payment status; card details are handled only by Stripe): to bill paid plans and keep accounting records for 7 years (Art. 6(1)(b) and (c) GDPR, §132 BAO).
- Security and usage logs (IP address, time, action, sign-in attempts): to protect the service against abuse, for example limits on sign-ups and requests; IP addresses of sign-up requests are stored only as one-way hashes (Art. 6(1)(f) GDPR).
- Emails we send (sign-up confirmation, account and billing notices): to run the service (Art. 6(1)(b) GDPR).
3. Cookies
We use only cookies that are strictly necessary: a session cookie that keeps you signed in, and the sign-in service's cookies. There is no tracking, advertising or analytics cookie, so no consent banner is needed.
4. Recipients and processors
- Hosting: Contabo GmbH, Germany, which runs the servers.
- Stripe (Stripe Payments Europe Ltd., Ireland): payment processing for paid plans.
- Resend (Resend, Inc., USA): sending account emails.
- OpenRouter (OpenRouter, Inc., USA) and the AI model providers it routes to: only when your plan includes documents read by the assistant (email inbox, uploads, scans). We request providers that do not store or train on the content.
- ChatGPT, Claude or other AI apps you connect to Quotenio are chosen and controlled by you; their own privacy terms apply to what you share in those apps.
Transfers to the USA rely on the EU-US Data Privacy Framework where the recipient is certified, otherwise on the European Commission's standard contractual clauses.
5. Retention
We keep account data while the account exists and delete it within 90 days after it is closed, except records we must keep by law (for example invoices, 7 years).
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests (Art. 15-21 GDPR). Write to hello@quotenio.com. You may also complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at).
7. Security
Connections are encrypted (HTTPS), passwords are handled by our sign-in service and never stored in plain text, companies' data is kept separate, and backups stored outside our server are encrypted before they leave it.
8. Data processing for your company (Art. 28 GDPR)
When we process personal data on behalf of your company we: process it only on your documented instructions, which are given by your use of the service; ensure our staff are bound to confidentiality; apply the security measures in section 7; use only the processors listed in section 4 and inform you of changes in advance so you can object; help you answer data subject requests and meet your obligations under Art. 32-36 GDPR; delete or return the data at the end of the service (section 5); and make available the information needed to demonstrate compliance, including audits by appointment. A signed data processing agreement is available on request.
9. Changes
We update this policy when our processing changes and show the date above.