Privacy notice

The company that operates Notquoted is the data controller for the personal data described here. Its registered name, company number, place of registration and registered office are published on the legal information page. For anything about your data, write to support@irobuilding.shop.

When you photograph a quotation, three regions are covered over in your browser before the image is sent anywhere: the letterhead band at the top of the page, the column down the right where figures normally sit, and the block at the foot where totals normally sit. You can cover anything else yourself by dragging over it.

The bars are painted into the pixels, not laid over them, so there is nothing underneath to recover. The original photograph is never uploaded. Only the flattened, redacted image leaves your device.

This means we do not hold the contractor’s name, the contractor’s contact details, or any monetary figure from your quotation — not because we delete them, but because they never arrived.

Your email address and password hash. To create your account and sign you in. Lawful basis: performance of a contract with you.

Your subscription status. Which plan you are on, when it renews, and how much of your allowance you have used. Lawful basis: performance of a contract.

The redacted image of your quotation, and the sentence you write about the job. To produce your reading. Lawful basis: performance of a contract. Kept only while the reading is being produced, then deleted.

Your readings. The extracted item text and the resulting comparison, so you can come back to them. Lawful basis: performance of a contract. You can delete any reading yourself at any time.

Support correspondence. To answer you and to keep a record of what was agreed. Lawful basis: legitimate interests in running a support service.

Billing records. Invoices and payment confirmations. Lawful basis: legal obligation — tax and company law require these to be kept.

Analytics, only if you accept them. Counts of visits and which pages were read. Lawful basis: your consent, which you can withdraw at any time from the cookie notice.

• Card numbers. They go directly to a PCI DSS Level 1 certified payment provider and never touch our servers.
• The unredacted photograph of your quotation.
• Any monetary amount from a quotation.
• The name or contact details of any contractor.
• Any special category data. Please do not send us any.

Images and text you upload are not used to train any machine learning model, ours or anyone else’s. They are not added to a training set, not used to fine-tune, and not shared with a model provider for that purpose.

Where a third-party model provider performs the text extraction, we use an arrangement that contractually prohibits training on the content we send, and we send only the redacted image.

This is a commitment in this notice, which means changing it would require us to notify you, not simply to edit a page.

• Redacted quotation images: deleted as soon as the reading is complete, and in any event within 24 hours.
• Readings: until you delete them, or 12 months after your account closes.
• Account records: until you close your account, then 30 days.
• Support correspondence: 24 months.
• Billing records: six years, because tax law requires it.
• Analytics: 14 months, and only if you consented.

Only with processors who need it to run the service, each under a written contract that limits them to our instructions:

• a hosting and database provider, to run the site and store your account;
• a model provider, to extract item text from the redacted image;
• a payment provider, to take payment and manage your subscription;
• an email provider, to send account, renewal and support emails;
• an analytics provider, only if you consented.

We do not sell personal data, we do not share it for behavioural advertising, and we have never done either.

Some processors operate outside the United Kingdom. Where personal data is transferred out of the UK, we rely on UK adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with a transfer risk assessment.

You can ask us for a list of the countries involved and a copy of the safeguards.

Under the UK GDPR you have the right to:

• ask what we hold about you and get a copy of it;
• have inaccurate data corrected;
• have data erased, where we have no overriding reason to keep it;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, where we relied on consent;
• not be subject to a decision made solely by automated means that has a legal or similarly significant effect — we make no such decisions.

Write to support@irobuilding.shop. We respond within one month and we do not charge for it.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk, by telephone on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

You do not have to raise it with us first, though we would rather you did so that we can fix it.

Readers in the EEA have the equivalent rights under the EU GDPR, and may complain to their national supervisory authority.

Readers in California have the rights given by the CCPA as amended: to know what is collected and why, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA, so there is no opt-out to offer you — but the rights above apply to everyone who uses this service, wherever they are.

This service is for adults. You must be 18 or over to hold an account. We do not knowingly collect personal data from children, and if we learn we have, we delete it.

• Everything is served over HTTPS with HSTS.
• Passwords are hashed, never stored in a readable form.
• Redaction happens on your device, so the sensitive parts of a quotation never travel.
• Access to production data is limited to the people who need it and is logged.
• If a breach is likely to be a risk to you, we will tell you, and we will report it to the Information Commissioner's Office within 72 hours as required.

If we change this notice in a way that affects you, we will email you before it takes effect. The date at the top always reflects the current version.