Privacy Policy

SnapQuote has two very different relationships with data, and it matters which one applies to you:

• Provider account data — When a Provider signs up and runs their business on SnapQuote, we are the data controller for their account, login, billing and usage data. This policy governs that relationship.
• End-customer submissions — When someone submits a job request (photos, description, contact details) to a Provider through a no-login link, that data belongs to the Provider. The Provider is the controller; we are only their processor and handle it on their instructions. For questions about how a specific business uses your request, contact that Provider directly — they are named on the intake page you used.

From Providers (as controller):

• Account & business profile: name, email, password (hashed), business name, logo, brand colour, trade, service area and contact details.
• Billing data: subscription plan and payment status. Card/payment details are handled by our payment provider (Paddle, acting as merchant of record) — we never see or store full card numbers.
• Usage & technical data: log data, IP address, device/browser info, and cookies strictly necessary to keep you signed in and secure.

From end customers (as the Provider's processor):

• The content you submit: photos, video, a description of the job, and answers to the Provider's intake questions.
• Your contact details: name and phone number and/or email, so the Provider can send you a quote.
• Quote responses: whether you accepted or declined a quote, and an optional signature.

We ask Providers to keep intake questions relevant and to avoid collecting special-category data. Please do not upload more than the job requires — for example, avoid including other people, documents or valuables in photos.

• To provide the service — route requests to the right Provider, build and deliver quotes, and show public intake and quote pages. (Legal basis: performance of a contract.)
• To run our business — bill subscriptions, provide support, and keep the service secure and working. (Legal basis: contract and our legitimate interests.)
• To send service messages — e.g. notifying a Provider of a new request or a quote acceptance. (Legal basis: contract / legitimate interests.)
• To meet legal obligations — tax, accounting and responding to lawful requests. (Legal basis: legal obligation.)

We do not sell personal data, we do not run advertising networks on it, and we do not use end-customer submissions to build a directory or to match customers with any Provider other than the one they contacted. SnapQuote is a tool, not a marketplace.

Some optional features may use AI to help a Provider draft a quote or summarize a request. Where used, content may be processed by our AI provider (Anthropic) solely to generate that draft for the Provider, who always reviews and edits before anything is sent. AI output is never sent to a customer automatically, and inputs are not used to train third-party models.

We share data only with vetted service providers who help us run SnapQuote, under contract and only as needed:

• Hosting & storage: Hetzner (EU region) — application hosting and object storage for uploaded media.
• Payments (our subscriptions): Paddle, as merchant of record.
• Email delivery: our transactional email provider (e.g. Resend / Postmark).
• AI processing (optional features): Anthropic.

We may also disclose data if required by law or to protect our rights. If we ever transfer data outside the EU/EEA, we use an approved safeguard such as Standard Contractual Clauses. A current list of sub-processors is available on request at privacy@snapquote.me.

• Provider accounts: for as long as the account is active, then deleted or anonymized within a reasonable period after closure, unless we must keep records (e.g. invoices) for legal reasons.
• End-customer submissions: retained on the Provider's behalf for as long as the Provider needs them, subject to the Provider's own retention settings and instructions. When a Provider deletes a request or their account, associated media and submissions are removed.
• Logs and backups: kept for a limited period for security and reliability, then rotated out.

We use encryption in transit, hashed credentials, strict per-Provider data isolation (no Provider can read another Provider's data), access controls, and unguessable tokenized links for public pages. Public intake and quote links are the primary protection for no-login pages — treat them like a password and only share them with the intended recipient.

Under the GDPR and applicable law you can request access, correction, deletion, restriction, portability, and object to certain processing.

• If you are a Provider (we are the controller): contact us at privacy@snapquote.me and we will respond within the legal time limits.
• If you are an end customer (the Provider is the controller): please contact the Provider you submitted your request to. We will support them in fulfilling your request and can act directly where required.

You also have the right to lodge a complaint with your local data protection authority.

We use only the cookies strictly necessary to run the service — for example, to keep a signed-in Provider authenticated and to protect against abuse. The public no-login customer pages are kept minimal and do not set advertising or cross-site tracking cookies.

SnapQuote is a business tool and is not directed to children. We do not knowingly collect data from children.

We may update this policy as the service evolves. We will change the “last updated” date above and, for material changes affecting Providers, provide reasonable notice.

SnapQuote, Envera Sehovica 28. Privacy questions and data requests: privacy@snapquote.me.