Privacy Policy of QUOTATIONIA

This Privacy Policy (hereinafter, the "Policy") aims to inform users (hereinafter, the "User" or "Users") of the website www.quotationia.com (hereinafter, the "Website"), about how QuotationIA (hereinafter, the "Company" or "we") collects, uses, stores, shares, and protects personal information obtained as a result of accessing, browsing, registering, and using the services provided through the Website (hereinafter, the "Service").

The Company is committed to protecting Users' privacy and complying with current data protection laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (hereinafter, "GDPR"), and the Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and guarantee of digital rights (hereinafter, "LOPDGDD").

1. Identity of the Data Controller

The controller of the personal data collected through the Website is:

QuotationIA
Registered office: Barcelona, Catalonia, Spain
Contact email: Info@quotationia.com

2. Personal Data We Collect

QuotationIA may collect the following categories of personal data:

• Identification and contact data: name, surname, email address, telephone number (if provided), billing address, and, where applicable, postal address
• Access and authentication credentials: User account creation and management is carried out through QuotationIA's own authentication system, which collects and processes information such as email, encrypted password, identity verification methods, and login records. Where the User chooses to sign in with Google, Google acts as the identity provider for that sign-in
• Payment data: information necessary to process payments, such as the last four digits of the card, cardholder name, and expiration date. Full financial information (full card number, CVV, etc.) is not stored or processed by QuotationIA. These data are handled directly by Stripe
• Service usage data: information entered by the User to generate quotations, service descriptions, queries made to the AI, documents generated, and activity logs
• Technical data: IP address, browser type, operating system, access data, cookies, and similar technologies that enable the proper functioning of the Website and Service improvement
• Communications with the User: records of emails, support messages, and any other interaction with the customer service team

3. Purposes of Processing

The collected data are used for the following legitimate purposes:

• Provision of the Service: allowing the User to register, create an Account, generate and download quotations using AI, and manage their subscription
• Administrative and billing management: processing payments, issuing invoices, managing subscriptions and recurring charges, and handling potential claims
• Customer support: responding to inquiries, complaints, rights requests, and providing technical assistance
• Service improvement: analyzing platform usage, debugging errors, implementing improvements, and training AI models with anonymized or aggregated data
• Security: preventing fraudulent activities, unauthorized access, or misuse of the Website
• Commercial communications: sending the User (with prior consent or based on the contractual relationship) communications regarding news, updates, promotions, and services from QuotationIA
• Legal compliance: responding to requests from competent authorities or complying with legal obligations in tax, commercial, or data protection matters

4. Legal Basis for Processing

Google Analytics 4 (Google) measures Website visits and usage only after you accept cookies, in every region. Google receives cookie identifiers, IP and device/browser information, and visited page paths. We do not include proposal content, account identifiers or URL query parameters in our page-view events. Analytics uses the existing cookie banner, and you can withdraw consent through “Cookie settings” in the footer. Visits made without consent are not replayed after acceptance.

Google Ads also receives a secondary conversion event when a visitor clicks the upward-arrow generation button inside the proposal writing interface. This measures a request to generate, not successful document completion or a purchase, and has no assigned monetary value. It contains no proposal text or customer identifiers and follows the same advertising consent and withdrawal rules below.

Google Ads (Google) receives advertising-cookie identifiers, technical visit data and, after a verified purchase, an opaque transaction reference, the amount paid and currency. This measures purchases resulting from advertising and supports campaign optimization. We do not send names, email addresses or card details in conversion events. In the EEA, UK, Switzerland and unresolved regions, advertising measurement requires acceptance in the cookie banner; elsewhere it is enabled unless refused. Your choice, date, region and notice version are recorded, with previous acceptance retained after withdrawal. Use “Cookie settings” in the footer to change or withdraw your choice at any time; refused events are not replayed after later acceptance.

Processing of Users' personal data is based on the following legal grounds:

• Performance of a contract: provision of the contracted Service, Account management, and subscription management
• Compliance with legal obligations: tax, commercial, and data protection obligations
• User consent: sending commercial communications, using non-essential cookies, processing certain data for marketing and analytics
• Legitimate interest of QuotationIA: ensuring platform security, preventing fraud, improving the Service, and defending against claims

5. Data Retention

Personal data will be kept for the period strictly necessary to fulfill the purposes for which they were collected:

• Account data: as long as the User maintains an active subscription or until deletion is requested
• Billing data: for the legally required period under tax and commercial law (minimum 6 years in Spain)
• Service usage data: for a maximum period of 12 months from the generation of the quotation, unless anonymized for statistical or service improvement purposes
• Commercial communications: until the User withdraws consent or objects to receiving them

6. Data Disclosure to Third Parties

QuotationIA does not sell or rent personal data to third parties. However, data may be shared with the following recipients:

• Technology service providers: hosting companies, cloud storage services, AI providers (Google), email services, and technical support. User accounts, credentials, and login sessions are managed by QuotationIA's own authentication system
• Payment processors: financial entities and secure payment platforms, including Stripe
• Public and judicial authorities: when legally required or necessary to defend QuotationIA's legitimate interests

All providers accessing personal data act as data processors under contracts ensuring GDPR compliance, except those acting as independent controllers (such as Stripe for financial data).

7. International Data Transfers

Since the Service is provided through AI technologies (Google), authentication services (Google, when the User signs in with a Google account), and payment processors (Stripe), data may be transferred to servers located in the United States or other countries outside the European Economic Area.

In such cases, QuotationIA ensures that these transfers are subject to the European Commission's Standard Contractual Clauses or equivalent safeguards recognized under European law (such as the EU-U.S. Data Privacy Framework for participating providers).

8. Users' Rights

The User may exercise the following rights at any time:

• Right of access: to know what personal data we process and for what purpose
• Right of rectification: to request the correction of inaccurate or incomplete data
• Right of erasure: to request the deletion of data when no longer necessary for their purpose
• Right to restrict processing: to limit data processing under certain circumstances
• Right to data portability: to receive their data in a structured format and transmit them to another controller
• Right to object: to object to processing based on legitimate interest or to receiving commercial communications
• Right not to be subject to automated decisions: to request human intervention in decisions that significantly affect them

To exercise these rights, the User must send a written request accompanied by a copy of an identification document to Info@quotationia.com.

Additionally, the User has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they believe their rights have been violated.

9. Data Security

QuotationIA adopts reasonable technical and organizational measures to protect data against loss, misuse, unauthorized access, alteration, or destruction. Such measures include encryption systems, SSL/TLS security protocols, firewalls, and restricted access controls.

However, the User acknowledges that no data transmission or storage system is entirely secure, and QuotationIA cannot guarantee absolute invulnerability of its systems.

10. Minors

The Website and the Service are not directed to minors under 18 years of age. QuotationIA does not knowingly collect personal data from minors. If a parent, guardian, or legal representative becomes aware that their child has provided data to QuotationIA without consent, they must contact us to request its immediate deletion.

11. Changes to the Privacy Policy

QuotationIA may update this Policy at any time. The new version will be published on the Website indicating the date of the last update. If the changes are significant, QuotationIA will notify the User by email or notice on the Website. Continued use of the Service after the changes take effect will constitute acceptance of the new Policy.

12. Contact

For any questions regarding this Privacy Policy, the User may contact:

QuotationIA
Address: Barcelona, Catalonia, Spain
Email: Info@quotationia.com