Privacy policy

QuoteCraft is run by Werner Mostert, a sole proprietor trading as W.MostertCo, 1290 Walter Ave, Waverley, Pretoria, South Africa. Werner Mostert is the Information Officer under POPIA and can be reached at WerriesMostert@gmail.com.

• About you, the account holder. We decide what we collect and why, so we are the responsible party. This policy covers it.
• About your clients and their people, which you put into QuoteCraft. You decide what goes in, so you are the responsible party and we are your operator: we process it only to run QuoteCraft for you, and never for our own purposes.

If you are a client of a business that uses QuoteCraft and want to know why your details are on a quote, ask that business. We will help them answer.

Billing. When you subscribe, you enter your card on Paystack's own checkout page. QuoteCraft never receives or stores your card number or CVV. We store your Paystack customer and subscription codes, a code Paystack issues to manage the subscription, the subscription status, the date you are paid up to, the date your free months end and the reference of your last checkout. Your card's brand, last four digits and expiry date, and your payment history, are fetched from Paystack when you open the Account page and are not stored by us.

Security. To stop password guessing and spam, we note attempts to sign in, sign up, reset or change a password, use two-factor codes and send the contact form, with the email address or IP address they came from. Those notes are deleted within a day. Our host keeps server logs for fault-finding and security.

The contact form. If you write to us through the contact page, we receive your name, email address, phone number and business name if you give them, and your message. It is emailed to us so we can reply and is not stored in the QuoteCraft database.

• Client records: name, contact person, phone, email address, physical address and client number.
• Quote and invoice content: scope, exclusions, notes, milestones, line items, rates, totals, currencies and exchange rates, purchase order references and who compiled the document.
• Images you add to quotes, up to 10 per quote, and anything visible in them.
• Purchase orders and proofs of payment you upload (PDF or image, up to 4 MB), with their file names, amounts and references, and anything visible in them. Proofs of payment often show the payer's name and bank details. These files are only shown to signed-in users of your business, never through a public link.
• When a client accepts a quote online: the name and email address they type, the date and time, their IP address and their browser details. This is your evidence of who accepted and when. Please tell your clients it is recorded, for example in your own privacy notice.

We don't rely on consent for any of these. If you object to something we do on the basis of legitimate interest, tell us and we will weigh it. We don't make automated decisions about you that have legal effects.

We don't sell personal information, we don't use advertising or tracking cookies, and we don't use your data or your clients' data to train machine-learning models.

Only these providers, each processing it on our behalf or, for Paystack, under its own policy:

We also disclose information where the law requires it, or to establish or defend a legal claim. If we are made to disclose your data, we tell you unless the law forbids it. If QuoteCraft is sold, your information moves to the new owner, who must keep to this policy; we tell you before that happens. We tell you before we add a provider that handles your clients' data.

• HTTPS everywhere, and encryption at rest by the database provider.
• Passwords hashed with bcrypt; banking details and two-factor secrets encrypted again with AES-256-GCM under a key kept outside the database.
• A signed sign-in cookie that ends after 2 days without use and 30 days at most. Changing your password signs out every device.
• Optional two-factor sign-in with an authenticator app.
• Every business's data is kept separate: each request only reaches the signed-in user's own business.
• Rate limits on sign-in, signup, password resets and changes, two-factor codes and the contact form; what you send is checked before it is saved.
• Shared quote links use a long random code that can't be guessed, and are kept out of search engines.
• Card payments happen on Paystack's page, so card numbers never reach us. Paystack's messages to us are checked against their signature.
• One person runs QuoteCraft, and production passwords and keys are not shared.

No system is perfectly secure. The encryption of banking details protects them if the database alone leaks; it can't protect against someone who takes over the running server together with its key. If personal information is accessed without authority, we tell the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires, and tell you straight away if it affects your clients' data.

Our providers are outside South Africa, mainly in the United States and Germany, so using QuoteCraft moves personal information across borders. POPIA section 72 allows this where the recipient is bound to protect it adequately, or where it is needed to provide the service you asked for. We rely on our agreements with each provider and on that necessity. For people in the EU or UK, we rely on the standard contractual clauses in the providers' data processing terms.

You may ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong, out of date, incomplete or misleading;
• delete information we no longer have a lawful reason to keep;
• stop processing we do on the basis of legitimate interest;
• where the GDPR applies, limit processing while a dispute is settled, or give you your data in a machine-readable format.

Email WerriesMostert@gmail.com. We reply within 30 days and may first check that the request is really from you. There is no charge. A plain email is fine; you don't need the POPIA forms. Quotes and invoices can also be downloaded as PDFs in the app.

Both are strictly necessary for a service you asked for, so they need no consent and there is no cookie banner. Neither tracks you. Vercel Analytics sets no cookies. Paystack's checkout page, which you visit only to pay, sets its own cookies under Paystack's policy. Your browser also keeps your light or dark theme choice and which “What's new” items you have seen, on your device only.

QuoteCraft is a business tool for people 18 and older. If you think a child's information has reached us, email WerriesMostert@gmail.com and we will delete it.

Please raise it with us first at WerriesMostert@gmail.com. If you are still unhappy, you may complain to the Information Regulator (South Africa) at inforegulator.org.za, or, in the EU or UK, to your local data protection authority.

We update this policy as QuoteCraft changes. We email account holders at least 14 days before a material change takes effect and update the date at the top.