Legal

Privacy Policy

Effective 29 July 2026

QuoteMate (quotemate.nz) is operated by Alex Murray, a New Zealand sole trader trading as QuoteMate. I'm the privacy officer. For anything in this policy, email support@quotemate.nz.

1. What we collect

• Your account: business name, your name, email, phone, address, GST number, bank account number (shown on your invoices because you put it there), and your logo if you upload one.
• Your customers' details: names, emails, phone numbers, and addresses you enter to create quotes and invoices. These belong to your customers — you're responsible for having a proper reason to give them to us (usually: they asked you to quote them).
• Your documents: quotes, invoices, line items, notes, and their acceptance status.
• Email records: which documents were emailed to which address, and whether delivery worked.
• Analytics: anonymous, cookieless page counts. No advertising trackers.

2. What we use it for

Running QuoteMate: creating your documents, emailing them on your behalf (replies go to you, not us), telling you when a quote is accepted, billing your subscription, sending service emails about your account, and support. Nothing else. We don't sell data, we don't use your data to train AI, and we never contact your customers except to deliver the documents you send them.

3. Quote links your customers see

Each quote gets a private link with a long, unguessable code so your customer can view and accept it without creating an account. Anyone who has the link can open it, so share it deliberately. These pages tell search engines not to index or archive them, and they are never cached by shared systems.

4. Where your data lives

QuoteMate is a New Zealand service, but our service providers store data on servers in the United States. They act as our processing agents — they may only use the data to provide their services to us, and we remain responsible for your information under New Zealand's Privacy Act 2020.

5. Our providers

6. Xero (optional)

If you connect Xero, we request only invoice and contact access, we push invoices as drafts, and we store the connection token encrypted (AES-256-GCM). Disconnect any time in Settings or from Xero's own Connected Apps page; if your subscription ends, we revoke the connection automatically. We never use Xero data for anything except creating your invoices.

7. Cookies

Only what sign-in requires (session cookies from our sign-in provider) plus one short-lived cookie during Xero connection. No advertising or tracking cookies.

8. Security

Everything travels over HTTPS. Xero tokens are encrypted at rest. Passwords and card numbers are held by Clerk and Stripe respectively, not by us. We're a small operation and don't claim formal certifications — we keep the amount of data we hold, and the number of systems that hold it, deliberately small.

9. Retention and deletion

Ask us to delete your account (email support@quotemate.nz) and we'll action it within 10 working days: subscription cancelled, sign-in account deleted, and your database records and logo removed from our active systems. After that, residual copies can persist briefly with our providers before expiring in the ordinary course: our database provider's restore history keeps up to 6 hours; email delivery logs expire after 30 days; server logs after 1 hour; our sign-in provider commits to deletion within 90 days. Payment records are different — Stripe and we retain transaction records where required by applicable tax, financial, or other laws, and those records cannot be deleted on request.

10. Your rights

Under the Privacy Act 2020 you can ask for a copy of your personal information or ask us to correct it — email support@quotemate.nz. If you think we've mishandled your information and we can't sort it out together, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

11. Changes

If this policy changes materially, we'll email account holders before the change takes effect.