Privacy Policy
👋 Plain English summary: We collect what we need to run the service, we don't sell your data, we keep it secure, and you can ask us to delete it at any time. For the full legal detail, read on.
Contents
1. Who We Are and How to Contact Us
Gem Quote Ltd ("we," "us," "our") is the data controller responsible for your personal data. We are registered in England and Wales.
Data protection contact: support@gemquote.co.uk
Subject your email: "Privacy / Data Protection"
2. What Data We Collect and Why
| Category | Data Collected | Purpose |
|---|---|---|
| Account data | Name, email address, password (hashed) | Create and manage your account |
| Profile data | Business name, phone, address, profession, country, currency, VAT number, qualifications, logo | Populate quotes with your business details |
| Usage data | Quote content you input, generated quote outputs, feature usage | Provide the AI quote generation service |
| Payment data | Subscription plan, billing history (card details held by Stripe, not us) | Process payments and manage your subscription |
| Technical data | IP address, browser type, device type, timestamps, cookies | Security, analytics, fraud prevention |
| Communications | Emails or messages you send us | Customer support, legal compliance |
| Customer data you enter | Customer names you type into quotes | Generate your quote — we process this as your data processor |
We collect data directly from you (when you register, use the Service, or contact us), automatically (via cookies and server logs), and from third parties (Supabase for authentication, Stripe for payment status).
3. Legal Basis for Processing (UK GDPR)
We process your personal data under the following legal bases:
- Contract performance: Processing necessary to provide the Service you have signed up for (account management, quote generation, payment processing);
- Legitimate interests: Analytics, fraud prevention, security monitoring, improving the Service — where we have assessed that these interests are not overridden by your rights;
- Legal obligation: Where we are required to process data to comply with applicable law;
- Consent: For non-essential cookies and where we otherwise ask for your permission — you may withdraw consent at any time without affecting processing already carried out.
4. How We Use Your Data
We use your data to:
- Create, manage and authenticate your account;
- Generate AI-powered quotes using the information you provide;
- Pre-populate your business details into quote templates;
- Process payments and manage your subscription via Stripe;
- Send you service-related emails (account confirmation, billing receipts, security alerts);
- Send you product updates and marketing emails where you have given us consent to do so — you can withdraw this consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by emailing support@gemquote.co.uk with the subject "Unsubscribe";
- Detect and prevent fraud, abuse, and security incidents;
- Comply with legal obligations;
- Improve and develop the Service (using anonymised, aggregated data where possible).
We do not sell your personal data to third parties. We do not use your personal data for targeted advertising purposes.
5. Who We Share Your Data With
We share your data only with trusted service providers who help us operate the Service, under contracts that require them to protect your data:
| Provider | Purpose | Data shared | Location | Safeguard |
|---|---|---|---|---|
| Supabase | Authentication, database and user data storage | Account details, profile data, quote history | EU / US | SCCs / Privacy Policy |
| Anthropic | AI-powered quote generation | Job description text you enter when generating a quote | US | SCCs / Privacy Policy |
| Stripe | Payment processing and subscription management | Name, email, billing details (card numbers stored by Stripe only) | US / EU | SCCs / PCI DSS L1 / Privacy Policy |
| Cloudflare | Bot protection (Turnstile) on forms | IP address, browser fingerprint (no personal account data) | US / Global | SCCs / Privacy Policy |
| Resend | Transactional and marketing email delivery | Name, email address, marketing consent status | US | SCCs / Privacy Policy |
| Netlify / Vercel | Website hosting and delivery | Server logs (IP address, pages visited) | US | SCCs / Privacy Policy |
We do not sell your personal data to third parties. We do not share your data with advertisers.
We may also disclose your data: (a) where required by law or a court order; (b) to protect our rights or the safety of others; (c) to a successor entity in a merger, acquisition or asset sale (you will be notified).
You can request a copy of the data processing agreements we have with our sub-processors by emailing support@gemquote.co.uk.
6. International Data Transfers
Where your data is processed: GemQuote is operated by Gem Quote Ltd, a company registered in the United Kingdom. Your personal data is primarily processed in the United Kingdom under UK GDPR. Your data is processed in the United Kingdom under UK GDPR.
Our key service providers are based in the United States. When we transfer your personal data outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs) where required:
| Provider | Transfer mechanism |
|---|---|
| Supabase | Standard Contractual Clauses (SCCs) — EU Commission approved. UK IDTA addendum for UK transfers. |
| Anthropic | Standard Contractual Clauses (SCCs). Note: your job description text is processed in the US to generate quote content. |
| Stripe | EU-US Data Privacy Framework adequacy decision. SCCs for UK transfers. |
| Cloudflare | EU-US Data Privacy Framework. SCCs for UK transfers. |
| Resend | Standard Contractual Clauses (SCCs). Used for transactional and marketing email delivery. |
You can request details of the specific transfer mechanisms by emailing support@gemquote.co.uk with the subject "Data Transfer Details".
7. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Account and profile data | For the duration of your account plus 2 years after closure |
| Quote input/output data | For the duration of your account (Pro saves quotes; free tier does not retain past session data) |
| Payment records | 7 years (legal and tax obligations) |
| Support communications | 3 years from last communication |
| Security / access logs | 90 days |
| Anonymised analytics | Indefinitely (cannot be linked back to you) |
After the retention period, data is securely deleted or anonymised. You can request early deletion by emailing support@gemquote.co.uk (subject to legal obligations that require us to retain certain records).
8. Your Rights
You have the following rights regarding your personal data. To exercise any of them, email support@gemquote.co.uk with the subject "Data Rights Request":
🔍 Right to Access
Request a copy of the personal data we hold about you.
✏ Right to Rectification
Ask us to correct inaccurate or incomplete data.
🗑 Right to Erasure
Ask us to delete your data ("right to be forgotten"), subject to legal retention obligations.
🚰 Right to Portability
Receive your data in a structured, machine-readable format to transfer elsewhere.
⛔ Right to Object
Object to processing based on legitimate interests, including direct marketing.
⏸ Right to Restrict
Ask us to pause processing of your data in certain circumstances.
🚫 Withdraw Consent
Where processing is based on consent, withdraw it at any time.
🕵 Automated Decisions
Right not to be subject to solely automated decisions with significant effects.
We will respond to rights requests within 30 days (extendable by a further 60 days for complex requests, with notice). We will not charge for responding unless requests are manifestly unfounded or excessive.
9. Cookies and Tracking
We use cookies and similar technologies. A cookie banner on our website allows you to accept or decline non-essential cookies.
| Type | Purpose | Can you decline? |
|---|---|---|
| Essential | Authentication, security, your preferences | No — necessary for the Service to function |
| Analytics | Understanding how the Service is used (anonymised) | Yes — via cookie banner |
| Marketing | We do not currently use marketing cookies | N/A |
You can also manage cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.
We use localStorage in your browser to store your session, preferences, and quote settings. This data is stored on your device and is not transmitted to our servers unless specifically required to provide the Service.
10. Children's Privacy
The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly. If you believe we have inadvertently collected data from a minor, please contact support@gemquote.co.uk immediately.
11. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:
- HTTPS encryption for all data in transit;
- Encrypted password storage (we never store passwords in plain text);
- Authentication provided by Supabase, which maintains SOC 2 compliance;
- Payment processing by Stripe, which is PCI DSS Level 1 certified;
- Access controls limiting who can access production data.
No system is completely secure. If you suspect a security issue, please notify us immediately at support@gemquote.co.uk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay as required by applicable law.
15. Ireland
If you are based in Ireland, the EU GDPR (as implemented by the Data Protection Acts 1988–2018) applies to our processing of your personal data. Your rights are the same as described in Section 8. You may lodge a complaint with the Data Protection Commission (DPC) at dataprotection.ie.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy on our website with a new effective date. If the changes materially affect how we process your data, we may ask for your consent. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
15. Complaints
If you have concerns about how we handle your data, please contact us first at support@gemquote.co.uk. We take all complaints seriously and will respond within 30 days.
If you remain dissatisfied, you have the right to complain to the UK supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk