Privacy Policy

This Privacy Policy explains how AltaPro AI (“QuotingAI”, “we”, “us”) handles personal information when you visit our website or use the QuotingAI service (the “Service”).

We are based in Edmonton, Alberta, Canada. We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

The short version: we collect what we need to run a quoting tool for your business, we may share it inside our own corporate group to run and improve our products, we do not sell your data, we do not let anyone train public AI models on it, and you can ask us for a copy of it or to delete it.

This matters, because it decides who is responsible for what:

• For your own account information (your name, email, business details, billing) we are the organization responsible for that information and this policy governs it.
• For information about your clients that you enter or generate — names, addresses, emails, phone numbers, quote contents, signatures — you are the organization responsible and we act as your service provider, handling it on your instructions to deliver the Service.

That means you are responsible for having the right to collect your clients' information, for telling them how you use it, and for obtaining any consent your own privacy obligations require. We handle it only to run the Service for you.

Information you give us

• Account and profile — your name, work email, password (stored only as a salted hash, never in readable form), business name, trade, phone, logo and brand colour.
• Team — the email addresses and roles of teammates you invite.
• Business content — your pricebook, materials and labour rates, costs and margins, quote templates, notes and terms.
• Your clients' information — the names, emails, phone numbers and job addresses you enter, and the contents of the quotes you send them.
• Support and correspondence — what you send us by email.

Information collected when a quote is signed

• The signer's typed name, optional email, and drawn signature image, plus the IP address, device user-agent and timestamp recorded as an audit trail for the electronic signature.
• Whether and when a proposal link was opened, and which optional add-ons were accepted.

Information collected automatically

• Standard server logs — IP address, browser and device type, pages requested, referring page, and timestamps.
• Usage of AI features (how many quotes were generated) so we can meter credits and prevent abuse.

Payment information

• Card payments are processed by Stripe. We never see or store full card numbers. We keep only a customer/subscription identifier, the plan, status, and billing dates.

We use personal information to:

• create and secure your account, and authenticate your sessions;
• provide the Service — drafting quotes, sending proposals, capturing signatures and collecting deposits;
• process subscription payments and manage plans, seats and AI credits;
• send service messages you would expect — a client opened your quote, a quote was signed, a deposit landed, follow-up reminders you enabled, trial and billing notices;
• provide support and respond to you;
• keep the Service secure — detect fraud, abuse, and rate-limit automated activity;
• understand aggregate usage so we can improve the product;
• comply with legal, tax and accounting obligations.

Where the law requires consent, we rely on your consent, which you may withdraw at any time (see Your Rights). Withdrawing consent may mean we can no longer provide parts of the Service.

When you use an AI feature, the job description you type and relevant pricebook context are sent to our third-party AI provider to generate a draft quote, and the result is returned to you.

We do not permit your content to be used to train third-party public AI models.We do not sell it, and we do not use your clients' personal information to train models.

Please avoid pasting sensitive personal information — government identifiers, health information, or financial account numbers — into job descriptions. The Service does not need it, and it should not be there.

AI output is a draft you review and approve. No decision with a legal or similarly significant effect on an individual is made solely by automated means.

We keep this deliberately minimal:

• Essential session cookie — a secure, HTTP-only cookie that keeps you signed in. The Service cannot work without it.
• Local storage— used only to remember small preferences, such as dismissing the “install the app” prompt.

We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. If that ever changes, we will update this policy and ask for consent where required.

We do not sell personal information, and we do not share it for third-party advertising.

We share it only in these situations:

• With your clients — the proposal you send contains the information you put in it, and your business details.
• Within our corporate group — QuotingAI is operated by Unconventional Group Inc. (operating as AltaPro AI), and we may share information with our subsidiaries and affiliated companies (entities that control, are controlled by, or are under common control with us) to operate, secure, support, develop and improve QuotingAI and our other products and services. Every company in the group is bound by this Policy, including the limits below: nobody in the group may sell your information, use it for third-party advertising, or train public AI models on it. This mirrors the licence you grant in section 13 of our Terms of Service.
• With service providers who help us run the Service, under contracts limiting their use of it (see the next section).
• For legal reasons — to comply with a law, subpoena or lawful request, to enforce our agreements, or to protect the rights, safety and property of our users or the public.
• In a business transaction — if we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of it. We will give notice if it becomes subject to a materially different policy.
• With your direction or consent — anything else.

We rely on a small set of established providers:

• Vercel — application hosting and delivery.
• Neon — managed PostgreSQL database where your account and quote data is stored.
• Anthropic — the AI model that drafts quotes from your descriptions.
• Stripe — subscription billing and client deposit payments.
• Resend — transactional email delivery (proposals, alerts, follow-ups).

Each is bound to use the information only to provide their service to us. If we add or change a provider that materially affects how your information is handled, we will update this list.

Our infrastructure and service providers process and store information in Canada and the United States, and may access it from other countries for support and maintenance.

This means personal information may be stored outside your province or country and may be accessible to courts, law enforcement and national security authorities of those jurisdictions under their laws. We use providers that offer appropriate contractual and security protections for cross-border processing.

We keep personal information only as long as needed for the purposes described here, or as required by law:

• Account and business data — for as long as your account is active.
• After you cancel — you may request an export for at least 30 days, after which we may delete your data.
• Signature and deposit records — retained longer where needed as evidence of a transaction, or to meet tax, accounting and legal-limitation requirements.
• Server logs — retained for a short period for security and troubleshooting.
• Backups — deleted data may persist in encrypted backups for a limited period before being overwritten.

We use safeguards appropriate to the sensitivity of the information, including:

• encryption in transit (HTTPS/TLS) and encryption at rest with our database provider;
• passwords stored only as salted hashes — we cannot read them;
• secure, HTTP-only session cookies and server-side session validation;
• access scoped so one business can never see another business's data;
• rate limiting and abuse protection on sensitive and AI endpoints;
• payment card data handled entirely by Stripe, never by our servers.

No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and keep records of breaches as PIPEDA requires.

Subject to legal limits, you may:

• Access — request a copy of the personal information we hold about you and how it has been used and disclosed.
• Correct — ask us to fix information that is inaccurate or incomplete. Most of it you can edit yourself in your settings.
• Delete — ask us to delete your account and associated data, subject to records we must retain.
• Export — request your data in a portable format.
• Withdraw consent — at any time, subject to legal and contractual restrictions and reasonable notice.
• Opt out of non-essential email — unsubscribe from product and marketing email at any time. Service messages necessary to operate your account (billing, security, a client signing your quote) will still be sent.

Email hello@quotingai.ca to make a request. We may need to verify your identity, and we will respond within the timeframe required by law (generally 30 days under PIPEDA).

If you are a client of one of our customers and want your information corrected or deleted, please contact that contractor directly — it is their information to manage. We will assist them on request.

If you are not satisfied with how we handled your privacy concern, contact us first at hello@quotingai.ca so we can try to resolve it. You also have the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial privacy regulator — in Alberta, the Office of the Information and Privacy Commissioner of Alberta.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy as the Service evolves. If we make a material change, we will give reasonable notice — by email or an in-app notice — before it takes effect, and update the effective date above. Continuing to use the Service after that date means you accept the updated policy.

For any privacy question, request or complaint, contact our privacy contact at hello@quotingai.ca.

QuotingAI is a product of AltaPro AI, Edmonton, Alberta, Canada.