for the QuickQuote software · Version: 19 July 2026
English courtesy translation of the German legal text. In case of discrepancies, the German version shall prevail.
The controller responsible for data processing in connection with the use of the QuickQuote software is:
Lukas Kessler / QuickQuote
Buergermeister-Fuchs-Strasse 70
68169 Mannheim
Email: privacy@quickquote.tech
Note: As soon as a company is incorporated (for example a UG or GmbH), that company shall replace the natural person named above as controller.
This Privacy Policy explains the nature, scope and purpose of the processing of personal data when using the QuickQuote software, the web application at app.quickquote.tech, the website quickquote.tech and the mobile apps for iOS and Android.
Personal data means any information by which you can be personally identified.
When using QuickQuote, the following data may be processed:
Order and site inspection data that the business records about its customers is processed by the provider as a processor on behalf of the business pursuant to Art. 28 GDPR. Details are governed by the data processing agreement (DPA). The data processing agreement is concluded upon registration and also applies to the free enquiry tier.
This data is processed solely for providing the functions of the software.
Data is processed for the following purposes:
Legal bases:
The QuickQuote software (web application at app.quickquote.tech) is provided through Google Firebase (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Firebase is used for the following services:
All data is stored and processed primarily in the europe-west region (EU).
In this context, personal data (for example email address, name, project data, technical usage data) may be processed on Google's servers. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. Google LLC is certified under the EU-U.S. Data Privacy Framework; additionally, standard contractual clauses pursuant to Art. 46 GDPR are in place.
Legal basis: Art. 6(1)(b) GDPR.
The marketing website quickquote.tech (not the web application) is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. When the website is accessed, Netlify processes technically necessary server log data (in particular the IP address, time of access, page requested, user agent) in order to deliver the website and ensure its security. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Netlify; the transfer to the USA is based on standard contractual clauses pursuant to Art. 46 GDPR.
When starting a paid subscription via the checkout form on the pricing page, interested parties provide the following data: owner email address (required) and, optionally, company name, industry and role. This data is used to prepare the order and to create a secure checkout session with Stripe (see Section 7 “Payment Processing (Stripe)”). It is not used for advertising purposes or shared with third parties for advertising purposes.
Legal basis for website hosting: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Legal basis for the form: Art. 6(1)(b) GDPR (performance of pre-contractual measures).
Businesses using QuickQuote can create a public enquiry link with a QR code and share it with their customers. The associated form page is provided as part of the web application via Google Firebase at app.quickquote.tech (see Section 5). The business's customers can use it to submit an enquiry to the business without needing an account of their own. The following data is collected: name (required), description of the request (required), phone number and/or email address (at least one of the two) and, optionally, the desired service, postcode and town.
Allocation of roles: For the contents of the enquiry, the respective business is the controller within the meaning of the GDPR. QuickQuote processes this data solely as a processor on behalf of the business pursuant to Art. 28 GDPR. The privacy information of the respective business displayed directly on the enquiry form (with details of the controller, purpose, legal basis, categories of data, retention period and data subject rights) is authoritative for the processing of the contents.
Technical operation of the form page: QuickQuote is a controller in its own right for the provision of the form page itself and for security and abuse protection. To protect against automated submissions, we use an invisible control field (honeypot) and server-side rate limiting. For rate limiting, the IP address is not stored in plain text but processed exclusively as a business-specific hash value; this data is deleted after approximately 24 hours. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure provision and protection against abuse).
No automated AI processing: Enquiries received through the form are not processed automatically by AI services; only technical validation and normalisation of the entries and storage in Cloud Firestore take place. AI features (see Section 6) are only used once a business deliberately adopts the enquiry into a project.
Retention: Enquiries that are not opened by the business are deleted automatically 30 days after receipt. Otherwise, the business as controller determines the retention period.
Confirmation and notifications: After submitting an enquiry, customers receive a confirmation with a reference number directly in the browser; no confirmation email is sent. Authorised employees of the business may be informed of new enquiries via internal push notifications.
QuickQuote uses the data collected through the form solely to make it available to the respective business, and not for its own advertising, personalised analytics or the training of AI models.
To support certain functions, the API of OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA or a comparable AI service provider is used. The provider reserves the right to replace the AI service used with an equivalent provider.
Depending on the function, the following data is transmitted to the AI service:
Data is only transmitted when the relevant function is actively used, for example when recording a voice note. Only such data is transmitted as is necessary for the relevant function (principle of data minimisation pursuant to Art. 5(1)(c) GDPR). Under OpenAI's API terms, the transmitted content is not used to train AI models and is stored only temporarily for the purpose of providing the service and monitoring for abuse.
Processing takes place automatically. The substantive accuracy or completeness of generated results cannot be guaranteed. Users are obliged to review AI-generated results on their own responsibility.
A data processing agreement pursuant to Art. 28 GDPR has been concluded with the AI provider. Data transfers to the USA take place on the basis of standard contractual clauses pursuant to Art. 46 GDPR.
Legal basis: Art. 6(1)(b) GDPR.
Payments are processed by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. When purchasing a paid license, data required for payment processing (for example name, email address, billing address) is transmitted to Stripe.
Complete payment data (for example card numbers) is processed exclusively by Stripe and is not stored on our servers. Stripe is PCI DSS certified. Subscription management takes place through the customer portal at quickquote.tech/en/account.
Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Stripe.
Legal basis: Art. 6(1)(b) GDPR.
For sending transactional emails (such as invitations, welcome emails, notifications), we use the service Resend, Inc., 2261 Market Street #4059, San Francisco, CA 94114, USA.
In this process, the recipient's email address and the respective email content are transmitted to Resend. Resend processes this data exclusively for the purpose of email delivery and does not store personal data beyond the delivery process.
Data transfers to the USA take place on the basis of standard contractual clauses pursuant to Art. 46 GDPR.
Legal basis: Art. 6(1)(b) GDPR.
This website uses the font “Barlow” for consistent visual presentation. The font files are served from the same server as the website (first-party hosting), not via external Google servers. No connection to Google is established and no IP address or other data is transferred to Google or any third party for the purpose of loading fonts.
The website quickquote.tech does not use cookies for tracking or analytics purposes. Only sessionStorage is used to store the selected language preference (German/English) for the duration of the browser tab. This data is automatically deleted when the tab is closed and is not transmitted to third parties.
The web application at app.quickquote.tech uses IndexedDB (a browser-side database) to locally cache application data from Google Firebase. This is technically necessary for the software to function and enables offline use. No data is stored for tracking or advertising purposes.
In the public demo environment we keep anonymous, aggregated usage counters (e.g. how often the demo is opened or the guided tour is started on a given day). No cookies are set, no IP addresses are stored and no personal data is processed; we only count the number of events per calendar day.
Legal basis: Art. 6(1)(b) GDPR (technically necessary for contract performance) and Art. 6(1)(f) GDPR (legitimate interest in language selection).
Data processing agreements pursuant to Art. 28 GDPR have been concluded with all service providers used (Google LLC, Netlify, Inc., OpenAI L.L.C. or comparable AI provider, Stripe, Inc., Resend, Inc.). These providers process data exclusively in accordance with our instructions and applicable data protection requirements.
Data is stored only as long as necessary to provide the software. Personal data is deleted as soon as the purpose of processing no longer applies, unless statutory retention obligations prevent deletion (for example tax retention periods pursuant to Section 147 AO).
Deletion of an individual user account (for example when an employee leaves):
When an individual user account is deleted within an existing workspace, login data (email, password) as well as personal profile data (name, phone number) are deleted irrevocably. The user's name is replaced systemically with "Former User." All content created in the workspace (projects, inspections, photos, notes) remains stored because it constitutes the customer's company and business data and is not attributed to the user's personal data inventory.
Termination of the workspace subscription:
After termination of the subscription, the workspace data is initially retained so that the subscription can be reactivated if needed. The workspace administrator can request the complete and irreversible deletion of all workspace data at any time by email to privacy@quickquote.tech; deletion takes place within 30 days of receipt of the request, unless statutory retention obligations (for example Section 147 AO) apply.
QuickQuote provides the following export features:
Export of personal profile data (all users):
Each user can export a machine-readable copy of their personal profile data (name, email address, phone number, role, member since) in JSON format at any time through the account settings. This export is limited to once per calendar month. This satisfies the right to data portability pursuant to Art. 20 GDPR.
Export of workspace data (administrator/owner only):
The workspace administrator can trigger a complete export of all workspace data in JSON format through the app. This export includes: user profile, team data, all projects with inspections and links to stored media files (photos). The media files themselves can be accessed via the links contained in the JSON file. This export is also limited to once per calendar month.
Project data, construction site documentation and other content created in the workspace are company data of the customer (controller under the GDPR) and are not subject to an individual export claim of single users.
Employees without an administrative role can delete their account at any time through the profile settings in the app. Owners or administrators of a workspace can have their account or the entire workspace deleted by email to privacy@quickquote.tech (the administrative role must be transferred beforehand, or the workspace deleted as a whole). Upon deletion, personal profile data (name, email address, phone number) is deleted irrevocably. Content created in the workspace (projects, inspections, photos, notes) remains with the company (see Section 12).
You have the following rights with regard to your personal data:
Right to object under Art. 21 GDPR: Where we process personal data on the basis of Art. 6(1)(f) GDPR (in particular server log data and technical usage data), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. You may send your objection informally to privacy@quickquote.tech.
To exercise your rights and for information requests pursuant to Art. 15 GDPR, please contact: privacy@quickquote.tech
Requests are processed within 30 days.
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The competent supervisory authority is:
The State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg
Lautenschlagerstrasse 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de
In connection with the use of QuickQuote, the provider sends the following transactional emails:
These emails are technically necessary for operation of the software and are sent exclusively to the email address stored in the account. Legal basis: Art. 6(1)(b) GDPR.
If you have questions regarding data protection, please contact:
Email: privacy@quickquote.tech
Lukas Kessler · Buergermeister-Fuchs-Str. 70 · 68169 Mannheim · quickquote.tech
Contact by email: If you contact us by email (for example at support@quickquote.tech or privacy@quickquote.tech), we process your email address, the content you provide and the time of your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete the correspondence once it is no longer required for handling the matter, unless statutory retention obligations (for example for business correspondence under the German Commercial Code (HGB) and the German Fiscal Code (AO)) require continued storage.
Quick