Privacy Policy
1. Who We Are
QUANTAPP_LEGAL_ENTITY — legal entity name and address pending confirmation.
Contact: [email protected]
2. What Data We Collect
- Account data: email, name, company name.
- Service data: estimates, projects, line items, client/customer data entered into estimates, labour rates, catalog customizations.
- Uploaded content: project specs, supplier quotes, drawings, photos, videos.
- AI-generated content: estimate drafts, scope mappings, sourced prices.
- Usage analytics: anonymous, aggregate only (via Plausible — cookieless, no personal data).
- Payment data: handled entirely by Stripe. We never see or store full card numbers.
3. How We Use Your Data
- Provide and operate the estimating service.
- Tenant isolation enforced via PostgreSQL Row-Level Security — your workspace data is never shared with or visible to other tenants.
- Service improvement using anonymized, aggregate data only.
- Customer support — responding to your requests.
4. Subprocessors
| Subprocessor | Purpose | Data Residency |
|---|---|---|
| Stripe | Payment processing | US / global |
| xAI (Grok) | AI scope mapping and material sourcing | US; data sent to xAI may be retained per their data retention policy |
| Google (Gemini) | AI document analysis and audio transcription | US / global; data sent to Google may be retained per their data retention policy |
| Supabase | Authentication and magic-link email delivery | US |
| DigitalOcean | Application hosting and object storage (MinIO) | See “Storage Location” below |
We do not sell, rent, or trade your data to third parties.
5. Where Your Data Is Stored
Your data is hosted on DigitalOcean infrastructure in the United States (New York region). MinIO object storage runs on the same server. Backups are stored in the same region.
QuantApp is a Canadian company serving Canadian builders, but we use US-based hosting infrastructure. This means your personal data may be subject to access requests under US law, including the US CLOUD Act, which permits US authorities to compel data disclosure even when the customer is outside the US.
PIPEDA cross-border transfer notice: Under the Personal Information Protection and Electronic Documents Act (PIPEDA), we are required to inform you that your personal information is being processed outside Canada. By using QuantApp, you consent to this cross-border transfer. We use comparable safeguards (encryption, access controls, contractual obligations with our hosting provider) regardless of jurisdiction.
We will provide at least 30 days’ notice by email and in-app banner before any material change to data residency.
6. Data Retention
- Active subscriptions: data retained for the life of the account.
- Trial expiry: account moves to read-only; data retained 30 days after trial ends, then permanently deleted.
- Pay-as-you-go (punch passes): data retained while credits remain; deleted on request or after 12 months of inactivity.
- Account deletion requests: data deleted within 30 days, except where retention is required by law (e.g., financial records retained for 7 years per CRA requirements).
7. Your Rights Under PIPEDA
- Access: request a copy of your data.
- Correction: request corrections to inaccurate data.
- Deletion: request deletion of your data (subject to legal retention requirements).
- Withdraw consent: cancel your account and request deletion.
- Complaint: contact the Office of the Privacy Commissioner of Canada.
To exercise any of these rights, email [email protected].
8. Cookies and Tracking
- Plausible Analytics: cookieless, privacy-first analytics. No personal data collected, no cross-site tracking.
- Authentication: a session token (JWT) stored in your browser's local storage to keep you signed in. This is not a cookie and is not shared with any third party.
- We do not use advertising cookies, analytics fingerprinting, or cross-site tracking of any kind.
9. Children
QuantApp is a business tool for construction professionals. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
10. Security
- Encryption in transit (TLS 1.2+).
- Encryption at rest (AES-256 for stored API keys and sensitive fields).
- PostgreSQL Row-Level Security for tenant data isolation.
- Login rate limiting and password hashing (PBKDF2-SHA256).
- API keys stored encrypted and never returned in plaintext after initial setup.
11. Changes to This Policy
We will notify users by email and in-app banner of material changes at least 30 days before they take effect.
12. Contact
For privacy questions or data requests: [email protected], attention: Privacy.
QUANTAPP_LEGAL_ENTITY — address pending confirmation.