Your information should never be a mystery.

Who is responsible?

For a customer enquiry, the service provider whose quote page you use decides why the information is used and is the primary data controller. QuoteKit provides the software that stores and displays the enquiry on that provider’s instructions. QuoteKit separately controls provider account and security information needed to operate the service.

What we collect

• Provider account: name, email address, password hash, recovery-code hash, business details and WhatsApp number.
• Customer enquiry: name, phone number, optional email, event date and time, venue, menu selections, guest count, notes and any dietary information you choose to provide.
• Security: a random session token is kept in a secure, HTTP-only browser cookie; only its cryptographic hash is stored in the database. Failed authentication is temporarily counted against a cryptographic key derived from the email address and network address to prevent repeated guessing.

Why we use it

We use the information to create and secure accounts, calculate estimates, deliver enquiries to the selected provider, notify the provider by email when a new enquiry arrives, help the provider prepare a final quote, respond to privacy requests, prevent misuse and maintain the service. We do not sell customer information or use it for advertising.

Where it is stored

Application records are stored in a Cloudflare D1 database and processed by the QuoteKit Cloudflare Worker. Source code is stored separately in a private GitHub repository; customer and provider records are not stored in GitHub. Cloudflare infrastructure may process information outside Nigeria subject to its service safeguards.

When an enquiry is submitted, QuoteKit emails a short alert to the provider’s account email address using Resend, an email delivery service. The alert contains the customer’s name and WhatsApp number, the event type, guest count, event date, venue and estimated total. It does not include the customer’s email address, dietary information or notes. Resend processes these details to deliver the email, which may take place outside Nigeria, including in the United States, subject to its service safeguards.

How long it is kept

Providers choose an enquiry-retention period between 30 and 730 days; the default is 365 days. Expired enquiries are removed when the provider uses the authenticated dashboard. Providers can delete an enquiry earlier. Email alerts already delivered to a provider’s inbox are held by the provider’s own email service and are not removed by QuoteKit’s retention period; providers are responsible for deleting them. Privacy-request records may be retained while the request is handled and as reasonably needed to demonstrate compliance.

Who can see it

Customers can use the public quote page. Submitted enquiry details are available only inside the authenticated dashboard belonging to the relevant provider, in the email alert sent to that provider, and to infrastructure and email-delivery suppliers required to operate QuoteKit. When a provider sends a final quote, the client receives a private link to a PDF of it, showing the client’s name, event details, menu, price and the provider’s payment details; anyone the link is shared with can open it. Providers must use the information only to respond to the enquiry and manage the booking.

Your choices and rights

You may request access, correction, deletion, or object to processing. Providers can export or delete their account data from the Privacy Centre. Customers should use the privacy-request link belonging to the provider who received the enquiry.

Open the relevant business quote page and select “Privacy request” at the bottom so your request reaches the correct provider.

Security and complaints

Passwords are salted and hashed before storage. Dashboard access requires a valid, expiring session. No internet service can promise absolute security; if you believe your information has been misused, submit a request to the provider and you may also complain to the Nigeria Data Protection Commission.