Privacy Policy
Quote to Cash is a tool contractors use to quote work, get it agreed, and invoice for it. We don't run ads, we don't use analytics or third-party trackers, and we never sell personal information. This page explains what we collect from contractors, what we hold about their customers, who else receives it, and how long any of it lasts.
Two kinds of people are described here
Contractors create an account, agree to our terms, and use the app to run their business. If you signed up, this is you.
Customers of contractors never signed up for anything. Your details are in Quote to Cash because a contractor you asked for work entered them, so they could send you a quote or an invoice. The section If a contractor quoted you is written for you.
What we collect from contractors
- Your account. Name and email address. Your password is stored only as a scrypt hash — we cannot read it and never see it in the clear.
- Your business. Trading and legal name, address, phone, email, tax identifier and logo. These are printed on the documents you send, which is the reason we hold them.
- Your sessions. A session token and the browser or device description your app sent, so you can recognise and end a session you don't recognise.
- Verification and reset codes. Hashed, short-lived and single-use.
What we hold about your customers
Entered by the contractor, or created when a customer acts on a document:
- Contact details — name, email, phone, address.
- The work — job descriptions, line items, prices, invoices and payments.
- Photographs attached by the contractor as a record of the work.
- Acceptance records. When a customer accepts a quote or a change order we store their typed or drawn signature, the date and time, the IP address the acceptance came from, the browser description, and a hash of the exact document accepted.
That last one deserves plain language rather than a bullet. We keep a record of the signature and the internet address a quote was accepted from. It exists so that a disagreement later about what was agreed has an answer. It is written only when a customer acts on their own document, and a contractor cannot create or alter one.
What we do not collect
No analytics. No advertising identifiers. No third-party trackers. No location. No access to contacts. We do not sell personal information, we do not share it for advertising, and nothing in this app tracks you across other apps or websites.
The app asks for camera and photo library access only when a contractor attaches a photograph to a job. Those images go to our servers and nowhere else.
Who else receives data
- Stripe — card details, entered by the customer directly into Stripe, plus the invoice amount and reference. Used to take card payments and to pay contractors out.
- Resend — recipient address and message content, to send quotes, invoices, reminders and codes.
- RevenueCat and Apple — App Store subscription events and an opaque business identifier, to run subscriptions bought inside the app.
- Railway — hosting, and everything above at rest.
- Cloudflare R2 — encrypted database backups, for disaster recovery.
Card numbers never reach our servers. They are collected by Stripe in your own browser. We see that a payment succeeded and for how much.
The identifier we send RevenueCat is a random business id, not an email or a name.
How long we keep it
While an account is open, for as long as it is open — a contractor's records are their business records.
When a contractor deletes their account, we delete the business and everything under it, including their customers' details.
Encrypted backups are the exception. Deleted data remains in backups until those backups age out, which takes up to 12 months. We cannot selectively remove one record from an encrypted backup, and we do not restore backups in order to reinstate deleted accounts.
If a contractor quoted you
The contractor decides what to collect about you and why. We hold it for them. That means requests to see, correct or delete your details go to the contractor who sent you the document, not to us — they are the ones who can act on them, and we act on their instructions.
If you cannot reach them, write to us at the address below and we will do what we can to put you in touch.
Your choices as a contractor
- See your data. The app exports your customers, invoices and payments.
- Correct it. Everything is editable in the app.
- Delete it. Settings → Account → Delete account removes the business and everything under it. This cannot be undone, and backups are as described above.
Security
Traffic is encrypted in transit. Passwords are hashed with scrypt. Backups are encrypted before they leave our infrastructure. Customer-facing document links carry an unguessable token, which is what lets a customer open a quote without an account — treat such a link as you would the document itself.
Where data is processed
Our servers and service providers are located in the United States. If you use the app from elsewhere, your data is transferred to and processed there.
Children
Quote to Cash is a tool for businesses and is not directed at children under 13. We do not knowingly collect their information.
Changes
If this policy changes materially we will update the effective date above, and say so in the app.
Contact
Carva Tech Solutions LLC
3017 Namaste Dr, Clermont, FL 34714, United States
support@carvatechsolutions.com