Privacy Policy (QuoteBuddy)

Effective date: 2025-12-22
Last updated: 2026-08-24

This Privacy Policy explains how Therness S.R.L. (“Therness”, “we”, “us”) collects and processes personal data when you use QuoteBuddy (the “Service”) available at quotebuddy.therness.com.

If you do not agree with this Privacy Policy, do not use the Service.

1) Who is the Data Controller?

Data Controller: Therness S.R.L.
Registered/Headquarters: Corso Castelfidardo 30/A, Torino, Italy
VAT: 13211460012
Contact email: info@therness.com

2) Scope

This Privacy Policy covers:

visitors to the Service website and authenticated users;
our marketing/lead tracking on the Service (if enabled); and
our communications with you (support, onboarding, product updates).

It does not cover third-party websites/services you may access via links from the Service.

3) Personal data we collect

Depending on how you use QuoteBuddy, we may process:

Account and profile data: name, work email, password (hashed), organization/tenant information, role, authentication logs.
Billing and subscription data: subscription plan, billing status, invoices, payment method metadata (we do not store full card numbers; our payment provider does).
Usage and device data: IP address, device and browser information, approximate location (derived from IP), timestamps, pages/screens viewed, feature usage, error logs.
Support and communications data: messages you send to us, support requests, and related metadata.
Cookies and similar technologies: identifiers and preferences stored in your browser/device.
AI feature inputs/outputs (if you use AI features): content you submit to AI-enabled features and the resulting output, to provide the requested functionality and improve reliability and safety.

4) Why we process personal data (purposes)

We process personal data to:

Provide the Service (create accounts, authenticate users, run tenant/workspace features).
Manage subscriptions and billing (payments, invoicing, fraud prevention, account administration).
Deliver communications (transactional emails, security notices, support messages; marketing messages where permitted).
Secure and maintain the Service (monitoring, debugging, abuse prevention, incident response).
Measure and improve the Service (analytics, product performance).
Market QuoteBuddy and prioritize prospects (where enabled, using marketing/intent tracking tools like Apollo.io).
Comply with legal obligations (tax/accounting, lawful requests, audits, recordkeeping).

5) Legal bases (EEA/UK and similar jurisdictions)

Where required by law, we rely on one or more of the following legal bases:

Contract: to provide QuoteBuddy and perform our agreement with you.
Legitimate interests: to secure, operate, and improve QuoteBuddy and communicate with business contacts, provided these interests are not overridden by your rights.
Consent: for non-essential cookies/trackers (e.g., analytics and marketing cookies) where opt-in consent is required.
Legal obligations: to meet accounting, tax, and other legal requirements.

6) Cookies, analytics, and marketing tracking

QuoteBuddy uses cookies and similar technologies:

Essential: needed for core functionality (e.g., authentication/session, security).
Self-hosted public-site analytics (Umami): a cookieless tracker operated by Therness measures only allowlisted public content pages. It removes query strings, fragments, referrers, and page-specific titles; does not transmit authenticated, account, tenant, RFQ, profile, settings, subscription, admin, application, API, static, or token-bearing paths; and honours browser Do Not Track. For permitted pages it may process the page path, timestamp, site hostname, language, screen/browser/device information, performance measurements, and tightly limited public CTA event data. Normal web requests also expose connection data such as IP address and User-Agent to the analytics server, which may support session, device, and approximate-location reporting. Umami does not set a QuoteBuddy analytics cookie; this does not mean the resulting records are anonymous or contain zero personal data.
Optional analytics (GA4): if configured, Google Analytics (GA4) is separate from Umami and loads only after you allow analytics cookies/trackers where consent is required.
Marketing/intent tracking (optional): to understand interest in QuoteBuddy and prioritize outreach. We may use Apollo.io website tracking.

QuoteBuddy does not enable Umami session replay, screen recording, or heatmaps.

Consent controls

Cookie preferences control optional GA4 and marketing/intent trackers. You can change those choices at any time from the banner/preferences; withdrawing analytics consent disables further QuoteBuddy GA4 dispatches. The cookieless Umami measurement described above is not controlled by the optional analytics-cookie preference; instead it is restricted to public routes, minimizes URLs, and stops when the browser sends a Do Not Track preference.

7) Sharing of personal data (recipients)

We share personal data only as needed:

Payment processing and billing: Stripe and related Stripe services (via our Stripe integration).
Email delivery: Amazon Web Services (AWS) Simple Email Service (SES) or configured SMTP provider.
Analytics: self-hosted Umami operated by Therness for limited public-site measurement; Google Analytics if separately enabled and consented where required.
Marketing/intent tracking: Apollo.io tracker endpoints (if enabled and consented where required).
AI providers: OpenRouter (and underlying model providers, depending on configuration) for AI-enabled features.
Infrastructure and hosting: cloud providers, logging/monitoring tools (as configured), and content delivery services.
Legal and compliance: authorities or professional advisers when required by law or to protect rights/safety.

We may use service providers (“processors”) who process data on our behalf under appropriate contractual safeguards.

8) International data transfers

Some recipients may process data outside your country (including outside the EEA/UK). When required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and/or other lawful transfer mechanisms.

9) Data retention

We keep personal data only for as long as necessary for the purposes described above, including:

Account data: for the life of the account and a reasonable period after closure to handle disputes and security.
Billing records: as required by tax and accounting laws.
Logs/security data: for a limited period appropriate to security and troubleshooting.
Public-site analytics and performance data: for a limited period needed to measure trends and improve the Service, after which it is deleted or aggregated when no longer necessary.
Marketing data: until you opt out, object, or it is no longer necessary.

Retention periods may vary based on legal requirements and operational needs.

10) Security

We implement technical and organizational measures designed to protect personal data, including access controls, encryption in transit where applicable, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11) Your rights

Depending on your location, you may have rights such as:

Access to your personal data
Rectification (correction)
Erasure (deletion)
Restriction of processing
Data portability
Objection (including to certain marketing or legitimate-interest processing)
Withdraw consent (for consent-based processing) at any time

To exercise rights, contact us at info@therness.com. We may need to verify your identity.

EEA/UK complaints

If you are in the EEA/UK, you may lodge a complaint with your local data protection authority.

California and similar U.S. state privacy rights (summary)

If applicable, you may have the right to know/access, delete, and correct certain personal information, and to opt out of “sale” or “sharing” as defined by law. QuoteBuddy does not intend to “sell” personal information for money; however, some marketing/analytics technologies may be considered “sharing” in some regimes. Cookie preferences control optional GA4 and marketing technologies, Umami honours browser Do Not Track, and you can also contact us about these rights.

12) Children

QuoteBuddy is intended for business users and is not directed to children. Do not provide personal data about children to us.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, where required, provide additional notice.

14) Contact

Questions about privacy can be sent to: info@therness.com