Privacy Policy (QuoteBuddy)

Effective date: 2025-12-22
Last updated: 2025-12-22

This Privacy Policy explains how Therness S.R.L. (“Therness”, “we”, “us”) collects and processes personal data when you use QuoteBuddy (the “Service”) available at quotebuddy.therness.com.

If you do not agree with this Privacy Policy, do not use the Service.

1) Who is the Data Controller?

Data Controller: Therness S.R.L.
Registered/Headquarters: Corso Castelfidardo 30/A, Torino, Italy
VAT: 13211460012
Contact email: info@therness.com

2) Scope

This Privacy Policy covers:

visitors to the Service website and authenticated users;
our marketing/lead tracking on the Service (if enabled); and
our communications with you (support, onboarding, product updates).

It does not cover third-party websites/services you may access via links from the Service.

3) Personal data we collect

Depending on how you use QuoteBuddy, we may process:

Account and profile data: name, work email, password (hashed), organization/tenant information, role, authentication logs.
Billing and subscription data: subscription plan, billing status, invoices, payment method metadata (we do not store full card numbers; our payment provider does).
Usage and device data: IP address, device and browser information, approximate location (derived from IP), timestamps, pages/screens viewed, feature usage, error logs.
Support and communications data: messages you send to us, support requests, and related metadata.
Cookies and similar technologies: identifiers and preferences stored in your browser/device.
AI feature inputs/outputs (if you use AI features): content you submit to AI-enabled features and the resulting output, to provide the requested functionality and improve reliability and safety.

4) Why we process personal data (purposes)

We process personal data to:

Provide the Service (create accounts, authenticate users, run tenant/workspace features).
Manage subscriptions and billing (payments, invoicing, fraud prevention, account administration).
Deliver communications (transactional emails, security notices, support messages; marketing messages where permitted).
Secure and maintain the Service (monitoring, debugging, abuse prevention, incident response).
Measure and improve the Service (analytics, product performance).
Market QuoteBuddy and prioritize prospects (where enabled, using marketing/intent tracking tools like Apollo.io).
Comply with legal obligations (tax/accounting, lawful requests, audits, recordkeeping).

5) Legal bases (EEA/UK and similar jurisdictions)

Where required by law, we rely on one or more of the following legal bases:

Contract: to provide QuoteBuddy and perform our agreement with you.
Legitimate interests: to secure, operate, and improve QuoteBuddy and communicate with business contacts, provided these interests are not overridden by your rights.
Consent: for non-essential cookies/trackers (e.g., analytics and marketing cookies) where opt-in consent is required.
Legal obligations: to meet accounting, tax, and other legal requirements.

6) Cookies, analytics, and marketing tracking

QuoteBuddy uses cookies and similar technologies:

Essential: needed for core functionality (e.g., authentication/session, security).
Analytics (optional): to understand usage and improve QuoteBuddy. We may use Google Analytics (GA4).
Marketing/intent tracking (optional): to understand interest in QuoteBuddy and prioritize outreach. We may use Apollo.io website tracking.

Consent controls

If required by your location, QuoteBuddy will not load non-essential analytics/marketing trackers until you opt in via the cookie banner/preferences. You can change your choices at any time from the banner/preferences.

7) Sharing of personal data (recipients)

We share personal data only as needed:

Payment processing and billing: Stripe and related Stripe services (via our Stripe integration).
Email delivery: Amazon Web Services (AWS) Simple Email Service (SES) or configured SMTP provider.
Analytics: Google Analytics (if enabled and consented where required).
Marketing/intent tracking: Apollo.io tracker endpoints (if enabled and consented where required).
AI providers: OpenRouter (and underlying model providers, depending on configuration) for AI-enabled features.
Infrastructure and hosting: cloud providers, logging/monitoring tools (as configured), and content delivery services.
Legal and compliance: authorities or professional advisers when required by law or to protect rights/safety.

We may use service providers (“processors”) who process data on our behalf under appropriate contractual safeguards.

8) International data transfers

Some recipients may process data outside your country (including outside the EEA/UK). When required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and/or other lawful transfer mechanisms.

9) Data retention

We keep personal data only for as long as necessary for the purposes described above, including:

Account data: for the life of the account and a reasonable period after closure to handle disputes and security.
Billing records: as required by tax and accounting laws.
Logs/security data: for a limited period appropriate to security and troubleshooting.
Marketing data: until you opt out, object, or it is no longer necessary.

Retention periods may vary based on legal requirements and operational needs.

10) Security

We implement technical and organizational measures designed to protect personal data, including access controls, encryption in transit where applicable, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11) Your rights

Depending on your location, you may have rights such as:

Access to your personal data
Rectification (correction)
Erasure (deletion)
Restriction of processing
Data portability
Objection (including to certain marketing or legitimate-interest processing)
Withdraw consent (for consent-based processing) at any time

To exercise rights, contact us at info@therness.com. We may need to verify your identity.

EEA/UK complaints

If you are in the EEA/UK, you may lodge a complaint with your local data protection authority.

California and similar U.S. state privacy rights (summary)

If applicable, you may have the right to know/access, delete, and correct certain personal information, and to opt out of “sale” or “sharing” as defined by law. QuoteBuddy does not intend to “sell” personal information for money; however, some marketing/analytics technologies may be considered “sharing” in some regimes. You can control such technologies through cookie preferences and by contacting us.

12) Children

QuoteBuddy is intended for business users and is not directed to children. Do not provide personal data about children to us.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date and, where required, provide additional notice.

14) Contact

Questions about privacy can be sent to: info@therness.com