Privacy Policy

Information we handle

• Account and shop data: name, email, organization, role, profile, authentication identifiers, plan, and signup date.
• Quoting data: customers and contacts, CAD files, part geometry, materials, rates, prices, quote status, customer quote links, and audit activity.
• Billing and communications: subscription status, metered use, payment-provider references, transactional email delivery, and support messages.
• Technical and analytics data: IP address, approximate country or region, browser/device details, URL paths without query strings or fragments, referrer domains and UTM parameters, advertising click identifiers when Marketing is allowed, page and feature use, clicks, errors, web performance measurements, timestamps, and stable analytics identifiers after this version is effective.

Necessary, Analytics, and Marketing

Necessary storage supports authentication, security, service delivery, and your six-month privacy-choice cookie (nq_consent). It is always on.

Analytics is optional. PostHog measures product funnels, business events, errors, and web performance. After the effective date, PostHog may use persistent identity and record replay only on public marketing and calculator pages; inputs are masked, canvas and network contents are not recorded, URL query strings and fragments are removed, and signed-in app pages, auth, legal pages, customer quote pages, uploaded-file content, and quote-detail content are excluded from replay and autocapture. HeyCatch automatically measures production visits, routes, and clicks after the effective date. We do not manually duplicate those HeyCatch events.

Marketing is optional and currently stores only campaign attribution and advertising click identifiers. NanoQuote has no marketing or advertising pixels configured. Adding one requires a named disclosure, policy update, consent-version change, and a new choice.

Browser storage

• nq_consent is a Necessary cookie that stores your category choices and policy version for six months.
• When Analytics is allowed and this policy is effective, PostHog uses a ph_…_posthog cookie and matching local storage for up to 180 days. They hold random device, person, and session identifiers plus consented attribution needed to connect visits and product events.
• PostHog persistent storage is enabled only on nanoquote.app and www.nanoquote.app. Localhost, development, and preview hosts use no PostHog cookie or local-storage persistence.
• Turning off Analytics removes PostHog browser persistence. Turning off Marketing removes advertising click identifiers while leaving consented Analytics active.

How choices work

• EU/EEA, UK, Switzerland, and unknown locations: Analytics and Marketing stay off until you opt in.
• Other locations: Analytics starts after regional resolution with notice; Marketing stays off until selected.
• Global Privacy Control or Do Not Track turns both optional categories off and overrides a stored preference.
• UTM parameters and external referrers are Analytics. Google, Microsoft, Meta, TikTok, or similar advertising click identifiers are Marketing and are cleared when Marketing is withdrawn.

Processors and transfers

Purposes and legal bases

We process service data to perform our contract, secure and support NanoQuote under our legitimate interests, meet legal obligations, and handle optional Analytics and Marketing according to consent or the permitted regional framework. You may withdraw an optional choice at any time without affecting earlier lawful processing.

Retention

• Quote retention is controlled by each organization: default 3 years for draft/sent/rejected and 7 years for accepted/completed, within the configured range.
• Inactive free accounts are eligible for deletion after 12 months; cancelled-subscription data is held for 90 days; deletion requests have a 14-day grace period; export files expire after 30 days.
• Consent records are retained with the account and removed during user deletion. The public cumulative shop-signup counter contains no personal data and is not decremented.
• HeyCatch retains analytics while NanoQuote subscribes and for up to two months afterward. PostHog retention follows NanoQuote's configured project retention; contact us for the current setting or to request deletion. Security, tax, dispute, and legal records may be kept longer when required.

Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection; opt out of sale/sharing or targeted advertising; withdraw consent; and appeal or complain to a regulator. NanoQuote does not sell personal information or use it for cross-context behavioral advertising today. Use Settings → Privacy & Data, Do Not Sell or Share, Privacy choices, or email privacy@nanoquote.app.

Security, children, and changes

We use access controls, tenant isolation, encryption in transit and at rest where supported, backups, and audit records. NanoQuote is a B2B service and is not directed to children under 16. Significant policy changes receive email or an in-app notice at least 30 days before taking effect.