Privacy policy

What personal information Quoflow collects, why, how we protect it, and your rights under the New Zealand Privacy Act 2020.

This policy explains what personal information Quoflow collects, why, how we look after it, and the rights you have. It is written to meet the Privacy Act 2020 and its information privacy principles (IPPs).

Who we are

Quoflow Limited is a New Zealand company based in Christchurch. We make estimating software for building product suppliers, available at app.quoflow.co.nz, and run this website.

You can contact our Privacy Officer about anything in this policy: just email us.

Our two roles

Quoflow holds two kinds of information, and our responsibilities differ for each.

Workspace content: we act for our customers

When a business uses Quoflow, its workspace holds the emails it receives, the plans attached to them, its products and prices, and its own customers’ details, such as builders, merchants and site addresses. We hold this information on that business’s behalf and only use it to provide the service to them. Under section 11 of the Privacy Act, information we hold as an agent is treated as held by our customer. Our customer decides what goes into its workspace and is responsible for it under the Act.

If your details are in a Quoflow customer’s workspace and you want to see or correct them, contact that business first. If you contact us, we will pass your request on and help them respond.

Account, website and billing information: we are responsible

For information about the people who sign up and use Quoflow, people who contact us through this website, and billing, Quoflow Limited is the agency responsible.

What we collect and how

Directly from you

Account details: name, work email address, role, and a password, which we store only as a bcrypt hash.
Contact and walkthrough requests: your name, company, email, phone number if you give it, and your message.
Support conversations and feedback you send us.
Billing details: billing contact, company details and invoices. Card details are collected and held by Stripe, not by us.

From connected mailboxes and systems

When a customer connects Microsoft 365, forwards email to their workspace address, connects a business system (ERP), imports a price list or uploads plans, Quoflow receives what those sources contain. This can include the names, email addresses, phone numbers and site addresses of the people who sent the emails, and of people named in them or in the plans.

Automatically

How the app is used by signed-in users: the screens opened, buttons and shortcuts used, how long steps take, and errors or slow responses. We don’t record what you type, the contents of emails or plans, or prices. We keep it for 120 days.
Technical information needed to run and secure the service, such as IP addresses, browser type, and the time of sign-ins and requests, recorded in server logs.
A session cookie that keeps you signed in to the app. See our cookie policy.

People whose details arrive in a customer’s emails

Information privacy principle 3A, in force from 1 May 2026, requires agencies that collect personal information from someone other than the person it is about to take reasonable steps to let that person know, unless an exception applies.

Builders, merchants, architects and others who send quote requests to a Quoflow customer have their details collected by that customer, through Quoflow. Because we hold this information on our customer’s behalf, our customer is the agency responsible for telling those people, for example in its own privacy statement, quote terms or email footer. Our customers are responsible for their own notices.

To help, we:

publish this policy so anyone can see how Quoflow handles information it processes for its customers;
give customers plain wording they can adapt for their own privacy statements on request;
only use those details to provide the service to that customer, never for our own marketing or anyone else’s.

Why we use it

To provide the service: sorting email into jobs, reading plans, finding doors, matching products and prices, and producing quotes for review.
To set up and manage accounts, workspaces and users.
To keep the service secure, prevent misuse and fix problems.
To understand how the app is used, so we can make it faster and easier to use.
To answer questions, provide support and arrange walkthroughs.
To bill customers and keep the financial records the law requires.
To tell customers about changes to the service, these terms or this policy.

We do not sell personal information. We do not use one customer’s data to improve another customer’s results.

How AI is used

Quoflow uses a business AI service to help read emails and plans, under terms that do not allow it to use your data to train its models. Information is sent to it only to process your requests.

AI suggestions are always checked by a person before a quote is priced or sent. Quoflow does not make decisions about individuals. Read more in our Responsible AI statement.

Storage and security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, as IPP5 requires. These include:

encryption of all data in transit with TLS (HTTPS everywhere, with HSTS);
mailbox and system credentials sealed with AES-256 encryption;
passwords stored only as bcrypt hashes;
strict separation of each customer’s workspace (tenant isolation);
secure, same-site session cookies;
read-only access to connected mailboxes by default: Quoflow never sends, deletes or orders anything on its own and never marks emails as read.

No system is perfectly secure, but we work to keep risks low and to act quickly if something goes wrong.

Overseas providers

We use trusted service providers for hosting, storage, AI processing, email and payments. Some are located overseas, and information is stored and processed in Japan and the United States. A current list of providers is available to customers on request.

Where these providers store or process information only on our behalf, we remain responsible for it. Where sending information to an overseas provider is a disclosure under IPP12, we only do so where the provider is subject to privacy laws that, overall, provide comparable safeguards to the Privacy Act, or where we have contractual protections in place that require them to protect the information in a way comparable to New Zealand law.

How long we keep it

Workspace data is kept while the customer’s account is active.
When an account is closed, workspace data is deleted within 90 days, unless the law requires us to keep something longer.
Backups roll off on their normal cycle after that.
Billing and financial records are kept for as long as New Zealand tax and company law requires.
Website enquiries are kept for as long as they are useful for the conversation, then deleted.

Your rights to access and correct

Under IPP6 you can ask whether we hold personal information about you and ask to see it. Under IPP7 you can ask us to correct it. If we don’t make a correction you ask for, you can ask us to attach a statement of the correction you wanted.

To make a request, email us. We may need to confirm your identity first. We will respond as soon as reasonably practicable, and within 20 working days, as the Act requires.

If your request is about information in a Quoflow customer’s workspace, that customer is responsible for responding. We will help them do so.

Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first. We will look into it and respond.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Privacy breaches

If a privacy breach happens, we act quickly to contain it and reduce any harm. If it is a notifiable privacy breach under the Act, meaning it has caused or is likely to cause serious harm, we notify the Privacy Commissioner and affected people as soon as practicable, as the Act requires.

Where the breach involves a customer’s workspace content, we tell that customer without undue delay so they can meet their own obligations. Our data processing agreement sets out the details.

Cookies

We use essential cookies only. We do not use advertising or tracking cookies. See our cookie policy.

Changes to this policy

We will update this policy when our practices or the law change. We will show the date of the latest version below, and tell customers by email about significant changes before they take effect.

Last updated 12 October 2026