Privacy Policy

1. Overview

This policy explains what QuotePilot (operated by Avion Analytics) collects, why, and your rights. For your own account data we act as the data controller. For personal data inside your quotes and client records (your customers' names, addresses, phone numbers), you are the controller and we process it only to provide the service to you.

2. What we collect

• Account data — your name, email, business name, branding (logo, colours, terms text) and verified WhatsApp numbers.
• Job content — the text, voice notes and photos you send to generate quotes, plus the quotes and client records created from them.
• Billing data — your plan, payment references and period dates from PayPal. We never receive or store card numbers.
• Usage data — technical logs (timestamps, message type, processing outcome) used for security, support and billing accuracy.

3. How we use it

• To generate your quotes: voice notes are transcribed and text/photos are analysed by AI to extract job details, which are priced from your rate list.
• Raw voice notes and photos are deleted immediately after extraction — we keep the resulting quote, not the recording or image.
• To operate your account: authentication, WhatsApp number verification codes, billing status and renewal reminders.
• To keep the service secure and diagnose problems.
• We do not sell your data or use your quote content for advertising.

4. Who processes it for us

We use a small set of processors, each bound by data-processing agreements: Supabase (database, authentication and file storage — UK/EU region), Meta's WhatsApp Business Platform (message delivery), Anthropic (AI extraction), Deepgram (speech-to-text), PayPal (payments) and our EU hosting provider. Some providers may process data outside the UK/EU under appropriate safeguards (standard contractual clauses).

5. Retention

• Raw voice notes and photos: deleted right after extraction.
• Quotes, client records and account data: kept while your account is active, deleted or anonymised within 30 days of a verified deletion request.
• Billing and audit records: kept as required by law (typically 6 years).

6. Security

Data is encrypted in transit (TLS) and at rest. Every business's records are isolated with row-level security in the database, inbound WhatsApp webhooks are signature-verified, files are served via signed expiring links, and WhatsApp numbers can only be linked after OTP verification.

7. Your rights

Under UK GDPR you can request access, correction, deletion, restriction or a portable copy of your personal data, and you can complain to the ICO. If your customer contacts us about data in your quotes, we will refer them to you as the controller and assist you in responding. Contact: privacy@avionanalytics.com.

8. Cookies

The web app uses only the cookies/local storage needed to keep you signed in and remember preferences (theme, currency). No advertising trackers.

9. Changes

We will post updates here and email you about material changes. This version applies from the date shown above.