Data Processing Agreement (DPA)

1. Roles and Scope

Customer (Controller): You are the controller of the personal data you enter, upload, or collect through the Service (customer contacts, lead submissions, etc.). You determine the purposes and means of processing.

QuotePilot (Processor): We act as a processor on your behalf, processing personal data only as necessary to provide the Service to you and in accordance with your instructions.

2. Processing Instructions

We process personal data only on your documented instructions, including as set out in the Terms of Service and this DPA. We will not process your customer data for our own purposes except as required by law. If we receive a legal request to disclose your customer data, we will notify you (to the extent legally permitted) before disclosing any data.

3. Data Subject Rights

We assist you in responding to requests from data subjects (your customers) to exercise their rights under applicable data protection laws (access, correction, deletion, portability, restriction, and objection). If you receive a request from one of your customers regarding their personal data, you are responsible for responding to it. We will reasonably assist you where we are able to do so.

4. Security Measures

We implement appropriate technical and organizational security measures to protect personal data, including:

• Encryption of data in transit (HTTPS/TLS 1.2+) and at rest
• Row-level security isolating each account's data from other accounts
• Access controls and authentication requirements
• Rate limiting and API throttling on public endpoints
• Regular security scans and audits
• Secure secrets management (no credentials in source code)
• Session security with HttpOnly, Secure, and SameSite cookie attributes

5. Sub-Processors

We use the following categories of sub-processors to provide the Service:

• Hosting and database provider (Base44) — application hosting, database storage, and backend infrastructure
• Authentication provider — account login, password verification, and session security
• Payment processor (Base44 Payments, powered by Wix) — subscription billing
• Email delivery provider (Resend) — sending quotes, receipts, reminders, and notifications
• File storage provider — storing logos, uploaded files, and generated PDFs

We enter into written agreements with each sub-processor imposing data protection obligations equivalent to those in this DPA. A current list of sub-processors is available on request. We will notify you in advance of any change to our sub-processors.

6. Data Breach Notification

In the event of a personal data breach affecting your customer data, we will notify you without undue delay (and in any case within 72 hours of becoming aware of the breach). We will provide you with information about the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach. We will take appropriate corrective action to secure the affected data.

7. Data Transfers

Your data may be processed and stored in the United States and other countries where our sub-processors operate. Where personal data is transferred outside the EEA, UK, or Switzerland, we put appropriate safeguards in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure the data receives an adequate level of protection.

8. Data Deletion and Return

Upon termination of your account, or at your request, we will delete your personal data in accordance with our data retention policy (90 days after cancellation, unless you request earlier deletion). You may export your data at any time from the Account page. You may request permanent deletion of all your data at any time by contacting us at info@quotepilot.software, and we will process your request within 30 days.

9. Audit Rights

You may audit our compliance with this DPA, subject to confidentiality obligations. We will provide reasonable assistance and information to help you comply with your audit obligations under data protection laws. We will make available upon request relevant certifications and audit reports.

10. Contact

For questions about this DPA or to request a signed copy, please contact us at info@quotepilot.software. Our postal address is QuotePilot, 72 Snowbird Lane, Ludlow, VT 05149.