Privacy Policy
What we collect, who we send it to, and what we do not do with it.
This policy explains how Martin Wai Hang Tse (ABN 24 566 565 190) handles personal information, consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
About you: your name, email address, password (stored only as a cryptographic hash — we cannot read it), your business name, ABN, licence number, address, phone, and the bank details you choose to print on your quotes. If you sign in with Google or Facebook, we receive your name, email address and profile picture from them.
About your customers: whatever you enter — business name, contact name, phone, email, site address and your notes. You are giving us other people's information. You are responsible for having the right to do that.
Your messages: the text or voice notes you send the bot, and the message identifiers WhatsApp gives us. Also your quotes, price list, and when quotes were sent and decided.
Technical: failed sign-in attempts (to stop password guessing), and basic server logs.
What we do not collect
- Card numbers. Payments go through Stripe's own checkout. We only ever see a customer reference, never a card.
- Your voice recordings, kept. A voice note is downloaded, transcribed, and discarded. We store the resulting text, not the audio.
- We do not track you across other websites, and we run no advertising.
Who we send it to
Running this service means sending some of your information to these processors. This list is complete.
| Who | What they get | Why |
|---|---|---|
| Meta (WhatsApp) | Your phone number and message contents | To carry messages between you and the bot |
| OpenAI | The audio of your voice notes | Speech-to-text |
| Anthropic | The transcript, your product and customer names | To work out what you're asking for |
| Stripe | Your name, email, and payment details you give them | Billing |
| Our hosting and database providers | All stored data | To run the service |
Some of these process data outside Australia, including in the United States. We do not sell your information to anyone, ever, and we do not share it with anyone not on this list.
How it's protected
Passwords are hashed with scrypt. Sessions use signed, HTTP-only cookies. Every business's data is separated at the database level, and no page or link can reach another business's information. See Security for the detail, including what we have not done yet.
How long we keep it
While your account is open, and for 30 days after you close it. Failed sign-in records are deleted after 7 days. We may keep records longer where the law requires it.
Your rights
You can ask us to show you what we hold, correct it, export it, or delete it. Email info@quotebot.online and we will respond within 30 days.
If you think we have mishandled your information, tell us first. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Cookies
We set one cookie, to keep you signed in, and a short-lived one during sign-in to prevent a known attack. Both are strictly necessary. We use no analytics, advertising or tracking cookies, which is why you have not been shown a cookie banner.
Last updated 7 August 2026.