Privacy Policy
Who we are
QuoteBake (the "Service") is operated from the United Kingdom. We are the controller of any personal data you provide when using the Service. You can reach us at hello@quotebake.co.uk.
What we collect
- Account data: the name and email address you provide at sign-up, and the hashed form of your password (we never store the plain-text password).
- Business data: the recipes, ingredients, packaging items, business details, logo, and quotes you create inside the app. This is your data — we hold it on your behalf.
- Marketing consent: whether you ticked the optional consent box at sign-up.
- Newsletter subscription data: if you sign up for our newsletter (via the marketing site or the free pricing calculator) we store your email address, the page you signed up from, your IP address at the time of signup, your browser identifier, and the timestamps of your subscription, confirmation and any unsubscribe. This record demonstrates your explicit consent under UK PECR.
- Billing data: if you upgrade to Pro, Stripe processes your payment. We receive a customer identifier and subscription status from Stripe but never see your card details.
- Technical data: standard server logs (IP address, browser, timestamps) kept for security and debugging.
How we use it
- To provide and operate the Service (lawful basis: contract).
- To send transactional emails — account verification, password resets, payment confirmations, payment failures (lawful basis: contract).
- To send occasional product updates and offers only if you ticked the marketing consent box (lawful basis: consent — you can withdraw at any time).
- To send the weekly QuoteBake newsletter only if you subscribed and clicked the confirmation link in the double opt-in email (lawful basis: consent — you can withdraw at any time via the one-click unsubscribe link in every email, or by emailing hello@quotebake.co.uk).
- To detect and prevent abuse and protect the Service (lawful basis: legitimate interests).
Who we share data with
We share the minimum necessary data with the following processors:
- Stripe (Stripe Payments UK, Ltd.) — payment processing.
- 20i Ltd — UK-based hosting for the marketing site and email delivery.
- Vercel, Inc. — hosts the app and API (data resident in the EU region we've selected).
- Neon — managed PostgreSQL database (EU region).
- Upstash — Redis-based rate limiting to prevent abuse (EU region).
- Cloudflare — privacy-friendly, cookie-free web analytics on our marketing pages. Cloudflare Web Analytics does not use cookies or track users across sites; it aggregates pageviews and traffic sources only, with IP addresses anonymised at the edge.
We do not sell your data to anyone. We do not share data with advertising networks.
Where we store data
All account, business, and quote data is stored on UK-based servers operated by 20i Ltd. Data is encrypted in transit (TLS) and your password is hashed with bcrypt. Stripe operates its own infrastructure for payment data, governed by its own privacy notice.
How long we keep it
We keep your data for as long as your account is active. If you delete your account, we delete your personal data within 90 days, except where we are required to retain it for accounting or legal reasons (e.g. invoice records must be kept for 6 years for HMRC).
Newsletter subscription records are kept for as long as you remain subscribed. If you unsubscribe, we retain a minimal record of your email address and the date you unsubscribed for up to 2 years, so we can honour your withdrawal of consent if the address is ever re-submitted. After 2 years we delete it entirely. You can request earlier deletion by emailing hello@quotebake.co.uk.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct any inaccuracies.
- Request deletion of your data.
- Request a copy of your data in a portable format.
- Object to or restrict certain processing.
- Withdraw your marketing consent at any time.
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we have handled your data.
To exercise any of these rights, email hello@quotebake.co.uk.
Cookies and similar technologies
QuoteBake uses one piece of browser storage: a JSON Web Token kept
in your browser's localStorage to keep you signed in.
It is essential to the operation of the Service and is not used for
tracking. We do not use third-party advertising cookies anywhere.
Our marketing pages use Cloudflare Web Analytics, a privacy-first analytics service that does not set cookies, does not track you across sites, and does not build a personal profile. It counts pageviews and referrers only. Because it uses no cookies, no cookie banner is legally required under UK PECR — but we wanted to name it here anyway.
Marketing emails and PECR
We only send marketing emails to people who have given explicit consent — either by ticking the marketing box at signup, or by subscribing to the newsletter and clicking the confirmation link in the double opt-in email. Every marketing email we send includes a one-click unsubscribe link that immediately stops further emails. You can also unsubscribe at any time by visiting quotebake.co.uk/unsubscribe.html or emailing hello@quotebake.co.uk.
We do not sell, rent or share your email address with any third party. We do not run pixel-tracking or open-tracking on our marketing emails.
Children
The Service is not directed at children under 16 and we do not knowingly collect data from anyone under that age.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. Material changes will be notified by email where appropriate.
Contact
Questions or requests: hello@quotebake.co.uk.