This policy explains what personal data DuneQuote (dunequote.com) collects, why, and what choices you have. DuneQuote is run by an individual based in Dubai, United Arab Emirates, who is responsible for your data (“we”). We aim to handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other privacy laws that apply.
1. What we collect
- Account details: your email address, and the name, business name, WhatsApp number, TRN, address, logo and settings you add.
- Documents: the quotes, invoices and credit notes you create, including your clients' names, phone numbers, email addresses, addresses and TRNs that you enter.
- Acceptance records: when a client accepts and signs a quote, we store their typed name, the signature image, the time, their IP address and a summary of their device and browser. This is kept as evidence of acceptance.
- Payment status: your plan and subscription status. Card details are handled by Dodo Payments and never reach us.
- Usage records: our own log of key actions in your account, such as signing in, saving settings, creating or sharing a quote, a client opening or accepting it, and viewing plans, with the time of each, used only to run, support and improve DuneQuote; it holds no IP address and is never used for advertising. When you create an account, we also store how you first found DuneQuote (for example the website that sent you, or a campaign tag in the link such as utm_source or ref).
- Website visit counts: when you open a page on dunequote.com, your browser sends us the page address, the domain of the website that sent you and any campaign tag in the link. We keep only daily totals per page and source, with no IP address, no device or browser details and nothing that identifies you. Your browser also keeps a small note of how you first arrived (in its local storage, not a cookie), which reaches us only if you ask for a sign-in link. If your browser sends a Do Not Track or Global Privacy Control signal, our own counter does not count your visits, your browser does not keep that note, and we do not store how you first found DuneQuote.
- Technical data: basic logs (such as IP address, browser type and errors) needed to run and protect the service. We use one sign-in cookie and no advertising or tracking cookies.
- Reminder stop requests: if someone uses the “Stop these reminders” link in a reminder email, we store their email address, the sender it applies to and the date, so that sender’s reminders are no longer emailed to them. The sender can see that reminders were stopped.
2. Why we use it
We use this data to provide the service you asked for: creating and showing your documents, sending sign-in links, a one-time welcome email when you create an account, and notifications, sending the follow-up and payment reminders you set up, processing upgrades, keeping the service secure and answering your messages. We also use visit counts and sign-up sources to see which pages and channels work, which is our legitimate interest in improving DuneQuote. The legal basis is performing our agreement with you and our legitimate interest in running a secure service. You are responsible for having a valid reason to add your clients' details.
3. We do not sell your data
We do not sell or rent personal data, and we do not use it for advertising.
4. Service providers
We use a small number of trusted providers to run DuneQuote:
- Cloudflare hosts the website and app and stores the database.
- Cloudflare also delivers the PDF tools used when you download a document (cdnjs.cloudflare.com): your browser loads them from Cloudflare, which sees your IP address like any website you visit.
- Cloudflare Web Analytics measures visits to the website and how fast its pages load (pages viewed, referring site, country, browser, operating system and device type), so we can see which pages are useful. It uses no cookies, stores nothing in your browser and does not fingerprint you; Cloudflare says it discards your IP address and does not store it. The Do Not Track and Global Privacy Control signals described in section 1 apply to our own visit counts, not to Cloudflare Web Analytics.
- Resend sends emails (sign-in links, notifications and reminders).
- Dodo Payments processes payments as merchant of record and has its own privacy policy for payment data.
- Google (Gmail / Google Workspace) holds the dqteam@dunequote.com mailbox: messages you send us, our replies, and the business emails described in “Business prospects” below.
These providers may process data on servers outside the UAE. We use them only for the purposes above and rely on their security and data-protection commitments.
5. What your clients see
Anyone who has the link to a document can view it, so share links only with the people they are meant for. Links are long and random, and documents are not listed on search engines.
5a. Business prospects
We sometimes email businesses and business owners in the UAE who may find DuneQuote useful. We find their business contact details on public web pages, such as their own website or a public business or professional directory. We keep their name, business name, trade, city, business email address, the page where we found it, a short note about their business taken from that page, and whether we emailed them and how they replied. We use this only to send a small number of emails about DuneQuote (a first email and at most two follow-ups), which is our legitimate interest in telling relevant businesses about our service.
You can object at any time: reply “unsubscribe” (or anything asking us to stop) or email dqteam@dunequote.com. We then stop emailing you and mark your address as “do not contact”, so we don’t contact you again.
6. How long we keep data
We keep your account and documents while your account is open, so you can see past quotes and invoices. When you close your account in Settings, or ask us to delete it, your documents stop being visible to anyone straight away and we permanently delete your data 30 days later, except where we have to keep something by law (for example, payment records held by Dodo Payments). During those 30 days you can reopen your account. After deletion we keep only a note that an account was deleted and when, with no personal details. Remember that you may have your own legal duty to keep tax records, so download your data (Settings, “Download my data”) before you close your account.
Specific periods:
- Acceptance records (typed name, signature image, time, IP address and device summary): kept for the life of the seller’s account plus 30 days, as evidence of acceptance.
- Reminder stop requests: kept while the sender’s account exists, and deleted with it.
- Sign-in links: expire after 30 minutes.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop or limit certain uses of it. You can download a copy of your data and close your account yourself in Settings, and change most details there too. For anything else, email dqteam@dunequote.com. We will reply within 30 days. If your client wants their data removed, they can contact you or us.
8. Security
We use encrypted connections (HTTPS), sign-in links that expire, and access controls with our providers. No online service is 100% secure, so please tell us straight away if you notice anything suspicious.
9. Changes
If we make important changes to this policy, we will tell you by email or in the app.
10. Contact
Privacy questions or requests: dqteam@dunequote.com.