Effective date: October 2, 2026
Version: 2026-10-02
1. Introduction and Overview
1.1 Who We Are
QuoteWillow LLC, a Florida limited liability company ("QuoteWillow," the "Company," "we," "us," or "our"), operates the website at https://www.quotewillow.com (the "Site"), the QuoteWillow builder app, and the QuoteWillow estimator widget (the "Estimator"), together the "Services." QuoteWillow is software for residential contractors ("Builders"). A Builder embeds the Estimator on its own website, where homeowners ("Homeowners") can describe a project, upload photos and PDF plans, and receive a preliminary estimate calculated from the Builder's own price book. The Builder then receives the request as a lead in the builder app.
This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and protect personal information in connection with the Services, and explains the choices and rights available to you. Capitalized terms not defined in this Policy have the meanings given in our Terms of Service at https://www.quotewillow.com/terms/ (the "Terms").
1.2 Scope of This Policy
This Policy applies to personal information processed in connection with:
- the Site;
- the builder app, including account registration, team invitations, price book management, lead review, and billing;
- the Estimator, wherever a Builder has embedded it; and
- emails you send to us at hello@quotewillow.com.
This Policy does not govern the privacy practices of Builders, of the websites on which Builders embed the Estimator, or of any third-party website or service linked from the Services.
1.3 Two Audiences and Our Two Roles
We handle personal information in two different roles:
- Builders. For information about Builders and their team members (account, billing, acceptance, and support information), QuoteWillow decides how the information is used and is responsible for it. Section 2 describes this information.
- Homeowners. For information that Homeowners submit through a Builder's Estimator, the Builder decides how the information is used and is responsible for it, and QuoteWillow processes it on the Builder's behalf as its service provider. Section 3 describes this information.
2. Information We Collect About Builders
2.1 Account and Registration Information
When a Builder creates an account, we collect the company name, the email address and password used to sign in, and the Builder's service ZIP code (the ZIP code of the area where the Builder primarily works), from which we derive the corresponding city. Passwords are used only to authenticate sign-in.
2.2 Team Members
A Builder may invite team members to its account. We collect the email address to which each invitation is sent and, when the invitation is accepted, the information the team member provides to create a login, together with the team member's acceptance record described in Section 2.6.
2.3 Price Book, Configuration, and Leads
We store the price book, estimator settings, and other business information that a Builder enters into the builder app, and the leads that the Estimator delivers to the Builder's account.
2.4 Connected AI Keys
A Builder may connect its own key for an AI service provider so that the Estimator can interpret Homeowner submissions. We store connected keys in encrypted form and use them only to process submissions for the Builder that connected them.
2.5 Billing Information
Subscriptions are billed through Stripe, Inc. ("Stripe"). When a Builder starts a free trial or subscription, the Builder enters payment details directly into Stripe Checkout. We do not collect or store payment card numbers or security codes. We receive from Stripe the information needed to administer the subscription, such as customer and subscription identifiers, subscription and payment status, and billing records.
2.6 Legal Acceptance Records
When a Builder or team member accepts the Terms and this Policy, at sign-up, through an invitation, or when we ask for re-acceptance of a revised version, we record: the document and version accepted; the date and time of acceptance; the email address of the accepting user and the account it belongs to; whether the acceptance occurred at sign-up, through an invitation, or as a re-acceptance; the IP address from which the acceptance was submitted; and the browser user agent (a string identifying the browser and operating system). We keep these records as evidence of acceptance.
2.7 Communications with Us
If you email us at hello@quotewillow.com, we receive your email address and the content of your message, including any attachments, and we keep that correspondence to respond to you and to maintain a record of requests such as cancellations and privacy requests.
2.8 Email Records
When we send an email, we keep the recipient address, the type of email, and when it was sent. We do not keep the one-time links contained in password reset or invitation emails after they are sent.
3. Homeowners Using a Builder's Estimator
This section is for Homeowners who use the Estimator on a Builder's website. The Estimator displays a notice before it sends your project for an estimate, explaining that your project details, files, and any contact details you share go to the Builder and are processed by QuoteWillow, including by AI service providers, to prepare your estimate.
3.1 What the Estimator Collects
When you use the Estimator, we collect, on the Builder's behalf:
- your name;
- your email address;
- your telephone number, if you choose to provide it;
- the description of your project;
- photos and PDF plans that you upload; and
- the address of the web page where the Estimator ran (which tells the Builder which of its pages you used).
We also store the preliminary estimate and any AI interpretation prepared from your submission, as part of the lead delivered to the Builder.
3.2 Photos and PDF Plans
Photos you upload are re-encoded to remove embedded metadata, such as EXIF data, which can include the location where a photo was taken and details about the camera or phone. PDF plans may contain other information, such as names or addresses in a title block. Please do not include information in your description, photos, or plans that you do not want the Builder to receive.
3.3 The Builder Is in Charge of Your Information
The Builder whose website you used decides how your information is used, and the Builder's own privacy notice governs its use of your information. QuoteWillow processes your information only for the Builder and only to provide the Services to the Builder: to receive and store your submission, interpret it, calculate a preliminary estimate from the Builder's price book, make the request available to the Builder as a lead, secure the Services, and comply with law. We do not use your information for our own marketing, and we do not sell or share it.
3.4 How Your Submission Is Processed, Including by AI Providers
Your preliminary estimate is calculated automatically from the Builder's own price book. If the Builder has connected its own AI service provider key, your project description, photos, and PDF plans are sent to that AI service provider to interpret the project (see Section 6). If the Builder has not connected a key, your submission is not sent to an AI service provider. Estimates are preliminary and are not bids, quotes, or offers; any price or commitment comes from the Builder.
3.5 Your Requests
Because the Builder is responsible for your information, please send requests to access, correct, or delete it to the Builder whose website you used. If you contact us instead at hello@quotewillow.com with the subject line "Privacy Rights Request," we will direct your request to that Builder and help the Builder respond. Please tell us the website where you used the Estimator so we can identify the Builder.
3.6 Cookies in the Estimator
The Estimator does not set cookies or store information in your browser.
4. Information Collected Automatically
4.1 IP Addresses
When your browser connects to the Services, our systems receive your IP address. We use IP addresses briefly to apply rate limits that protect the Services from automated abuse. IP addresses also appear in the server logs described in Section 4.2, and we record the IP address with each legal acceptance as described in Section 2.6. We do not store IP addresses with Homeowner leads.
4.2 Server Logs
Like most online services, our hosting providers record server logs of requests to the Services, which may include the IP address, the date and time, the page or address requested, the response, and the browser user agent. We use these logs to operate, secure, and troubleshoot the Services and keep them for up to six (6) months, after which they are deleted.
4.3 No Analytics or Advertising Tracking
We do not use analytics services, advertising pixels, session-replay tools, or similar tracking technologies in the Services.
5. How We Use Information
5.1 To Provide and Operate the Services
We use personal information to create and administer Builder accounts and team access, operate the Estimator, calculate preliminary estimates, interpret submissions (where a Builder has connected an AI key), deliver leads to Builders, and provide support.
5.2 Billing
We use billing information to administer free trials and subscriptions through Stripe.
5.3 Security and Abuse Prevention
We use IP addresses, server logs, and account information to detect, investigate, and prevent unauthorized access, abuse, fraud, and violations of our Terms, including by applying rate limits.
5.4 Communicating with You
We use contact information to respond to emails you send us and to send Builders and their team members transactional emails about their accounts, such as password reset links, team invitations, confirmations that they accepted the Terms and this Policy, and notices about prices and changes to the Terms, this Policy, or the Services. Billing emails, such as trial reminders and receipts, are sent by Stripe. We do not send marketing emails, and the Services do not send email or text messages to Homeowners.
5.5 Evidence of Acceptance
We use legal acceptance records to show which version of the Terms and this Policy each user accepted and when.
5.6 Legal Compliance
We use personal information as necessary to comply with applicable laws, to respond to valid legal process, to enforce our agreements, and to protect the rights, property, and safety of QuoteWillow, Builders, Homeowners, and others.
5.7 Automated Estimates
Estimates are generated automatically, but they are preliminary and non-binding. The Builder decides whether to offer any work and on what terms. We do not use personal information to make decisions that produce legal or similarly significant effects on any individual.
6. AI Service Providers
6.1 When AI Is Used
AI-assisted interpretation is used only when a Builder has connected its own AI service provider key. The AI service provider currently supported is OpenCode (opencode.ai), which routes requests to OpenAI GPT and Google Gemini models.
6.2 What Is Sent
When AI-assisted interpretation is used, we send the Homeowner's project description, photos, and PDF plans, together with the instructions needed to interpret the project. We do not send Builder passwords or payment information to AI service providers.
6.3 AI Provider Practices
Each AI service provider operates under its own terms and privacy policy, and requests sent through a Builder's connected key are also subject to the terms of the Builder's own account with that provider. Provider terms, model routing, and data handling practices can change without notice. This Policy describes how we send information to AI service providers; it does not guarantee any provider's independent practices.
7. How We Share Information
7.1 Service Providers
We share personal information with the following service providers, which process it on our behalf to operate the Services. The authoritative current list is Exhibit A to the Terms at https://www.quotewillow.com/terms/#service-providers.
| Provider | Purpose | Information Processed |
|---|---|---|
| Google Cloud (Cloud Run, Secret Manager, Cloud Build) | API hosting | Information handled by the QuoteWillow API, including account, billing status, acceptance, and Homeowner submission data; server logs |
| Cloudflare | Web app delivery and API proxy | IP addresses and request data passing between your browser and the Services |
| Neon | Postgres database and file storage | Account records, price books, leads, uploaded photos and PDFs, and acceptance records |
| Upstash | Rate limiting | IP addresses and request counts used to apply rate limits |
| Stripe | Billing | Payment and billing details that Builders enter at Stripe Checkout; subscription status |
| Resend | Transactional email delivery | Recipient email addresses, the company name shown in the email, and email content, including one-time links |
| OpenCode (opencode.ai) | AI interpretation of descriptions, photos and PDFs. It routes to OpenAI GPT and Google Gemini models and is used only when the builder connects its own key | Homeowner project descriptions, photos, and PDF plans |
7.2 Builders
Information that a Homeowner submits through a Builder's Estimator is made available to that Builder as a lead. Information about one Builder's account is visible to that Builder's team members.
7.3 Legal Disclosures
We may disclose personal information to courts, regulators, law enforcement agencies, or other government authorities when required by law or legal process, or when disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of QuoteWillow; (c) prevent or investigate possible wrongdoing in connection with the Services; or (d) protect the personal safety of users of the Services or the public.
7.4 Business Transfers
If QuoteWillow is involved in a merger, acquisition, reorganization, or sale of all or substantially all of its assets, personal information may be transferred to the successor entity, subject to this Policy and, for Homeowner information, to the successor's obligations to the Builder.
7.5 With Consent
We may share personal information in other ways when the person it concerns, or for Homeowner information the Builder, directs us to do so.
7.6 No Sale or Sharing of Personal Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under U.S. state privacy laws. We have not done so in the preceding twelve (12) months.
8. Cookies and Similar Technologies
8.1 What We Use
The builder app uses only the following first-party cookies and browser storage items. All are needed for the builder app to work or to remember a display preference. None is used for analytics or advertising.
| Name | Type | Duration | Purpose |
|---|---|---|---|
| quotewillow_session | Cookie | 7 days | Keeps you signed in to the builder app |
| quotewillow_csrf | Cookie | 7 days | Request protection: helps confirm that requests to change your account come from the builder app |
| quotewillow_csrf_token | Session storage | Until the browser tab is closed | Request protection, used together with the quotewillow_csrf cookie |
| quotewillow_billing_builder_id | Session storage | Until the browser tab is closed | Checkout hand-off: connects your return from Stripe Checkout to your account |
| quotewillow-theme | Local storage | Until you clear it | Remembers your light or dark theme preference |
8.2 The Estimator Sets None
The Estimator, which runs on Builders' websites, does not set cookies or use browser storage.
8.3 No Analytics or Advertising Cookies
We do not use analytics cookies, advertising cookies, or third-party tracking cookies.
8.4 Stripe Checkout
When a Builder goes to Stripe Checkout to start a free trial or subscription, Stripe may set its own cookies on its own domain, for purposes such as fraud prevention, under Stripe's privacy policy at https://stripe.com/privacy.
8.5 Global Privacy Control and Do Not Track
We honor Global Privacy Control ("GPC") signals as a request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, honoring a GPC signal does not change how the Services work. We do not respond differently to the legacy "Do Not Track" browser setting, because there is no consensus standard for it, and because we do not track you across websites.
8.6 Managing Cookies
You can block or delete cookies and browser storage through your browser settings. If you block the cookies listed above, you will not be able to sign in to the builder app.
9. Data Retention
9.1 Retention Periods
We keep personal information for as long as necessary for the purposes described in this Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements. The following schedule applies:
| Data Category | Retention Period | Basis |
|---|---|---|
| Builder account data (company, users, price book, settings) | Life of the account, plus up to 30 days after termination to request export or deletion; otherwise deleted within 90 days after termination | Contract |
| Billing records | 7 years | Legal obligation (tax and accounting) |
| Legal acceptance records | 10 years after acceptance | Legal obligation; evidence of agreement |
| Leads and uploads (Homeowner submissions, photos, PDFs, estimates) | Life of the Builder account, unless the Builder requests deletion sooner; then handled as Builder account data above | Builder's instructions |
| Server logs (IP address, request, user agent) | Up to 6 months | Security and troubleshooting |
| Email records (routine) | 1 year after sending | Security and troubleshooting |
| Email records (notices of revised terms or prices) | 10 years after sending | Evidence of notice |
| Backups | Up to 90 days | Business continuity |
Acceptance records keep a copy of the accepting user's email address and account identifier, so they remain available for their retention period even after an account is deleted.
9.2 Criteria for Determining Retention
In determining how long to keep information not listed above (such as correspondence), we consider: (a) the nature and sensitivity of the information; (b) the purposes for which it was collected and whether they have been fulfilled; (c) applicable legal, regulatory, or contractual requirements; (d) whether it is needed to establish, exercise, or defend legal claims; and (e) the risk of harm from unauthorized use or disclosure.
9.3 Deletion Requests
When we receive a verified deletion request from a Builder, or an instruction from a Builder to delete Homeowner information, we will delete the information within a reasonable time, subject to the retention periods above and any legal hold described in Section 9.5.
9.4 Backup Data
Deleted information may persist in backups for up to ninety (90) days, after which it is overwritten in the ordinary course of backup rotation. Backups are not used except to restore the Services.
9.5 Legal Holds
We may keep information longer where required to comply with a legal obligation, court order, or regulatory requirement, or for an active dispute, litigation, or investigation, and will then dispose of it in accordance with this schedule.
10. Data Security
10.1 Security Measures
We use administrative, technical, and physical safeguards designed to protect personal information, including: HTTPS (TLS) encryption for data in transit; encryption at rest provided by our hosting and database providers; encrypted storage of connected AI keys; application secrets kept in Google Cloud Secret Manager; password-protected accounts with session and request-protection controls; rate limiting; removal of embedded metadata from uploaded photos; and limiting each Builder's access to its own account's data.
10.2 Security Incidents
If a security incident involves unauthorized access to or disclosure of personal information, we will investigate it and notify affected Builders, individuals, and regulators as required by applicable law, including applicable U.S. state data breach notification laws such as Florida's. For Homeowner information, we will notify the Builder, which is responsible for any notice to Homeowners, and we will assist the Builder as described in Exhibit B to the Terms.
10.3 No Absolute Security
No information security system is impenetrable, and no method of transmission or storage is completely secure. We cannot guarantee that unauthorized parties will never defeat our safeguards. Please use a strong, unique password for your account and keep your sign-in details and any AI provider keys secure.
11. Your U.S. State Privacy Rights
11.1 Which Laws Apply
Depending on where you live, you may have rights under state privacy laws, including those of California, Virginia, Colorado, Connecticut, Utah, Texas, and Florida, where those laws apply to QuoteWillow or to the Builder that holds your information. These laws apply to businesses that meet certain thresholds, and not every law applies to every business. We honor the requests described below from Builders and their team members regardless of where they live, to the extent we reasonably can.
11.2 Your Rights
Subject to applicable law, you may have the right to:
- Know and access the categories and specific pieces of personal information we hold about you and how we use and disclose it;
- Correct inaccurate personal information;
- Delete personal information, subject to legal exceptions and the retention periods in Section 9;
- Portability, to receive your personal information in a portable, commonly used format;
- Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not engage in any of these);
- Limit the use of sensitive personal information (we use account sign-in credentials only to authenticate you, which does not give rise to this right); and
- Non-discrimination, so that you are not treated differently for exercising your rights.
11.3 Homeowner Requests
For information submitted through a Builder's Estimator, the Builder is responsible for responding to your request. As described in Section 3.5, we will direct your request to the Builder and help the Builder respond.
11.4 How to Submit a Request
Email hello@quotewillow.com with the subject line "Privacy Rights Request" and tell us what you are asking for. Please include enough information for us to identify you, such as the email address on your account. Homeowners should also tell us the website where they used the Estimator.
11.5 Verification and Authorized Agents
To protect your information, we will verify your request, generally by confirming it comes from, or matching it to, the email address associated with the information. You may use an authorized agent to submit a request on your behalf where the law allows; we may require written proof of the agent's authority and may ask you to verify your identity directly.
11.6 Response Timing
We will acknowledge your request within ten (10) business days and respond within forty-five (45) calendar days of receiving it. Where reasonably necessary, we may extend that period by an additional forty-five (45) calendar days, in which case we will tell you within the first forty-five (45) days and explain why.
11.7 Appeals
If we decline to act on your request, we will explain why. Where your state's law provides a right to appeal, you may appeal by replying to our decision or by emailing hello@quotewillow.com with the subject line "Privacy Rights Appeal." We will respond to an appeal within the time required by your state's law and, if we deny it, tell you how to contact your state attorney general.
11.8 California Disclosures
The table below describes the categories of personal information, as defined in the California Consumer Privacy Act, that we collected in the preceding twelve (12) months, whether we sold or shared each category, and why we collected it. For Homeowner information, we collect it on behalf of the Builder as its service provider. We disclose each category for a business purpose only to the service providers in Section 7.1 and, for Homeowner information, to the Builder.
| Category and Examples | Collected | Sold | Shared | Purposes |
|---|---|---|---|---|
| Identifiers: name, email address, telephone number (Homeowners, if provided), IP address, account identifiers | Yes | No | No | Accounts, operating the Estimator, delivering leads, security, acceptance records, sending account emails |
| Customer records: company name, billing records from Stripe | Yes | No | No | Accounts and billing |
| Commercial information: subscription and trial status, payment history | Yes | No | No | Billing and account administration |
| Internet or network activity: server logs, browser user agent, the web page address where the Estimator ran | Yes | No | No | Security, troubleshooting, acceptance records, telling the Builder which page was used |
| Audio, electronic, or visual information: photos and PDF plans uploaded through the Estimator | Yes | No | No | Interpreting projects and preparing preliminary estimates for the Builder |
| Professional or employment information: the Builder's business and service ZIP code | Yes | No | No | Accounts and configuring the Services |
| Sensitive personal information: account email and password used to sign in | Yes | No | No | Authentication only |
We do not knowingly collect precise geolocation, financial account numbers, or other sensitive personal information, and we remove embedded location metadata from uploaded photos. We collect this information from Builders and their team members, from Homeowners through the Estimator, from your browser when it connects to the Services, and from Stripe.
11.9 Non-Discrimination
We will not deny you service, charge you a different price, or provide a different quality of service because you exercised your privacy rights.
12. Location of Processing; Visitors Outside the United States
QuoteWillow is based in the United States, and the Services are intended for Builders located in the United States. Personal information is processed in the United States and in other locations where our service providers operate. The Services are not directed to people in the European Union, the European Economic Area, the United Kingdom, or Switzerland. If you use the Services from outside the United States, you do so on your own initiative, and your information will be processed in the United States, whose data protection laws may differ from those of your country.
13. Children's Privacy
The Services are not directed to anyone under the age of eighteen (18), and we do not knowingly collect personal information from anyone under 18. Builder accounts are available only to people 18 or older, and the Estimator is intended for adult Homeowners. If we learn that we have collected personal information from someone under 18, we will delete it or, for Homeowner information, ask the Builder to delete it. If you believe we may have such information, please email hello@quotewillow.com.
14. Third-Party Websites and Services
The Services link to and rely on third-party websites and services, including Builders' own websites, Stripe Checkout, and AI service providers that Builders connect. We do not control and are not responsible for their privacy practices, and we encourage you to read their privacy policies. The Site does not offer social login or social media sharing integrations.
15. Changes to This Policy
15.1 Revised Versions
We may update this Policy to reflect changes in law, technology, our practices, or the Services. Each revised version will be posted at https://www.quotewillow.com/privacy/ with a new version identifier and effective date.
15.2 Material Changes
If we make a material change, such as a change to the categories of personal information we collect, the purposes for which we use it, or the types of service providers we share it with, we will ask Builders and their team members to review and accept the revised Policy in the builder app before continuing to use their accounts. For Homeowner information, a revised Policy applies to information collected after it is posted, and we will not use previously collected Homeowner information in a materially different way without the Builder's instruction.
15.3 Questions About Changes
If you have questions about a change to this Policy, please email hello@quotewillow.com.
16. Contact Us
16.1 How to Contact Us
Questions, complaints, and requests about this Policy or our privacy practices should be sent to:
QuoteWillow LLC
Email: hello@quotewillow.com
Website: https://www.quotewillow.com
For privacy rights requests, please use the subject line "Privacy Rights Request." We will try to respond to all inquiries promptly.
16.2 Relationship to the Terms
For Builders, this Policy is incorporated into the Terms. Where QuoteWillow processes Homeowner information on a Builder's behalf, Exhibit B (Data Processing Addendum) to the Terms governs that processing.