Privacy Policy

This page explains what data we collect, why, who we share it with, and how you can control it. We try to keep it plain.

• If you are a visitor browsing picquote.co.uk or a subscriber to the PicQuote service, we (PicQuote) are the data controller for the information described in the section "Marketing site and subscribers" below.
• If you are an end-consumer uploading a photo of your property on a subscriber's branded subdomain (for example yourbiz.picquote.co.uk), the subscriber is the data controller for your enquiry, and PicQuote acts as their data processor. See the section "Subscriber subdomains" below.

This website is operated by PicQuote Ltd (in formation) [CONFIRM — replace with final registered company name once incorporated], a company to be registered in England and Wales (company number [CONFIRM]), registered office at [CONFIRM — registered office address].

We are registered with the Information Commissioner's Office as a data controller under registration number [CONFIRM — ZA number once ICO registration completes].

For any privacy-related question or to exercise your rights below, contact us at hello@picquote.co.uk.

When you browse picquote.co.uk, try the free demo, sign up for a subscription, or email us, we may collect the following:

• Account & subscription data: name, business name, contact email, phone number, billing address, the subscription tier you choose, the subdomain slug you pick, your logo and any branding you upload.
• Billing data: handled by Stripe Payments Europe Limited. We do not see or store your full card number; we receive only the last four digits, card brand, and the Stripe customer ID so we can manage your subscription.
• Demo data: when you click "Try it free" on the homepage we generate an anonymous demo token tied to your IP address. We use this only to enforce the 3-generation limit and to prevent abuse. Demo tokens and their associated photos are deleted within 30 days.
• Support data: any email you send us, including attachments, kept while reasonably needed to support you.
• Technical data: IP address, browser user-agent, referring URL, basic page-view analytics (Vercel Analytics, which does not use cookies and does not track you across sites). Server logs are retained for 30 days for security and debugging.

We rely on the following lawful bases under UK GDPR Article 6:

• Contract (Art. 6(1)(b)) for everything needed to provide the SaaS service you subscribed to.
• Legitimate interests (Art. 6(1)(f)) for security logging, abuse prevention on the free demo, and operating analytics.
• Legal obligation (Art. 6(1)(c)) for keeping billing records required by UK tax law.
• Consent (Art. 6(1)(a)) for any marketing email you opt in to. You can withdraw consent at any time using the unsubscribe link on every email.

A subscriber to PicQuote may use the service to operate a branded subdomain (for example acme.picquote.co.uk) on which their end-customers upload photos of driveways, roofs or patios to see a computer-generated mockup and request a quote.

On those subdomains the subscriber is the data controller for the end-customer's personal data (name, phone, postcode, photos). PicQuote acts as a data processor on the subscriber's behalf, under a written Data Processing Agreement that forms part of our subscription terms.

On the subscriber's instructions we will:

• Transmit each uploaded photo to Google's Gemini image model to produce the after-mockup. Photos pass through Google's API and are subject to Google's data-handling commitments for Gemini API customers (no training on customer data).
• Email the resulting lead (name, phone, postcode, original photo, generated mockup) to the subscriber's configured email address via Resend.
• Store the lead in the subscriber's record on Airtable (private to that subscriber).
• Delete photos and mockups from our systems within 30 days of upload. Lead contact details persist until the subscriber requests deletion.

If you are an end-consumer who submitted a photo on a subscriber subdomain and you want your data deleted or exported, please contact the subscriber directly (their contact details appear on their site). If you can't reach them, email us at hello@picquote.co.uk and we will pass the request on within 5 working days.

We use a small number of carefully chosen sub-processors, each bound by industry-standard data processing terms:

• Vercel Inc. (USA, with EU/UK data residency available) — hosting and edge delivery.
• Stripe Payments Europe Ltd (Ireland) — billing and subscription management.
• Resend (Plus Five Five Inc.) (USA) — transactional email delivery.
• Google LLC (USA) — Gemini API image generation. Inputs are not used to train Google models when accessed via the paid Gemini API.
• Formagrid Inc. (Airtable) (USA) — encrypted storage of subscriber records and lead data.

We do not sell your data, share it with advertising networks, or use it for any purpose beyond what we describe here.

Transfers outside the UK rely on Standard Contractual Clauses (and, for US providers, the UK extension to the EU-US Data Privacy Framework where the vendor is certified).

• Photos and generated mockups (whether from the free demo or a subscriber subdomain): deleted within 30 days.
• Lead contact details on subscriber subdomains: stored in the subscriber's Airtable record and retained until the subscriber requests deletion or closes their account.
• Subscriber account and billing data: kept while your subscription is active and for 7 years after cancellation to comply with UK tax record-keeping rules, then deleted.
• Server logs and analytics: 30 days rolling.
• Support emails: kept while reasonably needed, typically up to 24 months.

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you (subject access).
• Ask us to correct inaccurate data.
• Ask us to delete your data (where we are not legally required to retain it).
• Ask us to restrict or stop certain uses of your data.
• Object to processing carried out on the basis of legitimate interests.
• Withdraw consent for anything you previously consented to.
• Receive your data in a portable format and ask us to transmit it to another provider where technically feasible.
• Complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We'd appreciate the chance to put things right first, but you do not need to contact us before going to the ICO.

To exercise any of these rights, email hello@picquote.co.uk. We aim to respond within one calendar month, and will tell you if we need longer (UK GDPR permits up to two further months for complex requests).

We use a small number of strictly necessary cookies to keep you signed in, to remember your preferences (such as the monthly/annual toggle on the pricing page), and to protect against abuse of the free demo.

We use Vercel Analytics for aggregate page-view analytics. Vercel Analytics is first-party, does not use cookies, and does not track you across other sites. No advertising or retargeting pixels are used at this time.

[CONFIRM — if you later add Facebook Pixel, Google Ads conversion tracking, or any other advertising tracker, this section must be updated and a cookie consent banner added before that tracker fires.]

All connections to picquote.co.uk and our subdomains use HTTPS with TLS 1.2 or higher. Subscriber API keys and Stripe secrets are stored as encrypted environment variables on Vercel. Lead and subscriber data lives in Airtable behind an access-controlled personal access token. No system is ever 100% secure, but we follow industry-standard practice and review our setup regularly.

PicQuote is sold to UK businesses and is not intended for users under 18. We do not knowingly collect personal data from children.

If we make material changes we will update the "last updated" date at the top of this page, and for subscribers we will email you in advance of any change that affects how we process your data.