Privacy notice

Effective 17 September 2026

This notice explains what information Quoveta uses to provide the service and the choices available to you.

Who this notice covers

Quoveta is operated by Arbah Works, LLC, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. Quoveta provides a service for creating, sending, and following up on business quotes. Questions can be sent to the contact address below.

Information we handle

We handle account and profile details, business details, customer contact details, quote content, line items, terms, generated documents, delivery activity, customer decisions and questions, subscription status, and support requests. We also handle limited authentication, security, and operational logs needed to run and protect the service.

How we use information

We use this information to authenticate users, operate workspaces, create and deliver quotes, generate PDFs, schedule requested follow-ups, record customer responses, provide billing access, prevent abuse, troubleshoot failures, and improve service reliability.

Service providers

Quoveta uses Vercel for application hosting, Supabase for authentication, database, and file storage, Resend for email delivery, Stripe for subscription billing, PostHog for optional product analytics and sanitized error reporting, Google Ads for optional campaign conversion measurement, and Crisp for Production support conversations explicitly opened by public visitors or authenticated account owners. These providers process information only for the services they supply to Quoveta and under their own applicable terms.

Analytics, campaign measurement and error reporting

Product analytics and Google Ads conversion measurement share one optional control, while session replay has a separate optional control in Privacy choices. With consent, PostHog measures normalized pages, referring domains, campaign labels, device categories and feature use. Google Ads receives the normalized page, bounded Google click identifiers and fixed conversion events when a visitor starts the demo, creates a workspace or creates a quote. Google also receives ordinary request metadata, such as the IP address and browser information, when its tag loads. We do not send Google names, email addresses, account or customer details, quote content or values, or enhanced-conversion data, and advertising personalization stays off. For consenting account owners, an opaque workspace identifier connects their visit to PostHog product events. Session replay reconstructs masked interactions on our marketing website and signed-in app. Inputs and private account, customer and quote content are hidden, while static interface elements remain visible. Replay does not run on authentication, payment or public quote pages and does not record your desktop, camera or microphone. PostHog processes its data in its EU region. Sanitized operational errors are reported separately to investigate failures.

Cookies and local storage

Quoveta uses necessary cookies and local storage for sign-in, security, routing, preferences and support-session separation. A necessary cookie remembers your privacy choices for 180 days, and local storage shares changes between tabs. After optional consent, browser storage holds PostHog analytics identifiers and sanitized attribution. Google Ads may set first-party cookies beginning with _gcl_ and process gclid, gbraid, wbraid, gad_source and gad_campaignid parameters to attribute conversions. Quoveta and PostHog do not store these Google ad-click identifiers. Withdrawing analytics and campaign-measurement consent blocks further Google tag use and attempts to remove its first-party _gcl_ cookies. Choices can be changed in the footer or account settings. Account analytics preferences apply across devices, while replay consent applies to this browser. Production support chat is loaded only when a public visitor or authenticated account owner opens it. For a public visitor, Quoveta sends Crisp the public workspace ID, interface language, a random identifier kept for that browser tab, and the production site origin needed for the workspace domain lock. For an account owner, the identifier is account-specific and Quoveta also sends the current account email through the chat frame URL when support is opened, so the owner does not need to enter it again. Public chat does not prefill an email. Quoveta does not send Crisp names, business, customer or quote details, or the private parent-page path, query, or fragment, and it does not merge public and authenticated support sessions.

Information is shared with the service providers listed above when needed to provide Quoveta. Quote recipients receive the customer-facing content deliberately sent to them. Quoveta does not sell personal information. Information may also be disclosed when required by law or to protect the service and its users.

Retention

Information is kept while it is needed to operate the account, preserve quote and delivery records, protect the service, and meet applicable legal obligations.

Your choices and rights

You can update available account and business details in Quoveta and turn optional product analytics, campaign measurement and session replay off. You may contact us to ask about access, correction, deletion, restriction, objection, portability, or another right available under applicable law. A request may require identity verification, and some records may need to be retained where the law requires it.

Security

Quoveta uses access controls that separate each business's data, private file storage, signed provider requests, and restricted public quote links. No online service can promise absolute security, so please protect your sign-in details and report suspected misuse.

Changes to this notice

This notice may be updated when the service or legal requirements change. The effective date above will be updated when a revised notice is published.

Privacy questions

Contact Quoveta about this notice or a privacy request.

support@quoveta.com