Privacy notice
Last updated 11 November 2026
This notice explains what personal data QuoteAccepted collects, why, how long we keep it, and who processes it. QuoteAccepted is sold by DataSkye Ltd, a company registered in Malta, which is the data controller. Contact us through the contact form on our home page.
What we collect, why, and for how long
| Data | Why, and lawful basis | How long |
|---|---|---|
| Waitlist: your email address, where you came from (for example the Xero forum), and whether you ticked the adviser plan box | To tell you when QuoteAccepted launches. Consent, which you can withdraw at any time. | Until you ask us to remove it, and no longer than 12 months after the delivery date |
| Customers: name, email, business name, billing address, tax ID if given, plan, number of companies, amount and currency paid, and Stripe references | To take payment, deliver the service, refund you if needed, and keep tax records. Contract and legal obligation. | For as long as you're a customer, then as long as tax and company law requires |
| Visits: page, referring site, campaign tags, country, and a visitor code that changes every day | To count visits and sign-ups on this site. Legitimate interest in knowing whether the site works. | 12 months, then deleted automatically |
| Form protection: a one-way code made from your IP address with a value that changes every day | To stop forms being flooded with automated submissions. Legitimate interest in keeping the service available. | 1 day, then deleted automatically |
| Contact form: your name, email and message | To reply to you. Legitimate interest in answering questions. It is emailed to us and not stored in our database. | In our mailbox for as long as needed to deal with your question |
| Connected businesses: the Xero organisation's name and IDs, and Xero access tokens (encrypted with AES-256 before they are stored) | To read quotes and contacts, and update a quote's status and history in Xero. Contract with the business. | While connected. Disconnecting on our connections page deletes them straight away. If the business disconnects in Xero instead, we mark it disconnected and delete them after 30 days. |
| People who receive a quote: name, email, quote number, amount, expiry, which reminders were sent, and whether they accepted or declined | To send follow-ups for the business that quoted them, and record their decision in that business's Xero. The business is the controller of this data, and we process it on its behalf. A decline reason is written to the quote's history in Xero and emailed to the business. We don't keep a copy. | Deleted along with the business's connection, as above |
Cookies and similar technology
This site sets no cookies for visitors, and no tracking or advertising cookies at all, so there is no cookie banner. Visits are counted by our own code without cookies. We don't store your IP address. Pages for individual quotes aren't counted.
- If you choose a currency with the currency switcher, your choice is saved in your browser's local storage so prices stay in that currency. It never leaves your device, and you can clear it in your browser settings.
- Your country, as detected by our host from your connection, is used once per visit to choose a currency. It isn't stored with anything that identifies you.
- Two strictly necessary cookies are used only by the account owner: a sign-in cookie for the owner pages (8 hours), and a one-time security cookie while connecting Xero (10 minutes).
Who processes your data
| Processor | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting this website and its server functions, and detecting a visitor's country | USA, with servers worldwide |
| Supabase Inc. | Database for the waitlist, customers, Xero connections, quotes, reminders, visit counts and form protection | Database in Frankfurt, Germany |
| Stripe Payments Europe Ltd | Payments, receipts and refunds | Ireland, with group companies in the USA |
| Resend (Plus Five Five, Inc.) | Sending reminder emails, and emailing us form messages and alerts | USA, sending from Ireland through Amazon Web Services |
| Xero Limited | Source of quote and contact data, only for businesses that connect their Xero organisation | New Zealand, with servers in the USA |
Where data is transferred to another country, it is protected by the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses. We don't sell personal data or use it for advertising.
Your rights
You can ask for a copy of your data, or ask us to correct it, delete it, or stop using it. Contact us through the contact form on our home page. If you received a quote reminder, the business that sent the quote controls that data, so please contact them first. We'll help them respond. You can also complain to Malta's Information and Data Protection Commissioner (idpc.org.mt), or to the privacy regulator where you live, such as the Information Commissioner's Office in the UK, the Office of the Australian Information Commissioner, or New Zealand's Privacy Commissioner.