Privacy Policy

Information we collect

• Account details you provide: your name, email address, company name, and phone number.
• Business data you enter: leads, quote requests, agent/carrier contacts, rates, and shipments.
• Email connection: if you connect Gmail or Outlook, we store an access token that lets LQT send email on your behalf.

How we use Google and Microsoft account data

When you connect your Gmail or Outlook account, LQT requests send-only permission (Google's gmail.send scope / Microsoft's Mail.Send). We use it for one purpose: to send the quote-request, reminder, and quote emails that you create in LQT, from your own address, so your agents see a message from you rather than from a stranger.

LQT never reads, imports, or stores the contents of your mailbox. We do not request permission to read your email, and we cannot see your inbox. The access token is stored securely and used only to send the messages you initiate.

LQT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or share it with third parties.

Agent email replies

Emails LQT sends on your behalf carry a reply-to address that belongs to LQT (your quote number at our reply domain, e.g. EFS-PK-2600031@reply.leadquotetrack.com), so an agent's reply is delivered to us rather than to your mailbox. We process that one reply with an AI service to extract the rate details into your account, and we forward a copy to your own inbox so you can read it and answer the agent directly. Only replies to messages you sent through LQT are processed. Never your wider mailbox, which we cannot reach.

How data is stored and shared

• Your data is stored on Supabase (Postgres) with per-company access controls. Users in one company cannot see another company's data.
• We use trusted processors to run the service: Supabase (database, authentication), Vercel (hosting), Cloudflare (email routing), Resend (sign-in, password-reset and notification emails), Anthropic's Claude API (reading supplier replies), Paddle (payments, subscription billing and tax, as our merchant of record), PostHog (product usage statistics, EU region), and Sentry (error monitoring, EU region, it receives crash reports, not your business data). They process data only to provide the service.
• We do not sell your data.

Usage statistics

We collect statistics about how LQT is used, so we can see which features earn their place. This is processed by PostHog in the EU. These statistics are pseudonymous rather than anonymous: they carry your account id and company id, so they can be traced back to you and are treated as personal data. The rights below apply to them.

• What we collect: which screens are opened, and that an action happened (a quote request went out, a lead was created) together with your account id and your company id.
• What we never collect: client names, lanes, prices, email addresses, email content, uploaded files, or anything you type. We do not record your screen or your session.
• No cookies. Usage statistics set no cookie and store no identifier on your device, which is why LQT shows you no cookie banner.
• Turning it off: Settings → Account → Usage statistics. We also honour your browser’s “Do Not Track” setting automatically.

How we protect your data (security measures)

We apply the following technical and organisational safeguards to all data in LQT, including sensitive data obtained through Google APIs (OAuth tokens for the gmail.send scope and the connected account's email address):

• Encryption in transit: every connection to LQT (web app, API, OAuth callbacks, and outbound calls to Google and Microsoft) uses HTTPS with TLS 1.2 or higher. There is no unencrypted path into or out of the service.
• Encryption at rest: all application data is held in Supabase's managed Postgres, which is encrypted at rest with AES-256 on AWS-backed infrastructure.
• Credential isolation: Google and Microsoft OAuth access and refresh tokens are never written to an ordinary database column. They are stored as encrypted secrets in Supabase Vault (authenticated encryption, keys held outside the database tables) and are decrypted only in memory, inside a server-side function, at the moment an email you initiated is sent.
• Access control: every table holding customer data is protected by Postgres row-level security tied to your user and company, enforced at the database layer rather than in application code alone. Tokens are readable only by your own account's send operations.
• Least privilege on scopes: LQT requests the narrowest scope that performs the function (gmail.send only). We do not request gmail.readonly, gmail.modify, or any other scope that would allow reading, searching, or importing your mailbox, so mailbox contents never enter our systems in the first place.
• Restricted internal access: administrative access to production systems is limited to authorised personnel, protected by individual accounts with multi-factor authentication, and used only for operating and supporting the service.
• Secrets management: API keys and client secrets are held in the hosting platform's encrypted environment-variable stores, never in source code or the client-side application, and are rotated if exposure is suspected.
• Revocation and deletion: disconnecting your mailbox in Settings deletes the stored tokens and revokes LQT's permission immediately. Deleting your account permanently removes your data, including any stored tokens.
• Incident response: if we become aware of a breach affecting your personal data or your Google account data, we investigate immediately, revoke affected credentials, and notify affected users and the relevant authorities without undue delay and within 72 hours where the law requires it. Security issues can be reported to the address in the Contact section below.

A fuller technical description, written for IT and security reviewers, is on our Security page.

Data retention

We keep your data only while your account is active and for as long as needed to provide the service. OAuth tokens are retained only while your mailbox is connected and are deleted as soon as you disconnect it or the connection is revoked. When you delete your account, your data is removed from our live systems immediately; encrypted infrastructure backups are cycled out within 30 days.

Attachments (invoices, bills of lading, and similar uploaded documents) may be retained for up to five (5) years from the date of upload. After that period we may delete the file itself; the related shipment, quote, or lead record and its statistics remain in your account indefinitely. We recommend keeping your own copies in your accounting system for any longer-term record-keeping requirement.

AI and machine-learning models

We do not use data obtained through Google Workspace APIs to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models. We do not transfer Google Workspace API data to any third-party AI or ML model, tool, or service for those purposes.

LQT does use an AI service (Anthropic's Claude API) for one narrow, user-initiated feature: reading a single agent reply email that was delivered to your dedicated LQT address, in order to extract the rate details into structured fields. That reply arrives through our own inbound email routing, not through any Google API, and under Anthropic's API terms that content is not used to train models.

Your data rights

You have the right to access, export, and delete your personal data. LQT provides these directly in the app, with no need to email or wait:

• Access & export: Settings → Account → "Your Data & Privacy" → Export my data downloads a complete copy of your data (profile, leads, quotes, rates, agents, shipments) in a portable JSON file.
• Deletion (right to erasure): the same screen's Delete my account & data permanently removes your account and all your data. This is immediate and cannot be undone.
• Disconnect email: you can disconnect your Gmail/Outlook account at any time in Settings, which revokes LQT's permission to send on your behalf.

These rights are provided to all users regardless of location, reflecting protections under the EU GDPR, California CCPA/CPRA, and similar laws. If you need help exercising any of them, contact us below.

Contact

Questions about this policy or your data: support@leadquotetrack.com.