Privacy Policy

Account details. Your name, email address, business name, and the pricing defaults you set at signup.

Content you create. Customers, job addresses, walkthrough notes, photographs, audio and video you upload, estimates, rates and quotes.

Billing details. If you subscribe, Stripe collects and holds your payment details. We never see or store your card number. We keep only your subscription status, plan and billing period.

Usage records. A log of successful AI analyses, used to enforce plan limits, plus basic product events (an estimate created, a PDF downloaded) recorded in our own database rather than sent to a third-party analytics service. Three of those events — that you signed up, opened checkout, or started a subscription — are also reported to Meta if you reached us from one of our ads. See Advertising below for exactly what that sends.

Walkthrough media often shows the inside of someone’s home. We treat it accordingly:

• it is stored in private buckets and is never publicly accessible;
• access is through short-lived signed links, issued only to your organisation;
• stills from your footage are read to judge condition and to size rooms against something of known height in shot — a doorway, a light switch — and every measurement is labelled with how it was arrived at;
• you can delete any file from an estimate at any time.

You are responsible for having the property owner’s permission before photographing or recording their home.

This matters, because most of the information in this product is not about you — it is about the people whose homes you quote, and they never signed up here.

You decide what is collected about your customers and why. In data protection terms you are the controller of that information, and M3 Digital Co Pty Ltd is your processor: we hold and process it on your instructions, to provide the service to you, and for no purpose of our own. We do not sell it, we do not use it to advertise, and we do not use your customers’ footage to train AI models.

Practically, that means you are responsible for telling your customer what you are doing before you send them a walkthrough link — that they will record their own home, that the recording goes to you, and that it is used to prepare their quote. In most cases their agreement to record is what makes that lawful.

If one of your customers asks us directly to see or delete their information, we will refer them to you and help you respond, rather than acting on their request ourselves. That is the correct order: it is your relationship and your obligation.

Where the UK or EU General Data Protection Regulation applies, we rely on:

• Contract — to give you an account, hold your estimates, and take payment for a plan you chose.
• Legitimate interests — to keep the service secure, prevent abuse, and fix faults, balanced against your interests and never overriding them.
• Legal obligation — to keep tax and accounting records for the period the law requires.
• Consent — for anything optional, which you may withdraw at any time.

For information about your customers, your own lawful basis is what applies. See the section above.

When you press “Analyse walkthrough”, we send your notes, any transcript, and the photographs you have marked for analysis to Anthropic, which returns a structured draft scope. It is never asked for, and never returns, a price.

Two things happen earlier than that, and you should know about both. As each clip uploads, a still from it is checked so we can tell whoever is filming that the footage cannot be sized, while they are still standing in the room. And when a walkthrough is submitted, the audio is sent to OpenAI to be transcribed, so what was said about the job is not lost.

Images are downscaled before being sent, and no more than six are included in a single analysis. Your content is not used to train AI models.

These providers process data on our instructions to run the service. We do not sell your data. The one thing we share for advertising is described under Advertising below: a hashed form of your email address, so Meta can tell that an ad it showed you led to a signup.

Our providers operate internationally, so your data may be stored or processed outside your country. Where that happens we rely on the contractual protections those providers offer. Contact us if you need the specific regions for your account.

We keep your content while your account is open, because your estimate history is the point of the product. If you delete an estimate, it and its scope, materials and uploaded files are removed. If you close your account we delete your content within 90 days, except where we must keep records longer — for example transaction records required by tax law.

Wherever you are, you can ask us to give you a copy of your information, correct it, export it, or delete it. Most of this you can do yourself in the app. For anything else, email support@paintquoteking.com — we respond within 30 days, and we do not charge for it.

United Kingdom and European Union. You also have the right to object to processing, to ask us to restrict it, to data portability in a machine-readable format, and to withdraw consent at any time without affecting what came before.

Australia and New Zealand. You may ask for access and correction under the Australian Privacy Principles and the New Zealand Information Privacy Principles, and we will tell you in writing if we refuse and why.

Canada. Under PIPEDA you may ask what we hold, why, and to whom it has been disclosed.

United States. Where state law gives you the right to know, delete, or correct, you may exercise it at the same address. We do not sell personal information, and we never have. We do share one thing for advertising: where you reached us from one of our ads, a hashed form of your email address goes to Meta so it knows the ad worked, which some state laws treat as sharing for cross-context behavioural advertising. Advertising above says exactly what that is and how to stop it. We will not treat you differently for exercising any of these rights.

If you are not satisfied with our answer, you can complain to the regulator where you live:

• Australia: Office of the Australian Information Commissioner (OAIC)
• New Zealand: Office of the Privacy Commissioner
• United Kingdom: Information Commissioner's Office (ICO)
• Canada: Office of the Privacy Commissioner of Canada
• United States: your state Attorney General — California residents may also contact the California Privacy Protection Agency

Note that the customer records you store are your customers’ personal information, not ours. If one of them contacts us, we will point them to you — see “Who is responsible for your customers’ information” above.

If personal information is lost or exposed in a way likely to cause serious harm, we will investigate immediately, tell you what happened and what we are doing about it, and notify the relevant regulator within the time the law requires — 72 hours under the UK and EU GDPR, and as soon as practicable under the Australian and New Zealand schemes.

Where the breach involves your customers’ information, we will give you what you need to notify them, because that notification is yours to make.

This is a tool for tradespeople and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child’s information has reached us — for example in a walkthrough recording — tell us and we will delete it.

Access is protected by database-level row security keyed on organisation membership, so one account cannot read another’s data. Uploads are private and served through expiring signed links. Passwords are hashed by our authentication provider and are never visible to us.

No system is perfectly secure. If a breach affects your data we will notify you and the relevant regulator as required by law.

Some email is part of the service and cannot be turned off while you have an account: confirming your address, resetting your password, receipts, and telling you when a customer has answered a quote. Those are sent because you asked us to run your account, not to market to you.

We may also send occasional email about the product itself — new features, guidance on getting better quotes, or a change that affects you. Every one of those carries an unsubscribe link, and using it stops them without affecting your account or the service email above.

We do not sell your address, and we do not send you other companies’ advertising.

We advertise on Meta (Facebook and Instagram). To know which ads are worth paying for, we tell Meta when someone who clicked one of our ads signs up, opens checkout, or starts a subscription.

Two halves, and they do different things. Meta’s pixel runs on our public pages and records page views, which is how we see that a campaign is sending anybody at all. The three events above are not sent by it — they are sent from our server, so that an ad blocker or a phone’s privacy setting cannot quietly drop a signup we know happened. Nothing about a conversion depends on a script in your browser.

What we send. The name of the event, when it happened, the subscription amount where there is one, and your email address put through a one-way hash — a fixed-length string of letters and numbers that cannot be turned back into your address. Meta compares it against hashes it already holds. If it has never seen you, it learns nothing.

What we never send. Anything about your work. Not your jobs, your quotes, your prices, your rates, your margins, your customers, their addresses, or any photograph or recording of anybody’s property. None of that is part of this and none of it ever leaves our systems for advertising.

How to stop it. Email us at the address below and we will exclude your account, or use Meta’s own controls: Settings → Accounts Centre → Your information and permissions → Your activity off Meta technologies. You can also simply not arrive from an ad — with no click identifier stored, a signup is not reported.

We use the cookies needed to keep you signed in and to keep the service secure, and two for advertising: one we set ourselves if you arrive from one of our ads, storing the click identifier Meta puts on the link so we can tell Meta the signup came from that ad; and Meta’s own, set by its pixel. Ours is readable only by our server and expires after 90 days.

Meta’s pixel runs on this site. It records that a page was viewed and sets Meta’s own cookies (_fbp, and _fbc if you arrived from an ad). It does not read anything you type, and it is not what reports a signup or a payment — those are sent from our server, described under Advertising above.

There is no Google tag and no other analytics script. Product events — an estimate created, a PDF downloaded — are recorded in our own database and reported to nobody.

M3 Digital Co Pty Ltd, ABN 25 644 823 085
support@paintquoteking.com