Privacy Policy
This policy explains what personal data UltraQuote collects, why we collect it, who we share it with, and the rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018.
Who we are
UltraQuote (“we”, “us”, “our”) is an artificial-grass quoting tool operated from the United Kingdom by its owner, who is the data controller for the personal data described here. If you have any question about this policy or your data, email us at max@salesghost.app and we’ll help.
The data we collect
We only collect what we need to run the service:
- Account data. Your email address, and (if you sign in with Google) the basic identifier Google returns to confirm it’s you. We use a passwordless magic-link and Google sign-in, so we never see or store a password.
- Your plans and quotes. The lawns you draw, the property addresses or postcodes you search, map coordinates, roll and costing figures, and any business name you add for your quotes. This is the work you create in the app.
- Image improvements. If you choose to improve an area of map imagery, we process the selected crop to remove shadows and improve visible detail. The resulting image is saved with your account so it remains available in your plan.
- Billing data. If you subscribe to Pro or Enterprise, your payment is handled by Stripe. We do not receive or store your card number. We only keep the Stripe customer and subscription identifiers needed to manage your subscription.
- Technical data. Standard server and security logs (such as IP address, browser type and request time) generated automatically when you use the site.
- Optional analytics data. If you accept analytics cookies, we collect page views, product interactions and masked session recordings to understand how the service is used and where people encounter problems. When you are signed in, this may be connected to your account identifier and email address.
Where your work is stored
When you save a plan to the cloud it is stored in our database (Supabase) against your account, protected by row-level security so only you can read it. The app also keeps a copy of your current plan in your browser’s local storage so it survives a refresh; that copy stays on your device and is scoped to your account.
Why we use it, and our lawful bases
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Create and secure your account; store and sync your plans; provide the app | Performance of our contract with you (Art. 6(1)(b)) |
| Take payment and manage your Pro or Enterprise subscription | Performance of our contract with you (Art. 6(1)(b)) |
| Send service emails (sign-in links, welcome, billing and account notices) | Performance of our contract, and our legitimate interests (Art. 6(1)(f)) |
| Keep the service secure, prevent abuse, and fix problems | Our legitimate interests in a safe, working service (Art. 6(1)(f)) |
| Measure site usage and improve the product through optional analytics | Your consent (Art. 6(1)(a)) |
| Keep records for tax and accounting | Compliance with a legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising and we don’t sell it. Optional analytics run only if you accept them.
Who we share it with
We use a small number of trusted providers to run UltraQuote. They only process your data on our instructions, for the purposes below:
| Provider | What it does |
|---|---|
| Supabase | Account authentication and database hosting for your plans |
| Vercel | Application hosting, delivery and server logging |
| Stripe | Payment processing and subscription management for Pro and Enterprise |
| Resend | Sending transactional emails (sign-in links, welcome and billing notices) |
| PostHog | Optional product analytics and masked session recordings |
| Google Maps Platform | HD satellite map tiles for paid and active-trial accounts |
| Google Gemini API | Processing map crops when you request AI image improvement |
| Esri (ArcGIS) | Default satellite map imagery |
| Google Places | Suggesting UK addresses and turning the address or postcode you select into a map location |
We may also disclose data if we’re required to by law, or to establish, exercise or defend legal claims.
International transfers
Some of these providers process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by standard contractual clauses (the UK International Data Transfer Agreement or Addendum), so your data keeps an equivalent level of protection.
How long we keep it
- Account and plans: for as long as your account is open. If you delete a plan it’s removed from our database; residual copies may persist in encrypted backups for up to 30 days before being overwritten.
- Billing records: retained for six years after the relevant tax year, as UK tax law requires.
- Security logs: kept for a short period (typically up to 30 days) unless needed longer to investigate an incident.
Close your account by emailing us and we’ll delete your account data and cloud plans, keeping only what the law requires us to hold.
Cookies and local storage
UltraQuote uses necessary browser storage for an authentication token that keeps you signed in, your current plan, saved costing rates, and small preferences such as which panels are open and whether you’ve seen the walkthrough. If you accept analytics, PostHog also uses cookies and browser storage to measure product usage and provide masked session recordings. Optional analytics do not start before you accept them. Clearing your browser storage will sign you out, remove the local copy of your plan, and reset your cookie choice.
You can withdraw or change your analytics choice at any time using .
Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it;
- receive your data in a portable format; and
- withdraw consent where we relied on it.
To exercise any of these, email max@salesghost.app. We’ll respond within one month. If you’re unhappy with how we’ve handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first, though.
Security
All traffic is encrypted in transit with HTTPS. Your plans are isolated per account with database row-level security, payment card data is handled entirely by Stripe, and access to our systems is restricted. No online service can be guaranteed perfectly secure, but we take reasonable measures to protect your data.
Children
UltraQuote is a tool for tradespeople and isn’t directed at children. We don’t knowingly collect data from anyone under 18.
Changes to this policy
If we change this policy we’ll update the date at the top, and we’ll tell you by email before any material change takes effect.
Questions? Email max@salesghost.app.