Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the QuoteSnap Terms of Service. It describes how QuoteSnap Software ("we", "us", "Processor") processes personal data on behalf of our users ("you", "Controller") when you use our services.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person, including client names, site addresses, and contact details you enter into QuoteSnap.
• Processing: Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• Subprocessor: A third party engaged by us to process Personal Data on our behalf.

3. Role of the Parties

You are the Controller of Personal Data you input into QuoteSnap. We act as a Processor, processing Personal Data only on your instructions and for the purpose of providing the quote drafting service.

4. Our Obligations as Processor

We will:

• Process Personal Data only for the purpose of providing the QuoteSnap service.
• Not use Personal Data for our own purposes or sell it to third parties.
• Implement appropriate technical and organisational measures to protect Personal Data.
• Not retain Personal Data longer than necessary for service provision.
• Assist you in responding to data subject requests under the Privacy Act 1988.
• Notify you promptly of any suspected data breach affecting your Personal Data.

5. Subprocessors

We use the following Subprocessors to provide our service:

• Moonshot AI (Kimi): Processes voice transcripts and job details to generate quotes. Based in Singapore. See their Terms: platform.kimi.ai/docs/agreement/tos
• Stripe: Processes payment information. Based in the United States. See their Privacy Policy: stripe.com/au/privacy

We remain liable for the acts and omissions of our Subprocessors.

6. Data Transfers

Personal Data you submit may be transferred to Singapore (Moonshot AI) and the United States (Stripe) for processing. By using QuoteSnap, you consent to these transfers. We rely on standard contractual clauses and the Subprocessors' own data protection commitments to ensure adequate protection.

7. Data Retention and Deletion

We do not retain voice transcripts or quote content on our servers after processing. Your quote history is stored in your browser's localStorage and persists until you clear it. Usage metadata (IP address, timestamp) is retained for up to 90 days for quota enforcement and security purposes. Account data is deleted upon account closure. If you request deletion of your account data, contact us at vtradesof@gmail.com.

8. Security Measures

We implement the following security measures:

• HTTPS/TLS encryption for all data in transit.
• Rate limiting to prevent abuse.
• Input sanitization to prevent injection attacks.
• Hashed passwords (never stored in plain text).
• No central storage of quote content or voice transcripts.

9. Audit Rights

You may request information about our data processing practices by emailing vtradesof@gmail.com. We will respond within 30 days.

10. Changes to This DPA

We may update this DPA to reflect changes in our Subprocessors or legal requirements. Changes will be posted here with an updated date. Continued use after changes constitutes acceptance.

11. Contact

Email: vtradesof@gmail.com

Location: Adelaide, South Australia