← Back to Home

Privacy Policy

Last updated: September 24, 2026  ·  Previous version: May 18, 2026

LotQuote ("we," "our," or "us") operates the LotQuote.io website and the LotQuote application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. How we handle data from your Google account is described in Section 7 (Google Calendar Integration).

1. Information We Collect

Account Information: When you create an account we collect your name, email address, company name, phone number, and billing information.

Usage Data: We automatically collect information about how you interact with the Service, including IP address, browser type, device identifiers, pages visited, features used, and timestamps.

Location & Map Data: When you search for addresses or use the satellite map feature, we process addresses and geographic coordinates through Google Maps Platform (Maps JavaScript, Places, Geocoding, Street View, and Static Maps). The satellite map snapshot you capture for a job is part of the estimate you create, together with your measurements and markings, and is stored with that estimate as your content (estimates save automatically while you work). You control this content: deleting an estimate deletes its snapshot. Job-site coordinates are also sent to Open-Meteo to retrieve the weather forecast shown on scheduled jobs.

Customer & Client Data: Information you enter about your clients — names, addresses, email addresses, contact details, and job history — is stored to power the CRM, proposal, invoicing, work order, and client portal features. Client email addresses you provide are used to grant those clients access to the LotQuote Client Portal.

Estimate & Proposal Data: All estimates, line items, pricing, proposal PDFs, approval status, and quote type selections you create are stored and associated with your account.

Invoice & Payment Data: When you generate invoices, we store invoice line items, totals, payment terms, and invoice status. Payment processing is handled entirely by Stripe. We do not store full card numbers or sensitive payment credentials on our servers.

Work Order Data: Work order PDFs you generate — including satellite map snapshots, polygon overlays, pin markers, and material calculations — are stored and associated with the relevant estimate and customer record.

Blueprint & Measurement Data: PDF blueprints you upload, calibration data, polygon measurements, line measurements, signage placements, and count dot annotations are stored and linked to your estimates.

Team & Enterprise Data: For Enterprise plan accounts, we collect company profile information, team member email addresses, role assignments, shared price list data, and job costing records to support multi-user workspaces.

Client Portal Data: Clients who access the LotQuote Client Portal (clients.lotquote.io) authenticate via magic link. We store their email address and associate it with the estimates and invoices shared by their contractor. Service requests submitted through the portal are stored and linked to the client's email.

AI Detection Data: When you use the AI stall and marking detection feature (currently in Beta, available on Ultimate and Enterprise plans), the satellite image of the area you select is sent to our backend only to generate detection results for you. Our backend does not keep the image. The results are returned to you, and whatever you keep in your estimate is stored as part of your content (see Location & Map Data above). Some AI takeoff features use OpenAI, as described in Section 3.

Voice, Receipt & Photo Inputs: If you use voice estimates, receipt scanning, blueprint or aerial takeoff, stencil detection, or AI "after" images, we process the audio, images, or documents you submit, as described in Section 3. Voice recordings are not stored. Transcripts and the details extracted from them are stored with your account.

Google Calendar Data: If you connect Google Calendar, we access and store the limited information described in Section 7.

Integration Tokens: If you connect QuickBooks, Jobber, or Google Calendar, we store the OAuth access and refresh tokens issued for your account in our database so the integration keeps working. These tokens are scoped to the permissions you grant during the OAuth flow. Database access rules limit them to your own account and our backend servers, and they are never shared with other users. You can remove them at any time by disconnecting the integration.

Terms Acceptance Records. When you create an account or affirmatively accept an updated version of our Terms or Privacy Policy, we record which version you accepted, the timestamp of acceptance, your IP address at the time, and the user-agent string of your browser, for compliance and audit purposes.

2. How We Use Your Information

We use collected information to: provide and maintain the Service; generate estimates, proposals, work orders, and invoices; process payments and manage subscriptions; enable client portals and service request workflows; support team collaboration for Enterprise accounts; run AI detection and other AI-assisted features you choose to use; sync data with connected third-party platforms (QuickBooks, Jobber); add your scheduled jobs to your Google Calendar if you connect it; communicate with you about updates, security alerts, and support; deliver marketing and informational calls, text messages, and emails (subject to your consent and applicable law — see Section 13); analyze usage to improve the Service; and comply with legal obligations.

3. AI Model Training & Your Data

We do not use your customer data, estimate data, invoice data, customer contact information, blueprint files, or work order content to train, fine-tune, or improve any AI or machine learning model.

The AI stall and marking detection model used by the Service is trained on a separate, internally curated dataset of satellite and aerial imagery that does not include identifying customer, project, or business information. Satellite map images submitted to the AI detection feature are used solely to generate detection results, and our backend does not keep them after returning those results. We do not use them to retrain or update the production model.

AI features that use OpenAI. Some features send the content you submit to OpenAI's API to produce a result:

• voice estimates: your audio recording, its transcript, and your price-list item names
• receipt scanning: the receipt image or text
• blueprint takeoff: images of the plan pages you submit
• stencil detection: the photo you submit
• aerial takeoff and boundary detection: satellite imagery of the selected area
• AI "after" images: a satellite or cover photo of the lot

These requests are made only when you use the feature, and they include only what that feature needs. OpenAI processes this data as our service provider under its API terms. Under those terms, API data is not used to train OpenAI's models by default, and OpenAI may keep API inputs and outputs for a limited period for abuse monitoring. We store the results these features return as part of your account data, for example voice-estimate transcripts and extracted details, receipt images you upload, and generated "after" images. Google Calendar data is never sent to OpenAI or any other AI model.

If we ever change this practice — for example, by introducing an opt-in program where you can voluntarily contribute imagery to improve detection accuracy — we will obtain your explicit, affirmative consent first and update this Privacy Policy with at least 30 days' advance notice.

4. Multi-Tenant Data Isolation

LotQuote is a multi-tenant application. Each user's data — including estimates, customers, invoices, work orders, price lists, OAuth tokens, blueprint files, and job data — is strictly isolated through row-level security (RLS) policies enforced at the database layer. Enterprise team members can only access data within their assigned company workspace. No user can access another user's data.

5. Client Portal

The LotQuote Client Portal (clients.lotquote.io) allows contractors to share estimates, proposals, and invoices with their property manager clients. Clients authenticate via a magic link sent to their email address. Client-facing data is limited to what the contractor has explicitly associated with that client's email address. Clients may also submit service requests through the portal, which are stored and visible to their contractor.

6. Third-Party Services

We integrate with the following third-party services, each governed by their own privacy policies:

• Google Maps Platform: For satellite imagery, geocoding, and map display. Subject to the Google Privacy Policy.
• Stripe: For subscription billing and invoice payment processing. Your payment information is handled directly by Stripe and is not stored on our servers. Subject to the Stripe Privacy Policy.
• QuickBooks (Intuit): If connected, we access and sync estimate, customer, and invoice data between LotQuote and QuickBooks using OAuth 2.0. Per-user tokens are stored securely and isolated per account.
• Jobber: If connected, we access and sync job and client data between LotQuote and Jobber using OAuth 2.0. Per-user tokens are stored securely and isolated per account.
• Google Calendar API: If you connect it, we create and manage job events on the Google Calendar you select. See Section 7. Subject to the Google Privacy Policy.
• OpenAI: Processes the content you submit to the AI-assisted features listed in Section 3. Subject to the OpenAI Privacy Policy.
• Open-Meteo: Receives job-site coordinates and returns weather forecasts. No account details are sent.
• Supabase: Our database and authentication infrastructure. Data is stored on Supabase's secure, encrypted infrastructure with row-level security enforced.
• Railway & Vercel: Our backend and frontend hosting providers. Server logs may include IP addresses and request metadata for operational and security purposes.
• Resend: Our transactional and marketing email delivery provider. Email delivery metadata (recipient address, send timestamps, delivery and engagement events) is processed by Resend on our behalf.
• Telephony & messaging providers: If you have provided a phone number, we may use third-party telephony and SMS providers (such as Twilio, OpenPhone, or similar) to place marketing or informational calls and to send text messages. Each such provider acts as our service provider and processes call and message metadata on our behalf.

7. Google Calendar Integration

LotQuote can add your scheduled jobs to a Google Calendar. This integration is optional. It is off unless you connect it in Settings → Google Calendar, and only the owner of a job can sync it.

Permissions we request. When you connect, Google asks you to grant two permissions (OAuth scopes):

• https://www.googleapis.com/auth/calendar.events: lets us create, update, and delete the job events LotQuote adds to the calendar you choose.
• https://www.googleapis.com/auth/calendar: lets us list the calendars you can write to, so you can choose one, confirm the one you chose still exists and is writable, and, if you ask us to, create a new calendar for your jobs (named "LotQuote Jobs" by default).

What we access. With these permissions, LotQuote:

• reads the list of calendars you have write access to (each calendar's name, ID, time zone, color, and whether it is your primary calendar) and shows it to you in the calendar picker;
• creates one new calendar, only if you choose that option;
• creates, updates, and deletes events for your scheduled LotQuote jobs, only on the calendar you selected. An event is created when you schedule a job, updated when you reschedule it, and deleted when you unschedule or delete it.

What we do not access. LotQuote does not read, search, list, or copy the events already in your calendars, or any event it did not create. It does not read attendees, guests, or other people's calendars, and it does not access your contacts, email, or any other Google data.

What we write to your calendar. Each event contains the job type, the client or job name, the job-site address, the scheduled time, a weather forecast for the site, and a link to the job's work order in LotQuote. If you turn on Show full job details, events also include the estimate total and a link to the estimate. That setting is off by default.

What we store. We store the following, linked to your LotQuote account in our database (Supabase):

• the Google OAuth access token, refresh token, and token expiry time;
• the ID, name, and time zone of the calendar you selected (for a primary calendar, Google uses your Google account email address as its ID);
• your sync and "Show full job details" settings;
• the Google event ID for each job we added to your calendar, stored on that job so we can update or remove the right event.

Our backend logs (hosted on Railway) may record the selected calendar ID and short error messages returned by Google, for troubleshooting. We do not store a copy of your calendar or its events.

How we use and share it. We use Google Calendar data only to provide the calendar sync you turned on. We do not sell it. We do not use it for advertising, and we do not use it to build profiles of you. It is never sent to OpenAI or any other AI or machine-learning service, and it is never used to train AI models. We do not share it with third parties except the infrastructure providers that host LotQuote (Supabase for the database, Railway for our backend), and only as needed to run the integration. We may also disclose it where the law requires. Our staff do not read your Google Calendar data unless you ask us to for support, it is needed to investigate a security issue or abuse, or the law requires it.

How long we keep it. We keep the tokens and calendar settings while Google Calendar is connected.

How to disconnect and delete it.

• In LotQuote: go to Settings → Google Calendar → Disconnect. We revoke our access token with Google right away and delete the stored tokens, calendar ID, name, time zone, and sync settings from our database. Events we already created stay in your Google Calendar because they belong to you, and you can delete them in Google Calendar at any time. Google event IDs remain on your job records until you delete those jobs or your account.
• In your Google account: you can also remove LotQuote's access at myaccount.google.com/permissions. Our stored tokens then stop working. They are deleted when you disconnect in LotQuote or when you ask us to delete them.
• By email: to have all Google Calendar data we hold about you deleted, email privacy@lotquote.io. We will delete it within 30 days.

8. Data Storage & Security

Your data is stored on secure, encrypted servers. We implement industry-standard security measures including: TLS encryption in transit; encryption at rest; row-level security (RLS) enforced at the database layer; JWT-based authentication with server-side validation; per-user OAuth token isolation; Content Security Policy (CSP), HSTS, and X-Frame-Options headers; and server-side plan enforcement to prevent unauthorized feature access.

Shared image links. Some images you add to estimates (estimate photos, pin photos, and generated AI "after" images) are stored at unlisted links so they can appear in proposals and the client portal. Anyone who has one of these links can view that image. Receipt images are stored privately.

No method of internet transmission or electronic storage is 100% secure. While we use commercially reasonable practices to protect your data, we cannot guarantee absolute security.

9. Data Retention & Backups

We retain your account data for as long as your account is active. To delete your account and personal data, email privacy@lotquote.io from the email address on your account. After we verify the request, we will remove your personal data from our active production database within 30 days, except where we are required by law to retain it. Disconnecting an integration (QuickBooks, Jobber, or Google Calendar) deletes its stored tokens right away. See Section 7 for Google Calendar.

Backups. Routine encrypted database backups are retained for up to 90 days for disaster-recovery purposes. After your data is removed from the active database, residual copies in those backups are purged on the standard backup-rotation cycle (no later than 90 days).

Anonymized data. Aggregated, anonymized usage data that cannot reasonably be linked back to you may be retained indefinitely for analytics and product improvement. As stated in Section 3, we do not use your personal or customer data to train AI models.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to: access, correct, or delete your personal data; object to or restrict certain processing; request data portability; and withdraw consent at any time. To exercise any of these rights, contact us at privacy@lotquote.io. We will respond within the timeframe required by applicable law (typically 30–45 days). We will not discriminate against you for exercising any of these rights.

11. California Privacy Rights (CCPA / CPRA)

This section applies to California residents and is provided in compliance with the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA").

Categories of personal information we collect. In the past 12 months, we have collected the following categories of personal information, as described in Section 1 above: identifiers (name, email, IP address, device ID, phone number); commercial information (subscription tier, billing records); internet/network activity (usage logs, feature interactions); geolocation data (addresses you search, lots you measure); professional information (company name, role); communications metadata (call logs, SMS delivery events for messages we initiate); and inferences drawn from the above (e.g., subscription tier eligibility).

Sources. We collect this information directly from you, automatically through your use of the Service, and from connected third-party integrations you authorize (such as QuickBooks and Jobber).

Business purposes. We use this information for the purposes described in Section 2 above.

No sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA without notice.

Your CCPA rights. Subject to certain exceptions, California residents have the right to:

• Know what personal information we have collected about you, the categories of sources, the business purposes, and the categories of third parties with whom we share it
• Request a copy of the specific pieces of personal information we hold about you (right to access / portability)
• Request that we delete personal information we have collected about you
• Request that we correct inaccurate personal information about you
• Limit the use and disclosure of any sensitive personal information we collect
• Be free from retaliation for exercising any of these rights

How to exercise your rights. Submit a verifiable request by emailing privacy@lotquote.io. We may need to verify your identity by confirming details associated with your account before fulfilling the request. You may designate an authorized agent to make a request on your behalf, subject to verification.

12. European Economic Area, United Kingdom & Swiss Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following additional terms apply.

Data controller. LotQuote (Suwanee, GA, United States) is the data controller for personal data collected through the Service.

Legal bases for processing. We process your personal data on the following legal bases under the GDPR / UK GDPR:

• Contract: to provide the Service you have subscribed to and fulfill our contractual obligations under our Terms.
• Legitimate interests: to operate, secure, and improve the Service, prevent fraud, and communicate with you about your account, balanced against your privacy rights.
• Consent: for any optional processing where we explicitly request it (such as non-essential cookies, marketing calls or text messages to phone numbers you provide, or future AI training opt-ins, if introduced).
• Legal obligation: to comply with applicable law.

Your GDPR rights. You have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local supervisory authority.

International transfers. Because we are based in the United States, your personal data is transferred to and processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses) where required for transfers from the EEA, UK, or Switzerland.

To exercise any of these rights, contact us at privacy@lotquote.io.

13. Calls and Text Messages — TCPA Disclosure

If you provide a phone number during signup, in your account settings, or in any form on our website, you consent to receive marketing and informational calls and text messages from LotQuote and its affiliates, partners, and service providers at that number, including through the use of an automatic telephone dialing system, artificial or prerecorded voice, or other automated technology. Consent is not a condition of purchase. Message and data rates may apply, and message frequency may vary.

How to opt out. You may opt out of marketing text messages at any time by replying STOP to any marketing text message we send you. You may opt out of marketing calls by following the opt-out instructions provided during any call, or by emailing privacy@lotquote.io. Opting out of marketing communications will not affect transactional or account-related messages such as password resets, billing notices, subscription receipts, or service alerts, which you will continue to receive while your account is active.

Information we collect about calls and messages. When we (or our service providers acting on our behalf) place a call or send a text message to a number you provided, we may collect and retain associated metadata, including the phone number, the date and time of the call or message, the duration of any call, message delivery and engagement events (delivered, read, replied, opted out), and the content of text messages we sent or that you sent in reply. This information is used to operate, troubleshoot, and improve our outreach, to honor opt-out requests, and to comply with applicable law (including the TCPA and the Telemarketing Sales Rule).

Call recording. We do not record calls by default. If we begin recording calls in the future, we will provide notice at the start of any recorded call and obtain any consent required by applicable law, including any two-party consent jurisdictions.

Internal Do Not Call list. We maintain an internal Do Not Call list of phone numbers that have opted out of marketing communications. Once you opt out, we will honor that request indefinitely unless you later provide affirmative consent to be contacted again.

14. Cookies

We use essential cookies for authentication and session management. We may also use analytics cookies with your consent. You can manage cookie preferences through your browser settings.

15. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child, we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes — including changes to how we collect, use, or share your data, or to your privacy rights — by posting the updated policy on this page and updating the "Last updated" date above, and where required by law, by sending email notice or providing in-app notice at least 30 days before the changes take effect.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your privacy rights, please contact us at:
privacy@lotquote.io
LotQuote — Suwanee, GA, United States