What we hold, who sees it, and how to get it back

Quickmation builds and runs automations for small and medium businesses. When you use the platform we hold information about your business so we can do that work, and we are the controller of that information. Where your automations touch your own customers’ data, you are the controller and we act on your instructions.

Reach us at privacy@quickmation.com.

Your account. Name, email, role, and the organisation you belong to. A phone number if you give one, and a record of whether you have confirmed it by answering a call from us.

What you tell us about your business. The assessment answers, the processes you describe and the figures you give us, so we can judge what is worth automating.

Data from systems you connect. Only from systems you explicitly authorise, and only the parts the automation needs. We hold the access credentials for those systems encrypted with a key that is not in the database, so a copy of the database alone does not yield them.

What the platform did. Every consequential action writes an audit record: who or what did it, when, on what, and on whose authority. This is how you can check our work, and we do not offer a mode that skips it.

Phone calls, if you use the line. We store what the transcription service heard, how confident it was, and the calling number — which we record as unverified, because a calling number is a claim made by a carrier and can be forged. The code you key is never stored as you typed it; only a keyed digest of it is kept.

Your customers’ calls and texts, if you use the AI Front Desk. We store your customers’ phone numbers, a transcript of each call (calls are transcribed, never recorded), the texts sent each way, the messages they leave for your team, and whether they have replied STOP or START. What a customer says is sent to the model providers named below so the receptionist can reply. For this information you are the controller and we process it on your behalf.

To run the service you asked for, to bill you, to keep the platform secure, and to show you what was done on your behalf.

We do not sell your data, and we do not use your business data to train models. Text is sent to the model providers named below to carry out your work; it is not contributed to anyone’s training corpus by us.

Mobile numbers and text-messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. A customer’s number is used only to answer them and to tell your team about their message, and after a STOP no further text is sent to it until they reply START.

These companies process data on our behalf. We name them individually because “trusted third parties” tells you nothing you could act on.

• Neon — AWS, US East
  The database. All account and business data is stored here.
• Vercel — US
  Hosts the web application and serves every page and API route.
• Fly.io — Amsterdam
  Runs the isolated containers that execute implementation work.
• OpenAI — US
  Model inference. Receives the text of a task, never your stored credentials.
• NVIDIA — US
  Model inference for the execution agents. Also receives the text of assessment analysis, opportunity discovery, planning, review, documentation and classification work whenever OpenAI cannot take it.
• Stripe — US
  Payments. Card details go to Stripe directly and never reach our servers.
• Twilio — US
  Phone calls and text messages: call routing and speech-to-text on what a caller says, for your own reporting line and for an AI Front Desk number, and delivery of texts to and from your customers. It receives your customers' phone numbers, what they say on a call, and the texts themselves. Calls are transcribed, not recorded.
• Fish Audio — US company; processing location not published by Fish Audio
  Only if call voices are switched on, which they are not by default: turns the sentences our phone agents speak — on your own reporting line and on an AI Front Desk — into speech. It receives the text of those sentences, which can include your business information read back to you and an AI Front Desk's answers to your customers; it never receives the audio of a call. We keep the audio it returns for at most 7 days after it was last played.
• Resend — US
  Transactional email — email-address verification, password resets, approval notices and other notices about your account, including the notice to your team when a customer leaves a message with the AI Front Desk (which carries that customer's name, number and message). Sign-in itself is by password, not by emailed link.
• OpenRouter — US
  Only if answer-engine visibility sampling is switched on, which it is not by default: receives the questions we put to answer engines about your business, with its providers' data collection refused.

Separately, you may connect your own systems. We read from these only after you authorise it, and disconnecting deletes our copy of the credential:

Google Workspace · Google Business Profile · Microsoft 365 · QuickBooks · Xero · HubSpot · Salesforce · Pipedrive · Square · Jobber · ServiceTitan · RingCentral · Slack · LinkedIn · Facebook · Yelp · Twilio

The detailed contents of an automation run — its inputs and outputs — are cleared after 90 days. The record that the run happened, and its result, is kept, because that is the audit trail you rely on to know what we did.

Account and business information is kept while your account is open. Close it and we delete it, except where we are required to keep records — invoices and payment records in particular.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or ask us to stop. Email privacy@quickmation.com and we will respond within 30 days.

You can also leave. Your automations, the definitions behind them and the record of what they did are yours, and we will export them in a usable form. We do not build a platform you cannot walk away from.

Depending on where you live you may have additional rights under the UK GDPR, the EU GDPR or US state privacy laws, including the right to complain to a regulator.

Credentials for your connected systems are encrypted at rest with a key held outside the database. Access is scoped to your organisation at the query level, not merely in the interface. Anything that touches money, customers or production data waits for a named human to approve it — with one exception you choose: an AI Front Desk you switch on answers your customers’ calls itself (and, once texting is approved for its number, their texts), within the limits described in our terms.

Cookies. We set cookies only to keep you signed in, plus a short-lived one while you connect one of your systems, so the connection that comes back can be checked as the one you started. We run no analytics or advertising cookies.

No system is perfectly secure, and we would rather say that than imply otherwise. If we discover a breach affecting your data we will tell you, and we will tell you what we know rather than waiting until the picture is complete.

If we change this policy in a way that affects you materially, we will tell you before it takes effect rather than relying on you noticing a new date at the top of a page.