| Provider | What it does | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc.Privacy policy | Database, authentication and one-time sign-in links | Account emails, company settings, uploaded quote records | Ireland (AWS eu-west-1) | Inside the EEA — none needed |
| Vercel Inc.Privacy policy | Application hosting and delivery | Request metadata, IP addresses in short-lived server logs | Serverless functions pinned to Dublin (dub1); company is US-based | SCCs / EU–US Data Privacy Framework |
| Amazon Web Services EMEA SARLPrivacy policy | Sending follow-up email and receiving customer replies to pass them to the salesperson (Amazon SES, SNS and S3) | Recipient name and email address, message content, reply content and attachments, delivery, bounce and complaint events. Received replies are held in Amazon S3 only until they have been processed and are then deleted; anything left over, for example after a processing failure, is removed by an automatic 30-day expiry on the bucket | Germany (Frankfurt, AWS eu-central-1); data stays in the EU. Parent company Amazon Web Services, Inc. is US-based | AWS GDPR Data Processing Addendum / SCCs |
| Stripe Payments Europe, Ltd.Privacy policy | Subscription payments and invoices | Billing name, billing address, VAT ID, payment method — card details never reach us | Ireland | Inside the EEA — none needed |
| Google Ireland Limited / Google LLCPrivacy policy | Optional “Sign in with Google” (Google acts as an independent controller for the sign-in itself), and, only for accounts that choose “Connect Gmail”, sending the follow-ups you scheduled from your own Gmail or Google Workspace mailbox through the Gmail API (send-only: nothing in the mailbox is read) | Name, email address and Google account identifier — only for people who choose Google sign-in. For Gmail sending: the mailbox address and, for each follow-up sent from it, the recipient, subject and content | Ireland; parent company Google LLC is US-based | SCCs / EU–US Data Privacy Framework |
| Microsoft Ireland Operations LimitedPrivacy policy | Optional “Sign in with Microsoft” (Microsoft acts as an independent controller for the sign-in itself), and, only for accounts that choose “Connect Outlook”, sending the follow-ups you scheduled from your own Outlook.com or Microsoft 365 mailbox through Microsoft Graph, and, with the Mail.ReadBasic permission, reading message metadata and headers (never bodies or attachments) in the Inbox, Junk Email and Sent Items solely to detect bounces and replies to those follow-ups (a connection without that permission is send-only and reads nothing) | Name, email address and Microsoft account identifier — only for people who choose Microsoft sign-in. For Outlook sending: the mailbox address and, for each follow-up sent from it, the recipient, subject and content; and, if read access is granted, message metadata and headers of the Inbox, Junk Email and Sent Items, of which only data about bounces and replies to our follow-ups is kept | Ireland; parent company Microsoft Corporation is US-based | SCCs / EU–US Data Privacy Framework |
| Functional Software, Inc. (Sentry)Privacy policy | Application error diagnostics. Events are scrubbed before sending: no email addresses, tokens, request bodies or quote, customer or message content | Error messages, stack traces and request paths, with personal data and tokens removed; no session recording | Germany (Frankfurt, Sentry EU data region); data stays in the EU. Company is US-based | SCCs / EU–US Data Privacy Framework |
Current as of the date above.
Deliberately not on this list
No analytics, advertising or session-recording provider is used, because none is present in the product.
Google Fonts is not a recipient. The typefaces are downloaded when the site is built and served from qfutool.com, so no visitor’s browser contacts Google and no IP address reaches it.
No artificial intelligence provider receives your data, and nothing you upload is used to train a model — ours or anyone else’s.