1. Introduction

At Eazy QI ("we", "us", or "our"), we respect your privacy and are committed to protecting the personal and commercial data you entrust to us. This Privacy Policy outlines how we collect, store, process, and safeguard information when you visit our website, use our SaaS quotation and invoicing applications, or access public proposal and receipt presentation links.

2. Information We Collect

Depending on how you interact with Eazy QI, we collect the following types of information:

A. Account & Profile Information

When you register an organization or user profile, we collect your full name, email address, password hash, phone number, company name, address, tax registration number (e.g. VAT/GST), currency preference, and brand logo.

B. Business & Transactional Data

Information relating to your clients (customer names, emails, billing addresses), quotation line items, product catalogs, prices, discount rates, taxes, invoice statuses, customer advance balances, and payment records.

C. Technical & Telemetry Information

IP address, browser type, operating system version, page access timestamps, and error diagnostic logs collected strictly for performance optimization, rate-limiting, and cybersecurity auditing.

3. How We Use Your Information

We process your information exclusively for legitimate business and platform delivery purposes:

To create, manage, authenticate, and maintain your organization tenant and user accounts.
To generate dynamic web proposals, PDF quotations, invoices, and branded payment receipt documents.
To facilitate 1-click client proposal acceptance and notify you in real-time when clients respond.
To calculate ledger balances, customer advance deposits, and financial analytics for your business dashboard.
To send essential transactional notifications, password reset OTPs, verification emails, and invoice notifications.
To maintain cybersecurity hygiene, prevent brute-force attacks, and comply with legal or tax obligations.

4. Data Security & Storage

We implement stringent technical and organizational security controls to protect your data against unauthorized access, loss, or disclosure:

Encryption in Transit: All web traffic is enforced over HTTPS with TLS 1.3 encryption.
Encryption at Rest: Passwords are cryptographically hashed using standard Bcrypt / Argon2 algorithms. Database backups and sensitive configurations are secured with industry-standard encryption.
Tenant Isolation: Our multi-tenant architecture ensures each organization's data is partitioned and accessible only to authorized team members.
VAPT Hardening: We regularly undergo Vulnerability Assessment and Penetration Testing (VAPT) and enforce Content Security Policies (CSP), HSTS, and XSS filtering headers.

5. Cookies & Local Storage

We use cookies and browser local storage strictly for essential platform functionality:

Session & Authentication Cookies: To keep you securely logged into your dashboard and protect against Cross-Site Request Forgery (CSRF).
Preference Storage: LocalStorage keys (such as theme for dark/light mode preference and sidebarCollapsed) to remember your UI layout choices across browser reloads.
We do not sell your data to third-party ad networks or brokers.

6. Third-Party Service Providers

We may engage reputable third-party infrastructure providers to assist with platform operations:

Cloud Hosting & Database Infrastructure: Enterprise-grade cloud data centers with continuous monitoring and backups.
SMTP & Transactional Email Services: Providers used to deliver OTP verification codes and invoice emails according to your SMTP settings.
Google OAuth: If you choose to log in via Google Sign-In, we receive authentication tokens strictly to verify your email identity.

7. Your Privacy Rights

Depending on your jurisdiction (including GDPR and global privacy frameworks), you possess the following rights regarding your personal data:

Access & Portability: The right to request copies of the personal data we hold about you.
Rectification: The right to update or correct inaccurate profile, company, or billing details.
Erasure (Right to be Forgotten): The right to request deletion of your account and associated organization data, subject to lawful tax record retention requirements.
Withdraw Consent: The right to withdraw consent for marketing or optional email notifications at any time.

8. Data Retention Policy

We retain your business records, quotations, invoices, and receipts for as long as your account remains active. If you delete your organization, we purge active operational records within 30 days, except where longer retention is mandated by financial accounting or tax statutory regulations.

9. Contact Data Protection Officer

If you have questions, privacy requests, or wish to exercise any of your data protection rights, please contact our Data Protection Officer:

Eazy QI Privacy & Compliance Officer

Email: privacy@eazyqi.com

Security Inquiries: security@eazyqi.com