Privacy notice

To be completed before production. This staging notice contains explicit placeholders; it does not establish a legally complete public launch.

Controller and contact

[LEGAL ENTITY], [ADDRESS], [CONTACT EMAIL]. These details must be supplied and verified before production. QuotBridge is a Kodvra product name, not a stated legal entity.

What the enquiry form stores

Your name, email, company, country, optional website, industry, optional enquiry-volume bucket and message; language, submission time, consent record/version, status, last update time, a daily salted IP hash and a user agent truncated to 300 characters. Free-mail addresses are accepted and only flagged for internal triage. Do not submit confidential RFQs or third-party personal data.

Purpose and basis

We use the details to respond to your requested pilot conversation. The checkbox records consent under Art. 6(1)(a) GDPR; it is not permission for newsletters or unrelated marketing. You can withdraw consent without affecting prior lawful processing. Security controls use a legitimate interest in preventing abuse (Art. 6(1)(f)). No automated decisions with legal or similarly significant effects are made.

Retention and deletion

Unengaged enquiries are reviewed after 30 days and deleted by day 90 from collection. The application automatically purges new and closed records older than 90 days at startup and before admin reads. Active opportunities require manual necessity review every 90 days; unnecessary data is deleted promptly. Daily salted IP hashes rotate in meaning each UTC day; the in-memory rate-limit entries expire after one hour. The session cookie lasts two hours. Operator-managed backups must rotate within 30 days; deleted records expire from backups within that period. Contractual records, if any, need a separate policy.

Recipients and international transfers

The intended website host is Render in Frankfurt; the operator must verify its DPA, subprocessors, access, logs and transfer safeguards before launch. SQLite holds the lead records on the service disk. If configured, Telegram receives only the lead ID, language, country and industry, not your name, email or message. Telegram may process metadata outside the EEA; enable it only after reviewing its role, terms and any required safeguards, otherwise leave it disabled. The form does not call an AI provider.

Cookies, fonts and server logs

One essential HttpOnly, SameSite=Lax session cookie binds the anti-forgery token to your browser. No analytics or advertising trackers are installed. Onest loads from Google Fonts; your browser therefore contacts Google and transmits connection information such as your IP address. Google may process data outside the EEA; the operator must assess this before production or self-host the font. Hosting access logs may contain IP addresses; configure minimal logging and a maximum 30-day operational retention with the host.

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction or portability, withdraw consent and object to processing based on legitimate interests. Contact [CONTACT EMAIL]. You may complain to your competent supervisory authority. Submitting this form is voluntary; required fields allow us to handle your enquiry.

Product preview and future pilot documents

The preview uses fictional data locally in your browser and submits nothing. Processing real pilot RFQs would require separate contractual instructions, retention terms and approval of any model provider. This enquiry form is not an upload channel.