Quotepencil privacy notice
Version 1.0, November 2026
Who we are
Quotepencil is a trading name of Buvo Ltd. Buvo Ltd is registered in England and Wales, company number 15846940. Our registered office is 320 Firecrest Court, Warrington, WA1 1RG.
Buvo Ltd is the "controller". That means we decide how your data is used, and we are responsible for it.
We are registered with the Information Commissioner's Office (ICO). Our registration number is ZB805946.
To ask us anything about your data, email privacy@quotepencil.co.uk.
Who this notice is for
This notice covers two groups of people:
- Builders we contact about Quotepencil. We write to the owners and directors of small UK building companies.
- Builders who use or try Quotepencil. This includes anyone who sends us a job to see a sample quote.
Group 1: builders we contact
What we hold
- Your company's name, number and trading address.
- Your first and last name, and your role, as a director.
- The email address your firm publishes on its own website. This may be a named address or a general one.
- Your replies, any request to stop, and notes on our conversation.
Where it comes from
- Companies House. Company details come from the public Companies House register. A director's name comes from the Companies House officers register.
- Your firm's own website. We take the email address and trading address your firm shows on its own site. We find the site with an ordinary web search. We never use directories such as FMB, TrustMark or Checkatrade.
- You. Anything you tell us when you reply.
What we never collect
- Home addresses
- Dates of birth
- Personal mobile numbers
- Guessed email addresses
- Data from email-finder tools
We only look up a director's name for firms we have chosen to contact, in the week before we contact them.
How we contact you
We send one email. We may send one follow-up email 7 to 10 days later. Then we stop. We do not phone you and we do not message you on LinkedIn.
We only email private limited companies. We never email sole traders or partnerships.
We may sometimes write to you by post instead of email.
Why we use it, and our lawful basis
We want to tell building firms about a service that helps them write quotes. That is a business offer, sent to a business.
Our lawful basis is legitimate interests. This means we have a fair business reason, and we have checked that it does not override your rights. We weighed it up like this:
- You would expect it. Company directors are listed on a public register partly so people can contact the company. A business email about a business service is an ordinary approach.
- It is light. One email, at most one follow-up, then we stop.
- It is easy to say no. Every email tells you how to opt out. A stop request goes on our "do not contact" list the same day.
- It is about your business, not your private life. We use public facts about your firm. We do not build a profile of you.
- You are told. Our first email says who we are, where we got your details, and where to find this notice.
Group 2: builders who use or try Quotepencil
What we hold
- Your contact details and the messages you send us.
- Job notes you send us, and your prices or rates.
- If you become a customer, your price book and your past jobs.
How job notes are handled
You send us job notes by email.
Before any job note goes near an AI tool, we remove all names, addresses and contact details by hand. Then the note is processed by our AI provider, OpenRouter, to match the job to your own price list. Plain code, not the AI, works out every price and every sum.
After a demo, we delete the original notes you sent.
Please leave your customer's name and address out of anything you send us.
Quotepencil drafts quotes. It never sends anything to your customers. You check the quote and you send it.
If you become a customer
Before we take in any of your past jobs or price data, you sign processor terms with us. These set out how we handle your customers' details on your behalf.
Why we use it, and our lawful basis
We use your details to show you what Quotepencil does, and to run the service for you if you become a customer.
Our lawful basis is contract: you asked us to provide the service, and we need your job notes to do it (UK GDPR Article 6(1)(b)).
Who handles the data for us
These companies handle data on our behalf:
| Company | What it does |
|---|---|
| Airtable | Holds our list of firms and our "do not contact" list |
| Anthropic (Claude) | Helps build our list of firms and check their websites. Searches carry company names only, never a person's name |
| Apify | Runs some of the web searches we use to find building firms. Searches carry a building service and a town, never a person's name. Its stored search results are deleted after each run |
| OpenRouter | Processes job notes, after names and addresses are removed by hand |
| Stripe | Takes payments from customers |
| Google (Google Workspace) | Runs our email |
| Vercel | Hosts our website |
Companies House is where some of the data comes from. It does not handle data for us.
Data sent outside the UK
Some of the companies above are based in the US, or may store data there. When data goes outside the UK, it is protected by a safeguard that UK law allows.
| Company | Where | Safeguard |
|---|---|---|
| OpenRouter | US | UK Addendum to the EU standard contractual clauses |
| AI model companies that OpenRouter passes job notes to | Several countries, including the US | Their contracts with OpenRouter, which must protect data at least as well. Names and addresses are removed first |
| Google (Google Workspace) | US | UK Extension to the EU-US Data Privacy Framework |
| Vercel | US | UK International Data Transfer Agreement, and the UK Extension to the Data Privacy Framework |
| Airtable | US | UK Addendum to the EU standard contractual clauses |
| Anthropic (Claude) | US | UK Addendum to the EU standard contractual clauses |
| Apify | Czech Republic (EU), and may pass data to the US | The UK treats the EU as safe for data. UK Addendum for anything sent on |
| Stripe | US | UK Extension to the Data Privacy Framework, with the UK Addendum as a back-up |
To ask for a copy of any of these safeguards, email privacy@quotepencil.co.uk.
How long we keep it
| Data | How long |
|---|---|
| Name and email of someone who did not reply | 6 months after our last email, then deleted |
| Name of anyone we chose not to contact in the end | Deleted when we review that batch |
| A "do not contact" entry (company name, company number and date) | Kept, so we never contact the firm again |
| Someone who replies or becomes a customer | As long as the conversation or contract lasts, then under the customer terms |
| Original job notes sent for a demo | Deleted after the demo |
| Job notes and customer data from real jobs | 90 days after we send the quote, then deleted |
When someone asks us to stop, we delete their name and email. We only keep the company name and number, so we can make sure we never contact them again.
Your rights
You have the right to:
- Access: ask for a copy of the data we hold about you.
- Correction: ask us to fix anything that is wrong.
- Deletion: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Objection: object to us using your data. If you object to marketing, we stop.
To use any of these rights, email privacy@quotepencil.co.uk.
If you are unhappy with how we handle your data, you can complain to the ICO: ico.org.uk/make-a-complaint
How to opt out
You can stop hearing from us at any time:
- Reply STOP to any email from us, or
- Email hello@quotepencil.co.uk with STOP in the subject, or
- Write to us at 320 Firecrest Court, Warrington, WA1 1RG.
We add you to our "do not contact" list the same day.
Changes to this notice
This is version 1.0, November 2026. If we change this notice, we will update the version and date here.