Kwowta is a quote and invoice management application for trades businesses. This policy explains what personal data we collect, why we collect it, and your rights in relation to it. We are committed to processing your data lawfully and transparently.
01
Who we are
Kwowta is operated by MJL Consult Global Ltd, a company registered in England and Wales (Company No. 16310532), with registered address at Horley Green House, Horley Green, Huddersfield, HX11 3AS, United Kingdom.
For the purposes of UK GDPR and the Data Protection Act 2018, MJL Consult Global Ltd is the data controller for personal data processed through the Kwowta application and website.
Contact: [email protected]
02
Data we collect
Account and company data
- Name, email address, and phone number
- Company name, registration number, address (registered and trading)
- VAT or tax registration number (if applicable)
- Banking details (sort code, account number, IBAN, BIC/SWIFT — used solely for displaying on quotes and invoices)
- Company logo and brand colour
- Subscription tier and billing history
Quote and invoice data
- Customer names, email addresses, phone numbers, and addresses
- Quote and invoice content (line items, prices, materials, labour rates)
- Digital signatures collected during quote approval
- File attachments uploaded to quotes
- Payment records
Usage and technical data
- Login timestamps and device type
- App version and operating system
- Error logs (anonymised where possible)
Security data
- Password (stored as a one-way bcrypt hash — we cannot recover it)
- Security question answers (stored as hashes)
- Password reset tokens (short-lived, cleared on use)
03
How we use your data
- Providing the service: Creating, storing, and delivering quotes and invoices to your customers
- Account management: Login, password reset, user invitations, and permission management
- Billing: Managing your subscription, processing payments via Google Play or the App Store
- Communications: Sending quote and invoice emails on your behalf, transactional emails (password resets, invitation emails)
- Security: Detecting fraud, protecting accounts, and enforcing our terms
- Legal obligations: Retaining records as required by applicable law
- Anonymised analysis and service improvement: We may aggregate and anonymise usage data (for example, average quote values by trade, regional pricing trends, most-used features) to improve the app and to produce market insights. This analysis cannot be used to identify you or any individual customer
We do not use your identifiable personal data for advertising, sell your data to third parties, or use your personal data to train AI models.
04
Legal basis for processing
- Contract performance: Processing necessary to deliver the Kwowta service you have signed up for
- Legitimate interests: Security monitoring, fraud prevention, service improvement
- Legal obligation: Retaining financial records as required by HMRC and applicable accounting regulations
- Consent: Where we ask for your explicit consent (e.g. marketing communications, if we introduce them in the future)
05
Sharing your data
We share your data only where necessary:
- Your customers: Quote and invoice content is shared with your customers via email and the quote approval page
- Infrastructure providers: Hostinger (web hosting, EU/UK data centres) — bound by data processing agreements
- Email delivery: SMTP via Hostinger — email content passes through their servers in transit
- Google Play / Apple App Store: Subscription purchase and verification data — governed by their respective privacy policies
- Law enforcement: Where we are legally required to disclose data
We do not share your data with advertisers, data brokers, or analytics platforms.
06
Data retention
- Active accounts: Data is retained for as long as your account is active
- Deleted accounts: Personal identifiers (name, email, phone) are anonymised immediately on deletion. Anonymised quote and invoice records are retained for up to 6 years for legal and accounting compliance, then permanently deleted
- Security tokens: Password reset tokens expire after 1 hour. Invitation tokens expire after 7 days
- Backups: Encrypted backups may retain data for up to 30 days after deletion
07
Your rights
Under UK GDPR, you have the following rights:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate data (you can update most data directly in the app)
- Erasure: Request deletion of your personal data (see Account Deletion below)
- Restriction: Ask us to restrict processing of your data in certain circumstances
- Portability: Receive your data in a structured, machine-readable format
- Objection: Object to processing based on legitimate interests
To exercise any of these rights, email [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Data portability: You may request a machine-readable export of your personal data at any time by emailing
[email protected]. We will respond within 30 days.
07b
Anonymised and aggregated data
We may derive anonymised, aggregated insights from the way Kwowta is used — for example, trends in quote values by trade sector, regional pricing patterns, common material combinations, or feature adoption rates. This data is stripped of all personal identifiers before analysis and cannot be reverse-engineered to identify you, your business, or any of your customers.
We use such anonymised insights to:
- Improve the Kwowta product and prioritise new features
- Publish industry market data and reports (for example, average quoting rates by trade in a region)
- Understand how the service is being used across different sectors
Because this data contains no personal information, it falls outside the scope of data subject rights (such as the right to erasure). If you have questions about what anonymised data may be derived from your usage, contact us at [email protected].
08
Account deletion
You can delete your account at any time from within the app: Manage Company → Delete My Account. You will be asked to confirm with your password.
On deletion, your personal data (name, email, phone) is immediately anonymised. If you cannot access the app, email [email protected] and we will process the deletion within 5 business days.
Full details: kwowta.com/account-deletion
09
Security
- All data is transmitted over HTTPS/TLS
- Passwords are stored as bcrypt hashes — we cannot read them
- API endpoints require authentication to read or write company data
- Quote approval links use cryptographic HMAC tokens
- Banking details are visible only to authorised users in your company
If you discover a security vulnerability, please disclose it responsibly to [email protected].
10
Children
Kwowta is a business tool intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has registered an account, please contact us immediately.
11
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or by email. Continued use of Kwowta after changes take effect constitutes acceptance of the revised policy.
The current version is always available at kwowta.com/privacy.