Privacy Policy

Last updated November 1, 2026

This policy explains how Helios One Oy (business ID 3596623-5, Helsinki, Finland, "we") handles personal information in connection with QuotedPart: our website quotedpart.com, the QuotedPart app, the RFQ and quote pages that shops share with their customers, and the QuotedPart MCP server that AI assistants use to price parts (see AI assistants and MCP).

Who is responsible

• We are the controller for account and team details, billing, support and feedback, security logs, and the analytics we collect on our website, in the app and on shops' RFQ and quote pages.
• For personal data a shop puts into QuotedPart about its customers and contacts (RFQs, quotes, orders, customer records), the shop is the controller and we process it on the shop's behalf under the Data Processing Addendum. If you are a shop's customer and want to access or delete that data, contact the shop. We will help it respond.

What we collect

• Account details: name, email address, password (stored only as a secure hash), role, and your shop's name, address, phone, website and logo.
• Billing details: Stripe collects your card, billing name, address and any tax ID. We store your Stripe customer ID and subscription status, and never receive full card numbers.
• Shop content: CAD models, drawings, RFQ emails and attachments forwarded to your shop's address, quotes, prices, customer names and contact details, orders and purchase order documents.
• From shops' customers: when you submit an RFQ or accept a quote on a shop's page, your company, name, email, message, files, PO number and PO file, and when you open a quote link.
• Communications: emails to support and feedback sent from the app, including any screenshot you attach.
• Technical data: IP address, browser and device details, request logs and error reports, used for security and troubleshooting.
• Ad clicks: when you arrive from one of our Google search ads, the ad's click ID and whether you later start a trial. See Cookies below.
• Usage data, session replay and surveys: we use PostHog (EU cloud) on our website, in the app and on shops' RFQ and quote pages to record page views, clicks, performance, errors and session replays, and to show short surveys in the app. Replays capture what is shown on screen, everything typed into forms, including on shops' RFQ and quote pages, the browser console, and the page's network requests and responses. Passwords are masked, and secret quote and invite links and keys are redacted. Card details are entered on Stripe's pages and are not recorded. When you are signed in, this data and your survey answers are linked to your account ID, name, email and shop.
• AI logs: the text we send to our AI provider and its answers, such as RFQ email text and what was read from a drawing, with passwords and keys redacted. They are stored in PostHog and linked to the user and shop. File contents (PDF or image data) are not logged.

How we use AI

QuotedPart uses Anthropic's Claude API to read: drawings when they are added to a part (including drawings from RFQ pages and forwarded emails), RFQ emails forwarded to a shop's address and RFQ text pasted into the app, and quote PDFs and answers given during pricing setup. Our AI provider never receives ITAR vault parts. Anthropic processes this data as our service provider, does not use it to train its models, and keeps it only for a limited period under its commercial terms. We don't use your content to train AI models either. We review AI logs to measure and improve accuracy. AI output is a suggestion that the shop reviews; we don't make automated decisions about people.

AI assistants and MCP

You can price parts from an AI assistant such as ChatGPT, Claude, Codex or another MCP client through the QuotedPart MCP server (quotedpart.com/mcp), directly or with the QuotedPart plugin. This requires an existing QuotedPart account: the assistant sends you to quotedpart.com to sign in, and you allow the assistant on a consent screen. It then prices parts in your shop, as you, at your shop's own rates.

• Linking: when you allow an assistant, we give it an access token for your shop, valid for one hour, and a refresh token it uses to renew it. The link ends after 30 days without use. We store only hashes of these tokens, together with the link: the name the assistant registered with us, your account and shop, and when it was linked and last renewed. The tokens also stop working if you leave the shop or your role there can no longer create quotes.
• What the assistant learns about you: an identifier for your QuotedPart account that never changes and means nothing outside QuotedPart. If it asks for your email address (ChatGPT does), the consent screen says so, and the assistant then receives your account's email address and whether it is verified. ChatGPT uses its domain so that a company's ChatGPT Enterprise workspace can control which workspaces link accounts with the company's email addresses. Assistants don't get your name, password, or anything about the other people in your shop.
• What the server receives: the files the assistant sends for pricing (STEP, IGES, DXF or PDF, up to 40 MB each), sent inline, uploaded through a one-time upload link, or as a link that our server downloads (public internet addresses only), and the choices in each tool call, such as material, process and quantities. These are processed to price the part.
• What it doesn't receive: your account or identity at the assistant provider, or your conversation with the assistant. It receives only what the assistant puts into a tool call.
• What is stored: each estimate is saved as a quote in your shop, with its parts, the files and what was measured or read from them, like a quote made in the app. These quotes are shop content: you can change or delete them in the app, and they are kept and deleted with the rest of your shop's data (see How long we keep it). The quote link the assistant gets (quotedpart.com/assistant/quotes/…) opens the quote only for people signed in to your shop.
• A file uploaded through create_upload is held temporarily in Netlify Blobs. That temporary copy is deleted when estimate_price reads it, before pricing. An upload that is never used is deleted within about 40 minutes of being created. Files sent as a link or inline don't go through this temporary storage.
• PDF drawings are read with Anthropic's Claude API as described above, and these reads are part of the AI logs, linked to you and your shop.
• The assistant provider (for example OpenAI or Anthropic) receives the tool results, such as prices, the cost breakdown, your shop's materials and markup when the assistant asks for them, and the quote link, and handles them and your conversation under its own terms and privacy policy.
• Your IP address is used only in the server's memory, for two rate limits: on file uploads, and on registering new assistant apps for sign-in (estimates are limited per account). The MCP server never writes it to storage or logs. Netlify, our host, also applies its own per-address request limit and processes your IP address as it does for all traffic to our website.
• You can unlink an assistant at any time in QuotedPart under Integrations, AI assistants. Its tokens stop working at once, and the quotes it made stay in your shop. Removing QuotedPart in the assistant ends the link too if the assistant revokes its token with us; otherwise the link ends after 30 days without use.

Why we use it

For people in the EU, EEA and UK, the legal basis is shown in brackets.

• To provide QuotedPart, including sign-in, billing and support (contract).
• To process shop content on the shop's instructions (as processor under the DPA).
• To keep the service secure and prevent abuse (legitimate interests).
• To understand how QuotedPart is used, fix problems and improve accuracy, using analytics, session replay and AI logs (legitimate interests). You can object.
• To measure which of our search ads lead to trial sign-ups (legitimate interests; in the EEA, UK and Switzerland only with your consent to ad storage).
• To send service emails such as password resets, invites, trial reminders and billing notices (contract).
• To meet accounting, tax and other legal obligations (legal obligation).

We don't sell personal information and don't show ads in QuotedPart. We advertise on Google Search and measure which ads lead to sign-ups, as described under Cookies. If we send product news, every message lets you unsubscribe.

Who we share it with

• Service providers listed below, under contracts that limit their use of the data to providing their service to us.
• Services a shop chooses to connect, such as QuickBooks Online, Fulcrum and ProShop, at the shop's direction, and AI assistants you link to your account (see AI assistants and MCP).
• A shop's customers, who see the quotes and messages the shop sends them.
• Professional advisers, authorities when the law requires, and a successor in a merger or acquisition, who must keep protecting the data as this policy says.

Providers that process shop content and other personal data for us:

Providers for our own billing and ad measurement:

Cookies and similar technologies

The app stores your sign-in session in your browser; it is needed for the app to work. PostHog stores an identifier in a cookie and local storage to recognize repeat visits for analytics. You can block or clear them in your browser; blocking analytics doesn't affect how QuotedPart works.

Google Ads (as of September 26, 2026): when you arrive from one of our Google search ads, Google's tag (gtag.js) can store the ad's click ID in a first-party advertising cookie (_gcl_aw, Google's conversion linker), so that a trial sign-up afterwards is counted for that ad. We use it only to measure which ads lead to trial sign-ups, not to build profiles or show you ads. For visitors in the EEA, UK and Switzerland, Google Consent Mode keeps ad storage denied, so this cookie is not set there without consent. We also use Google Ads enhanced conversions: when you start a trial, your sign-up email is hashed (SHA-256) in your browser and the hash is shared with Google LLC, only with that trial sign-up and only outside the EEA, UK and Switzerland, so Google can attribute the sign-up to the ad you clicked. Google acts as our processor for this under the Google Ads Data Processing Terms. Otherwise Google processes this data under its own terms as described at policies.google.com/technologies/ads.

International transfers

We are based in Finland. The QuotedPart database and files are hosted in the United States (Convex on AWS us-east-1), and several providers are in the United States. Analytics data is stored in the EU. For personal data transferred from the EU, EEA, UK or Switzerland to the United States, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) where available, and otherwise on the European Commission's Standard Contractual Clauses.

How long we keep it

• Shop content and account data: while the shop exists. After a trial or subscription ends, the shop stays read-only so you can export your data or subscribe again. Quotes made through an AI assistant are shop content.
• We delete a shop and its data within 30 days of the owner's deletion request. We may also delete a shop that has been read-only for more than 12 months, after emailing the owner at least 30 days in advance. Guest demo shops may be deleted after 30 days without use. Quotes priced through an AI assistant before sign-in was required, and never moved into an account, are kept until you ask us to delete them: email touko@heliosone.fi with the quote link or quote ID.
• Links to AI assistants: until you unlink the assistant or it goes 30 days without use. We then delete the link and its token hashes.
• Deleting a quote or part removes it from the app. Its files are kept with the shop, because copied quotes share them, and are deleted with the shop.
• Session replays: up to 90 days. Other analytics events and AI logs: as long as they are useful for improving QuotedPart. When we delete a shop, we also delete the analytics data linked to it and its users.
• Billing and accounting records: as long as Finnish accounting law requires, generally 6 to 10 years.
• Support emails and feedback: as long as needed to handle them and improve the product.
• Deleted data can remain in our providers' backups for a limited period until it is overwritten.

Your rights

• You can ask us to access, correct, export or delete your personal information. Much of this is available in Account settings; otherwise email touko@heliosone.fi. We answer within one month.
• In the EU, EEA and UK you can also restrict or object to processing, including analytics based on legitimate interests, and complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local data protection authority.
• US residents have the rights their state law provides, such as the rights to know, access, correct and delete personal information. We don't sell or share personal information for targeted advertising, so there is nothing to opt out of. You can use an authorized agent, and we may need to verify your identity. If we decline a request, you can appeal by replying to our decision. We don't discriminate against anyone for using these rights.
• If your data is in a shop's content (for example an RFQ you sent a shop), contact that shop first.

Security

Data is encrypted in transit and at rest by our hosting providers. Each shop's data is kept separate by access checks on every request, passwords are stored as secure hashes, quote and invite links use long random tokens, and staff access is limited to what is needed to run the service. The files and technical data of ITAR vault parts are encrypted in the shop's browser before upload, and we hold only that ciphertext. If a breach affects your personal information, we will tell you without undue delay.

Children

QuotedPart is a business service and is not meant for anyone under 16. We don't knowingly collect their personal information.

Changes

We will post any update here with a new date, and email shop owners about material changes.

Contact

Helios One Oy, business ID 3596623-5, Helsinki, Finland. touko@heliosone.fi.