Privacy Policy

01Our approach

We collect the account and contact information needed to serve you, and nothing we do not need.

We do not sell your data to any third party, and we do not use it for advertising.

02Data controller

QuotationsHub (the "Controller") operates the procurement platform at quotationshub.com. For privacy questions or to exercise your rights, contact privacy@quotationshub.com.

03What we collect

• Account data: name, work email, hashed password, MFA factors.
• Business data: company name, CR number, Nitaqat category, VAT ID, supplier and buyer contacts.
• Procurement data: RFQs, quotes, awards, contracts, work orders, messages, uploaded documents.
• Technical data: IP address, user-agent, timestamps, audit-log events, security alerts.
• Supplier portal data: hashed magic-link tokens, one-time codes, submission timestamps.

04Why we process it (legal bases)

• To provide and secure the Service (contract performance).
• To comply with tax, ZATCA, and record-keeping obligations (legal obligation).
• To detect fraud, abuse, and unauthorized access (legitimate interest).
• To communicate service updates and respond to support requests (consent / contract).

05Sub-processors

We use the following sub-processors to operate the Service. They are bound by data-processing agreements and process personal data only on our instructions.

• Lovable (application hosting, edge routing) — EU/US regions.
• Supabase (managed PostgreSQL, authentication, storage) — EU region.
• Mailgun via Lovable Emails (transactional email delivery) — EU region.

06Cross-border transfers

Data may be processed outside the Kingdom of Saudi Arabia in the sub-processor regions above, using contractual safeguards consistent with PDPL Article 29.

07Retention

• Audit logs and security alerts: 12 months (automated purge).
• Account and RFQ records: retained while your account is active, plus 30 days.
• Tax-relevant records (invoices, awards): retained for the period required by KSA law.
• Supplier portal tokens: expire and are deleted after the RFQ closes.

08Security

We keep your data under strict security standards and access it only when necessary: TLS in transit, encryption at rest, row-level security in the database, hashed and rotated supplier tokens, rate limiting, MFA (mandatory for admins), leaked password checks, and content-security policies. Full details available on request.

09Your rights (PDPL)

To exercise any right, email privacy@quotationshub.com. We respond within 30 days.

• Right to be informed how your data is processed.
• Right of access to your personal data.
• Right to request correction of inaccurate data.
• Right to request deletion, subject to legal retention obligations.
• Right to withdraw consent where processing is based on consent.
• Right to lodge a complaint with the Saudi Data & AI Authority (SDAIA).

10Cookies and local storage

We use only strictly necessary session storage for authentication and language preference. No advertising or third-party tracking cookies are set.

11Children

The Service is not directed to individuals under 18.

12Changes

Material changes to this policy will be communicated by email or in-app notice at least 14 days before taking effect.

13Contact

Privacy questions: privacy@quotationshub.com. General enquiries: info@quotationshub.com.