What changed in version 1.6 (6 October 2026): we now name our service providers and where they process data (section 6), state how long conversations and records are kept and why (section 7), describe how we invite businesses to join as suppliers (section 9), and describe our automated decisions more fully (section 4).

1. Who We Are (Data Controller)

This Privacy Policy explains how we handle your personal data when you use QuotesDone, an online B2B anonymous quotation marketplace.

The data controller is:

• QuotesDone Technologies, a Dubai Sole Establishment
• DET Dubai Trader License No. 1633275
• Owner: Ahmad Mhd Nabil Alzain
• Address: Dubai, United Arab Emirates
• Email: management@quotesdone.com; Phone: +971 50 931 9355 (the number on our licence record is +971 56 791 8605)

We process personal data in accordance with the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (PDPL), and its implementing regime overseen by the UAE Data Office, which from June 2026 operates within the new UAE Federal Authority for Artificial Intelligence and Data. This policy applies to customers, suppliers and visitors. Where you act on behalf of a business, references to your personal data mean the personal data of the individuals concerned.

2. Personal Data We Collect

Depending on how you use the platform, we collect:

• Customer identity and contact data: your name, email address and mobile number, with the mobile number verified by one-time password (OTP).
• Request content: the job or request you submit as text, voice recordings, photographs or drawings, including any personal data you choose to include.
• Supplier data: business details and Know Your Customer (KYC) documents provided for vetting and onboarding.
• Payment data: a payment reference returned by our payment processor, Stripe. We do not store full card numbers; card and Apple Pay details are handled by Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS).
• Usage and technical data: logs, device and connection information, and records of platform activity.

We do not intentionally collect special categories of data. Please avoid including sensitive details in request content unless necessary.

3. Purposes and Lawful Bases

We process personal data for clear purposes, each supported by a lawful basis under the PDPL:

• To create and manage your account, verify your mobile by OTP, and provide the marketplace, including matching requests to suppliers and enabling paid reveals (performance of a contract).
• To calculate and collect the customer Reveal Fee of 3% of the quoted value at the point you choose to reveal a supplier, and to keep accounting records (performance of a contract and legal obligation). Suppliers pay no commission or success fee on jobs they win.
• To vet suppliers and verify KYC documents, prevent fraud and misuse, secure the platform and improve our services (legitimate interests).
• To share a chosen supplier's contact details on a paid reveal, and for optional marketing (your consent, which you may withdraw at any time).

Where we rely on legitimate interests, we balance these against your rights and interests.

4. Smart and Automated Processing

QuotesDone uses smart and automated tools to operate the marketplace. These tools:

• Structure and standardise the requests you submit (including converting voice, photos and drawings into a structured brief).
• Match each request to suppliers in the matching trade who are likely to be able to quote.
• Summarise requests and quotes to make them easier to compare.

Some decisions on the platform are made by automated systems, including software that uses large language models, without a person reviewing each case. They include matching and ranking suppliers, checking quotes against your specifications, and assessing refund requests and disputes under our published rules. You remain free to accept, reject or ignore any quote. If a decision made by automated means affects you, you may object to it and ask for it to be reconsidered by a person, by writing to management@quotesdone.com, as described in the Your Rights section. Automated outputs, including summaries and comparisons, can contain errors; please check the supplier's own quotation before relying on it.

5. How We Share Data

Anonymity is central to QuotesDone. We share personal data only as follows:

• Request content is shared with matched suppliers WITHOUT revealing your identity, so suppliers can prepare anonymised quotes.
• Your contact details are disclosed to a single supplier only after you pay the Reveal Fee and consent to the reveal for that chosen supplier; suppliers receive customer contact data only for jobs revealed to them.
• Our payment processor, Stripe, receives the data needed to take payment (card or Apple Pay) and returns a payment reference.
• Service providers process data on our behalf, under their terms and our instructions. They are named in section 6, with what they process and where.

We may also disclose data where required by UAE law, a court of competent authority, or to protect our legal rights. We do not sell personal data.

6. Service Providers and Cross-Border Transfers

Our platform is hosted outside the United Arab Emirates, and our service providers process personal data outside the UAE. They are:

• Supabase (database, file storage, sign-in and server functions): all platform data. Hosted in Singapore.
• Vercel (website hosting and delivery): website requests and technical data.
• OpenRouter and the model providers it routes to (such as Google and Anthropic): the text of requests, documents, quotes and messages that our automated tools read.
• Resend (email delivery) and Microsoft 365 (our company mailbox): email addresses and the content of emails we send and receive.
• Meta (WhatsApp Business Platform) and Twilio (text messages and verification codes): mobile numbers and message content.
• Stripe (payments): the data needed to take a payment.
• Dropbox (backup copies of records and documents): copies of platform records.
• Serper (web search): search queries about businesses, products and prices; these do not include your contact details.

Except where a location is stated above, these providers process data in the United States and in other countries where they operate. Where we transfer personal data outside the UAE, we apply the safeguards required by Articles 22 and 23 of the PDPL:

• We transfer data to countries the UAE Data Office recognises as providing an adequate level of protection; or
• Where adequacy is not established, we rely on appropriate safeguards such as contractual terms obliging the recipient to protect the data, or on the other grounds those Articles allow, including your explicit consent, in each case in a manner that does not conflict with the public and security interests of the State.

You may contact us for more information about the safeguards applied to a transfer.

7. Data Retention

We keep personal data only for as long as necessary for the purposes described above and to meet legal obligations. Article 3 of Cabinet Decision No. 74 of 2023 (the Executive Regulation of the Tax Procedures Law) requires records to be kept for five years from the end of the calendar year in which they were created, and our periods follow it:

• Account data: while your account is active, and for five years after its last activity.
• Conversations with us (emails, WhatsApp messages, and portal and website chat): while your account is active, and for five years after its last activity, and in any case for five years from the end of the calendar year in which the message was written. The message text and its archived copy are then deleted.
• Requests and their records (request details, drawings, bills of quantities, photographs, quotes and comparison reports): for at least five years from the end of the calendar year in which they were created.
• Transaction and financial records, including Reveal Fee records: for at least five years from the end of the calendar year in which they were created, or longer where the law requires.
• Supplier KYC documents: for the duration of the relationship and five years after it ends.
• Records connected with an open dispute, refund, complaint or unpaid amount: until the matter is closed, even where a period above has ended.
• An unfinished sign-up (an account whose email, mobile verification or acceptance of the terms was not completed within 30 minutes): deleted in full after 30 minutes, with nothing sent to it.
• Backup copies of our database: 30 days of daily copies and one copy for each of the last 12 months.
• Security and audit logs: for limited periods.

When a retention period ends, we securely delete or irreversibly anonymise the data.

8. Your Rights Under the PDPL

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Access your personal data and obtain information about how it is processed.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data where the legal grounds apply.
• Object to, or request restriction of, certain processing, including processing based on legitimate interests and certain automated processing.
• Request that your personal data be provided to you, or transferred to another controller, in a structured, commonly used, machine-readable format (data portability), where technically feasible.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any right, contact us at management@quotesdone.com. We will respond within the timeframes required by the PDPL. If you are not satisfied, you may lodge a complaint with the UAE Data Office.

9. Electronic Marketing and Communications

We send transactional messages you need to use the service — for example mobile one-time passwords (OTP), request and quote notifications, and account or payment confirmations — on the basis of our contract with you; these are not marketing.

We send marketing or promotional messages by email, SMS or other electronic means only where you have given consent, and you can withdraw consent or unsubscribe at any time using the link or instructions in the message, or by emailing management@quotesdone.com.

Invitations to businesses. We invite businesses in the UAE to list as suppliers on QuotesDone. For this we use business contact details that the business itself has published, for example on its website or in a public business directory: the company name, its trade, and its published business email address. We rely on our legitimate interest in offering a business service to another business. We send one invitation and up to three reminders, by email, during working hours. Every message identifies QuotesDone and contains a one-click unsubscribe link, and an unsubscribe stops every further message at once and permanently. We use this data for nothing else and we do not sell it. You may ask us at any time what we hold and where we obtained it, or ask us to delete it; we then keep only the record of your opt-out, so that we do not contact you again.

We handle electronic communications in line with the UAE telecommunications and electronic-marketing rules overseen by the Telecommunications and Digital Government Regulatory Authority (TDRA) and the Electronic Transactions and Trust Services Law (Federal Decree-Law No. 46 of 2021). We do not sell your contact details for third-party marketing.

10. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, consistent with the PDPL and the Electronic Transactions and Trust Services Law, Federal Decree-Law No. 46 of 2021.

• Access to personal data is restricted to authorised personnel on a need-to-know basis.
• We use encryption in transit, OTP verification for customer mobile numbers, and segregation of anonymised request content from identity data.
• Payment card data is handled by Stripe, our PCI DSS–certified payment processor, and is not stored by us.

No system can be guaranteed to be completely secure. If a personal data breach occurs that meets the legal threshold, we will notify the UAE Data Office and affected individuals as required by the PDPL.

11. Children, Changes and Contact

QuotesDone is a business-to-business platform intended for users aged 18 and over. It is not directed at minors, and we do not knowingly collect personal data from children. If you believe a minor has provided us data, please contact us so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our services or the law. The current version is always available on our platform, and material changes will be notified where appropriate.

For any privacy question, to exercise your rights, or to reach our data protection contact, please use:

• Email: management@quotesdone.com
• Phone: +971 50 931 9355 (licence record: +971 56 791 8605)
• Post: QuotesDone Technologies, Dubai, United Arab Emirates (our DET Trader License is for an online business with no shop front, so there is no street address)

This policy is governed by the laws of the UAE, and disputes are subject to the courts of Dubai.