Privacy Policy

1. Who we are

EdgeQuote ("EdgeQuote," "we," "us") is an instant-estimate and lead-capture service for trade contractors, operated by Sebastien Vautier (professionally known as Sebastien Ricci), a sole proprietor trading as Beyond the Edge Studio. Registered address: [PLACEHOLDER — registered business address]. Contact: sebastien@beyondtheedgestudio.com. The Service is published at edgequote.beyondtheedgestudio.com.

Three groups matter in this policy:

• Contractors — the trade businesses who hold an EdgeQuote account, configure an estimator, and receive the leads it produces.
• Homeowners — people who use a Contractor's estimator to get a price range and, if they choose, leave their contact details so that Contractor can follow up.
• Prospective contractors — people who ask us for a demo through our own marketing pages.

Roles. For Homeowner data, the Contractor is the data controller and EdgeQuote acts as a processor on their documented instructions. That relationship is governed by our Data Processing Addendum. For Contractor account data and for demo requests, EdgeQuote is the controller. This policy describes both, and says which is which in each section.

2. Information we collect

From Contractors (we are controller): account email address, role, the business details you enter (business name, logo, accent colour, currency, locale, service-area postal prefixes, notification email addresses and mobile numbers, reply-to address, sending domain), your price sheet and estimator configuration, your webhook destination and its shared secret, sign-in timestamps, and your session records (expiry, last-seen time, browser user-agent string, and a hashed IP address — never the raw address).

From Homeowners, on the Contractor's behalf (Contractor is controller): the name they give, and an email address, a phone number, or both; their answers to the Contractor's estimator questions and the plain-language summary of those answers frozen at submission; the estimate range calculated for them and its breakdown; the postal code or area they enter; their preferred contact time or requested appointment window; up to three job photographs they choose to upload; the page address the estimator was embedded on; a hashed IP address; and the timestamp and version of the consent wording they were shown. Notes the Contractor later adds to the lead, and the contract value if the job is won, are also stored on that record.

From prospective contractors (we are controller): name, business name, email address, optional phone number, and the trade selected, plus a hashed IP address.

Automatically: application and security logs, aggregated daily counts per Contractor (estimator views, sessions started, sessions completed, leads produced, total estimated value, and how many people answered each question), rate-limit counters, and records of abuse signals. The per-question and per-day counters are aggregate only: they hold no identifier for any individual and cannot be traced back to one.

Email deliverability. If a message we send on a Contractor's behalf bounces or is reported as spam, we record the recipient's email address on a suppression list with the reason, so we stop mailing an address that does not exist or does not want us. That list exists to protect recipients and our sending reputation.

What we deliberately do not collect. We do not store raw IP addresses anywhere; every IP is hashed before it is written. We do not collect payment card details of any kind. We do not collect government identifiers, health data, biometric data, precise geolocation, or data about racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation. We do not knowingly collect data from children.

3. Cookies and tracking

The estimator sets no cookies at all. It writes nothing to your browser's local or session storage, loads no analytics script, no advertising pixel, and no session-replay or heat-mapping tool, whether it is used on our domain or embedded in a Contractor's own website. The usage counts in Section 2 are produced on our server from the request itself and are aggregated per day; there is no per-visitor record, no visitor identifier, and no cross-site tracking.

The Contractor dashboard sets two strictly necessary cookies: eq_session, which keeps a signed-in user signed in, and eq_view_as, which records that an agency administrator is temporarily viewing a specific Contractor's account. Neither is used for advertising or analytics.

Because there is nothing to opt out of, we do not respond differently to "Do Not Track" or Global Privacy Control signals. This is set out in full in our Cookie and Tracking Statement.

4. How we use information

We use Contractor information to operate accounts, authenticate sign-in, publish and serve the estimator, deliver leads and notifications, produce the Contractor's own reports, provide support, prevent abuse, and meet legal obligations.

We process Homeowner information only to provide the Service as the Contractor has configured it: calculating and displaying the estimate range, emailing and, where enabled, texting the Contractor that a lead has arrived, sending the Homeowner a copy of their own estimate, delivering the lead to a webhook destination the Contractor has configured, displaying the lead and any photographs in the Contractor's dashboard, and exporting it when the Contractor asks. We also process it to detect and block abuse of the form.

We do not sell personal information, we do not share it for cross-context behavioural advertising, we do not use Homeowner data to market anything of our own, and we do not use it to train artificial-intelligence models. EdgeQuote has no AI features.

5. Legal bases (GDPR Art. 6)

Where the EU or UK GDPR applies, the bases are:

6. What Homeowners are told, and when

Before a Homeowner submits their details, the estimator displays: "By continuing you agree to be contacted by [the Contractor's business name] about this project." (in French: "En continuant, vous acceptez d'être contacté par [business] au sujet de ce projet."). We record when they agreed and which version of that wording they were shown, so the Contractor can demonstrate consent as GDPR Art. 7(1) requires rather than merely assert it. The current version identifier is 2026-08-23.v1.

That sentence alone is a contact permission, not a full Art. 13 notice. The complete point-of-collection notice for Homeowners is the Homeowner Privacy Notice, which must be linked from the estimator's contact step. See NOTES FOR YOUR LAWYER.

7. Sharing

We share information only with:

(a) Sub-processors needed to run the Service. The current list, with role and location, is at subprocessors.md and is published at edgequote.beyondtheedgestudio.com/legal/subprocessors. In summary: Vercel Inc. (application hosting), Neon Inc. (managed PostgreSQL database), Resend Inc. (transactional email), Twilio Inc. (SMS notifications to Contractors, where the Contractor enables them), and Cloudflare Inc. (Turnstile bot verification on public forms).

(b) The Contractor whose estimator the Homeowner used. That is the entire purpose of the Service.

(c) Destinations the Contractor connects. If a Contractor configures a webhook, lead data is sent to the address they specify. That transfer happens on the Contractor's instruction, to a destination we do not control, and the receiving service's own terms then apply. We verify the destination is a public HTTPS address and refuse internal or reserved network ranges, but we cannot vouch for what happens after delivery.

(d) Authorities, where we are legally required to disclose, and a successor if the business is sold, in which case this policy continues to apply until replaced with notice.

We do not otherwise disclose personal data, and we do not sell it.

8. International transfers

We operate from the United States and use US-based sub-processors. Where personal data of people in the EEA, the UK or Switzerland is transferred to us or to a sub-processor outside those areas, the transfer is made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), together with the supplementary measures described in Section 9. [PLACEHOLDER — confirm with each sub-processor that its current DPA incorporates the 2021 SCCs and the UK Addendum, and retain a copy.] See NOTES FOR YOUR LAWYER.

9. Retention

• Leads are erased 24 months after they are created. A Contractor may set a shorter or longer window on their own account; the permitted range is 1 to 84 months and it cannot be switched off. Erasure is carried out by a daily job whose runs are recorded, so a job that silently stops is detectable.
• Demo requests are erased 12 months after they are made.
• Job photographs uploaded but never attached to a submitted lead are purged within hours by the same daily job. Photographs attached to a lead are deleted with that lead.
• Sign-in tokens expire in 15 minutes and no more than three may be outstanding at once; expired tokens and sessions are purged automatically.
• Rate-limit counters and IP blocks expire on their own schedule and are swept daily.
• Consent records are kept with the lead they belong to and are erased with it.
• Aggregate daily counts hold no personal data and may be kept indefinitely.
• Suppression-list entries (bounced or complained addresses) are kept for as long as needed to avoid mailing that address again.
• Records needed for accounting, tax, or to establish or defend a legal claim are kept for as long as the applicable law requires.

10. Security

All transport is over TLS. IP addresses are hashed before storage and never written in raw form. Sign-in is by single-use magic link, rotated on redemption rather than on request, so a link intercepted in transit cannot be replayed after use. Sessions are server-side records that can be revoked. Webhook payloads are signed. Incoming provider webhooks are signature-verified before they are trusted. Public forms are protected by bot verification, per-address and per-network rate limits, and abuse recording. Uploaded images are checked against their actual file signature and re-encoded before storage. Access to Contractor data is scoped to that Contractor, and agency-administrator access is recorded. A security gate runs on every change to the codebase.

No method of transmission or storage is completely secure. If a personal-data breach occurs that is likely to result in a risk to affected people, we will notify affected Contractors without undue delay so that they, as controller, can meet their own notification duties, and we will notify supervisory authorities where we are required to do so directly.

11. Your rights

If the EU or UK GDPR applies to you you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. You may lodge a complaint with your national supervisory authority. In France that is the CNIL (cnil.fr).

If a US state privacy law applies to you (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana) you have the right to know what is collected and why, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of sale, of sharing for cross-context behavioural advertising, and of profiling with legal or similarly significant effects. We do none of those three things, so there is nothing to opt out of and no "Do Not Sell or Share My Personal Information" link is required. You may not be discriminated against for exercising a right.

How to exercise a right. Homeowners should contact the Contractor whose estimator they used, because that Contractor is the controller of their data; the Contractor can act on the request directly from their dashboard. If you cannot reach them, or you do not know which business it was, write to sebastien@beyondtheedgestudio.com and we will locate your records by email address or by phone number and act on them, or pass the request to the responsible Contractor and tell you we have done so.

We verify a request against the contact details already on the record and may ask for further reasonable verification. We respond within 30 days where the GDPR applies and within 45 days, extendable once with notice, where US state law applies. An authorised agent may act for you with written proof of authority. If we refuse a request you may appeal by replying with "Appeal" in the subject line; we answer appeals within the period your state's law sets, and you may also contact your state Attorney General.

We make no automated decisions producing legal or similarly significant effects about anyone. The estimate range is an arithmetic calculation from the Contractor's own published price sheet and the answers given. It is an indicative price range, not a decision about a person, not a credit assessment, and not a binding quotation.

12. California specifics (CCPA/CPRA)

In the last 12 months we collected the categories described in Section 2: identifiers (name, email address, phone number, hashed IP address); customer records (postal area, project answers); commercial information (estimate ranges, lead status, contract value where a Contractor records one); internet or network activity (service logs, aggregate usage counts); visual information (job photographs the Homeowner chooses to upload); and professional information (a Contractor's business details). They were sourced from you, from your device, and from the Contractor whose estimator you used, for the purposes in Section 4, and disclosed only to the sub-processors in Section 7.

We have not sold personal information and have not shared it for cross-context behavioural advertising in the preceding 12 months, and we do not do either now. We do not use sensitive personal information beyond what is necessary to provide the Service, and we draw no inferences about personal characteristics. Requests under Cal. Civ. Code §1798.83 ("Shine the Light") go to the address in Section 11.

13. Children

The Service is for businesses and for adult homeowners. It is not directed at children, we do not knowingly collect personal data from anyone under 16, and we have no feature that would identify a user's age. If you believe a child has given us data, write to us and we will delete it.

14. Changes

We will post a new "Last updated" date when this policy changes, and we will tell Contractors by email before a material change takes effect. If a change materially affects how Homeowner data is processed, the consent version identifier in Section 6 is incremented so that existing records still point at the wording that was actually shown at the time.

15. Contact

sebastien@beyondtheedgestudio.com. [PLACEHOLDER — postal address for formal notices.] We have not appointed an EU or UK representative under GDPR Art. 27; see NOTES FOR YOUR LAWYER.

---

NOTES FOR YOUR LAWYER

1. Art. 13 notice at the point of collection. As at 2026-09-02 the estimator shows one sentence of contact consent and does not link to any privacy notice. docs/legal/homeowner-notice.md is drafted to fill that gap, but it is not yet linked from the estimator's contact step and is not yet served at a public URL. Until it is, the Art. 13 / Art. 14 information duty is not discharged, and the consent recorded is evidence of a contact permission only. This is the single highest-priority item in this pack.
2. GDPR Art. 27 representative. The Service is offered in French, priced in euros, and aimed at French contractors, which is strong evidence of "targeting" the EU market under Art. 3(2). A controller or processor with no EU establishment that targets the EU must generally designate a written representative in an EU member state. None is designated. Confirm whether Art. 27 applies here and, if so, appoint one and name them in Section 15.
3. Controller/processor split. This pack treats the Contractor as controller of Homeowner data and EdgeQuote as processor. That is the honest description of how the product behaves, but EdgeQuote also determines the retention default, the security measures, the consent wording, and the suppression list. Confirm this is a processor relationship and not joint controllership under Art. 26. If it is joint, an Art. 26 arrangement and a public summary of it are required.
4. Standard Contractual Clauses. Section 8 asserts SCC coverage. Verify each sub-processor's current DPA actually incorporates the 2021 SCCs with the correct module and the UK Addendum, and keep executed copies. Do not leave this as an assertion.
5. Suppression list lawful basis. Retaining a bounced or complaining recipient's email address indefinitely is justified here as a legitimate interest in not re-mailing them, and it is the approach regulators generally expect. Confirm, and consider whether an erasure request should remove the entry (which would allow mail to resume) or keep it (which serves the person's own interest). The product currently keeps it.
6. Photographs. Homeowners upload photographs of their own property. Those may incidentally contain other people, vehicle plates, or documents. There is no automatic redaction. Consider whether the notice must warn against including other people.
7. Nevada governing law with EU users. Section 15 of the Terms selects Nevada law and a Clark County venue. Mandatory consumer-protection and data-protection rules in France and the EU cannot be displaced by that choice, and the GDPR applies regardless. Confirm the carve-outs are wide enough.
8. Blank facts. Registered business address and postal notice address are marked [PLACEHOLDER] and must be filled before publication.

WHAT THIS DOES NOT COVER

• The Contractor's own privacy policy. Each Contractor is a controller in their own right and needs their own notice; this document does not serve as one for them, and nothing here tells them what their own obligations are.
• Any obligation arising from how a Contractor uses lead data after we deliver it, including calling, texting, or emailing a Homeowner. Telephone and messaging consent rules (for example the US TCPA, state mini-TCPA statutes, and French rules on unsolicited commercial contact) apply to the Contractor, not to us.
• Employment, contractor, or supplier data of Beyond the Edge Studio.
• Any jurisdiction outside the US, the EEA, the UK and Switzerland.
• Sector-specific regimes. EdgeQuote is not designed for and must not be used to collect health, financial-account, biometric, or children's data.