Privacy Policy
This document is provided in English, which is the binding version.
This policy explains what personal data QuoteGate AI processes, why, and what rights you have. It applies to quotegateai.com, our API and MCP endpoints, and the emails our agent sends and receives.
Who we are
QuoteGate AI, Haifa, Israel. Contact for privacy questions: hello@quotegateai.com.
QuoteGate AI sells to businesses. We act in two roles:
- Controller for data about visitors of our website, people who request an audit or a pilot, our customers' account contacts, and business contacts we write to.
- Processor for the data our agent handles for a customer (the "supplier"): price requests from the supplier's buyers, buyer company details, quotes, deals and orders. For that data the supplier is the controller, and our Data Processing Addendum applies.
What we collect and why
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Request metadata: IP address, browser, pages, time | Your browser, when you visit the site or call the API | Run and secure the service, block abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
| Language preference | Stored in your own browser (localStorage), only when you choose a language | Show the site in your language | Strictly necessary for a function you asked for |
| Domain and optional work email | The free audit form | Run the audit, send the report if you asked for it | Your request (Art. 6(1)(b)); legitimate interest |
| Name, work email, company, role, message | The pilot and contact forms | Answer you and prepare an offer | Steps before a contract (Art. 6(1)(b)) |
| Account contacts, billing details | Customers, when they buy | Provide the service, invoice, keep accounts | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Business contact details (name, role, work email) published by companies | Public company websites | Offer our service to suppliers, one message with an easy opt-out | Legitimate interest (Art. 6(1)(f)) |
| Buyer requests, buyer company details, deal history | Buyers and their agents, on behalf of a supplier | Answer price requests, check the buyer's company, send orders to the supplier's ERP | Processing on the supplier's instructions (Art. 28 GDPR) |
We do not sell personal data, do not use it for advertising, and do not use customer or buyer data to train AI models.
Cookies and tracking
The site sets no cookies, uses no analytics or advertising trackers, and loads no third-party scripts or fonts. The only thing stored in your browser is your language choice.
Automated decisions
Our agent answers price requests automatically, inside rules the supplier sets: list prices, discount limits and a floor price. Discounts past the limit, doubtful buyer checks and anything the supplier chose to review go to a person. Prices are calculated by those rules, not chosen by an AI model. A buyer can always ask for a person by writing to the supplier directly. See How we use AI.
Who receives data
Only the service providers listed on our Subprocessors page, each under a contract that limits use to providing the service, and the supplier a buyer contacted. We disclose data to authorities only when the law requires it.
International transfers
We are based in Israel, which the European Commission recognises as providing adequate protection. Our database is in the EU. Where a provider processes data in the USA, the transfer is covered by EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
How long we keep data
| Data | Kept for |
|---|---|
| Request logs | Up to 30 days |
| Audit results and lead form submissions | 24 months after the last contact, or until you ask us to delete them |
| Customer account and billing records | For the contract, then as long as tax law requires (in Israel, 7 years) |
| Data processed for a supplier | For the contract; deleted or returned within 30 days after it ends |
| Deal audit log | For the contract; it is hash-chained, so single entries are not edited, only the whole log is deleted |
Your rights
You can ask us for access to your data, a copy, correction, deletion, restriction, or to stop processing based on legitimate interest, including any marketing message. Write to hello@quotegateai.com. We answer within 30 days. If your data was processed for a supplier, we pass your request to that supplier and help them answer it.
You can also complain to a data protection authority: in Israel, the Privacy Protection Authority (gov.il/en/departments/the_privacy_protection_authority); in the EU, the authority in your country.
Security
See Security: encryption in transit, access limited to staff who need it, a database closed to public access, and a tamper-evident log of agent decisions.
Changes
We will post changes here and change the date below. Material changes for customers are announced by email 30 days in advance.
Last updated: 5 November 2026.