Effective September 4, 2026 · MrQuote, operated by Holistic Business Consulting LLC
MrQuote is field service management software for trade contractors — quoting, measurement and takeoff, scheduling and dispatch, routing, e-signature, invoicing and payment collection. It is operated by Holistic Business Consulting LLC d/b/a MrQuote ("we", "us"). This policy covers the MrQuote web application, the mobile and desktop apps, the marketing site at https://mrquote.net, and the customer-facing portals, booking pages and e-signature pages we host on behalf of our customers.
MrQuote is sold to businesses. If you are a property owner who received a quote, invoice or signature request through MrQuote, the contractor who sent it is the controller of your information and we process it on their instructions. Direct requests about that data to the contractor; if you contact us instead, we will route your request to them.
If you connect Google Workspace, Microsoft 365, an accounting system or another integration, we receive data from it as described in sections 4 and 6. We also draw on public and licensed property data sources — parcel records, aerial imagery, elevation and flood data — to support measurement and takeoff. That property data is not tied to your Google account.
Connecting a Google account is optional; MrQuote works without it. When you do connect one, we request only the permissions listed below. We request no other Google scopes, and in particular we do not request permission to read, search or list your Gmail mailbox, and we do not request access to your Drive as a whole.
| Permission | Data it reaches | Why we need it |
|---|---|---|
| gmail.send | Permission to send mail as you. This scope grants no ability to read, search, or list your mailbox. | Sending quotes, invoices, appointment confirmations and e-signature requests from your own address, so replies reach your inbox rather than ours. |
| calendar / calendar.events | Your calendar list, and the events on the calendars you choose — titles, times, locations, attendees. | Showing installs and callbacks on the dispatch board, and writing scheduled jobs back to your calendar so a booking exists in one place. |
| drive.file | Only the individual Drive files this app creates, or that you explicitly pick with the Google file picker. It gives no access to the rest of your Drive. | Attaching specs, photos and generated PDFs to a job record, and saving documents MrQuote produces back to your Drive. |
| contacts / contacts.other.readonly | Contact records in your Google address book: names, email addresses, phone numbers, postal addresses, and organisation. | Matching a customer record to a contact you already have, and optionally writing new customers back to your address book so they exist outside MrQuote. |
| tasks | Your Google Tasks lists and task items. | Creating and completing job follow-ups without leaving the job record. |
We store the OAuth refresh token that keeps your connection alive, encrypted at rest with a key held outside the database. Short-lived access tokens are kept only until they expire. Beyond tokens we retain the minimum the feature needs: the calendar events shown on the dispatch board, the identifiers of Drive files attached to a job, and contact fields you have chosen to sync onto a customer record. We do not keep a copy of your mailbox, because we never have permission to read it.
We do not sell Google user data and do not transfer it to third parties for their own purposes. It is disclosed only to the infrastructure providers in section 8 acting on our instructions, to other members of your own MrQuote organisation as your administrator has configured, and where we are legally compelled.
Google data is encrypted in transit with TLS 1.2 or better, and at rest. Access is scoped per user and enforced by row-level security in the database, so one organisation cannot reach another's data. Refresh tokens are encrypted with a separate application key. Administrative access to production is limited to named personnel and requires multi-factor authentication.
Your connection and the data derived from it persist until you disconnect. You can disconnect inside MrQuote at any time, or revoke MrQuote's access directly from your Google account at myaccount.google.com/permissions. On disconnection we delete the stored refresh token immediately and purge cached Google content within 30 days. Data you deliberately copied into a MrQuote record — a customer's phone number synced from Contacts, for example — stays on that record, because it is now your own business record; you can delete it like any other field.
MrQuote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:
Where you connect Microsoft 365 instead of, or alongside, Google Workspace, the same commitments apply: we request the narrowest mail, calendar, files and contacts permissions the feature needs, store tokens encrypted, use the data only to provide the feature, never for advertising or model training, and delete tokens on disconnection. You can revoke access from your Microsoft account settings.
We use the information described above to operate MrQuote: to create and secure accounts, deliver the features you use, process subscription payments, send transactional and service messages, provide support, investigate abuse and fraud, measure and improve reliability and performance, and meet legal and tax obligations.
Where the GDPR or UK GDPR applies, we rely on: performance of a contract for operating the service and billing you; legitimate interests for security, abuse prevention and product reliability; consent for precise location, optional integrations and non-essential cookies, which you can withdraw at any time; and legal obligation for tax, accounting and lawful requests. For business records our customers upload about their own clients, our customer is the controller and we act as processor under our Data Processing Addendum.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose it only to service providers who process it on our instructions under contract, to other users in your own organisation as your administrator has configured, when you direct us to send it somewhere (for example, emailing a quote to your customer), where legally compelled, and to a successor entity in a merger or acquisition — in which case this policy continues to apply until superseded, and we will give notice before any material change.
| Provider | Purpose |
|---|---|
| Supabase | Application database, authentication, and file storage. |
| Cloudflare | Content delivery, DNS, TLS termination, and edge security. |
| Stripe | Payment processing. Card details go to Stripe directly and are never stored by us. |
| Google LLC | Workspace APIs and Maps/geocoding services, where you have connected them. |
| Microsoft Corporation | Microsoft 365 mail, calendar and file APIs, where you have connected them. |
| Transactional email provider | Delivery of platform email such as password resets and system notices. |
| AI model gateway | Optional AI assistance features, subject to the limits in section 9. |
Our current subprocessor list, including notice of changes, is published at /legal/subprocessors.
Some MrQuote features use AI models — for example drafting proposal copy, or interpreting aerial imagery during measurement. Where a feature sends content to a model, it sends only what that feature needs, through a gateway bound by contract to process it solely to return our result.
We do not permit your data to be used to train, fine-tune or improve any provider's general-purpose models, and we do not use it to train our own. Data from a connected Google or Microsoft account is excluded from AI features altogether. Where a document composed by an AI feature would otherwise contain customer identifiers, those are removed before the request leaves our infrastructure.
No system is perfectly secure, and we do not claim otherwise. To report a vulnerability, contact security@mrquote.net. We do not pursue legal action against good-faith security research that respects customer data and gives us reasonable time to remediate.
To request deletion, use the account settings in MrQuote or write to privacy@mrquote.net.
Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw a consent you previously gave, and — under US state privacy laws — to opt out of sale or of sharing for targeted advertising (we do neither) and to appeal a decision we make on your request. We will not discriminate against you for exercising any of these rights.
To exercise them, email privacy@mrquote.net from the address on your account, or tell us enough to locate your record. We respond within 30 days, or 45 days where US state law allows an extension, and will tell you if we need longer. We may need to verify your identity first. If we process your data on behalf of a contractor who uses MrQuote, we will forward your request to them. You may also authorise an agent to act for you and, in the EEA or UK, lodge a complaint with your local supervisory authority.
We operate from the United States and our infrastructure is hosted there, so information you give us is processed in the US. Where we receive personal information from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with technical measures including encryption in transit and at rest. You can request a copy of the relevant transfer terms from the privacy contact below.
We use a small number of first-party cookies and browser storage entries that are strictly necessary: keeping you signed in, remembering your organisation and interface preferences, protecting forms against cross-site request forgery, and caching data so the app works offline in the field. We use limited first-party analytics to understand reliability and feature use. We do not use third-party advertising or cross-site tracking cookies. You can clear or block cookies in your browser, but signing in will not work without the essential ones.
MrQuote is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
When we change this policy we update the effective date above. For changes that materially affect how we handle your information — and for any change to the Google permissions we request — we give notice in the app or by email before the change takes effect, and where the law requires it we ask for your consent rather than assuming it. Superseded versions are available on request.
Questions about this policy, or about your data:
Holistic Business Consulting LLC d/b/a MrQuote
Privacy: privacy@mrquote.net
Security: security@mrquote.net