Controller

The controller responsible for processing personal data on this website is Quote 10X, Kurfürstendamm 11, 10719 Berlin, Germany. Email: [email protected], phone: +49 7274 729173. See also our legal notice.

A. This website: hosting, cookies and booking a call

This website uses no analytics or statistics cookies. With one exception, visiting it sends no data to advertising or analytics providers: on the page our Google ads lead to, we measure with your consent whether a visit from an ad leads to a sign-up (below, “Google Ads”). Fonts, images and videos are served from our own server, not from Google or other third parties. This section describes what the website actually does and supplements the general description of cookies in section 2 below.

Something is stored only if you confirm your region and language in the selector at the bottom of every page, or make a choice in the cookie banner on the ads page:

The language, region and consent entries never leave your browser. Without an explicit choice nothing is stored, and you see each page in the language you opened it in; only the homepage redirects by country, as described below. We show a cookie banner only on the ads page, because only that page runs a service that needs consent.

Google Ads. On the page our Google ads lead to (/en/trial, /de/trial), a banner asks for your consent. Only if you allow “Marketing” does the page load the Google tag of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It recognises from the click identifier in the address (gclid) that you came from one of our ads, keeps it in the cookies _gcl_au and _gcl_aw, and tells Google when you click a link to sign up. Google receives your IP address, the click identifier, browser and device information, and the page and time. Google also processes this data for its own purposes and under its own responsibility, including in the USA (Google LLC is certified under the EU-US Data Privacy Framework, adequacy decision under GDPR Art. 45). We use the measurement only to judge how well our ads work; personalised advertising and remarketing are switched off. The legal basis is your consent (GDPR Art. 6(1)(a); in Germany § 25(1) TDDDG). You can withdraw it at any time with “Cookie settings” at the bottom left of the page. More in Google’s privacy policy.

Hosting. This website is delivered by Cloudflare, Inc. (USA), acting as our processor. Cloudflare processes the connection data this requires, above all your IP address, to deliver the pages and protect them from attacks. It also derives from the IP address the country you are visiting from: visitors who open the homepage from Germany, Austria, Switzerland or Liechtenstein are sent to the German version. Nothing is stored and no profile is built for this. The legal basis is our legitimate interest in a secure website in the right language (GDPR Art. 6(1)(f)). Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, GDPR Art. 45).

Booking a call. “Book a 20-minute call” takes you to a Google Calendar booking page (Google Ireland Limited). You enter your name and email address there; we receive them with the appointment, and Google creates the Google Meet link for the call. We use them only to prepare and hold the call (GDPR Art. 6(1)(b)) and, if no contract follows, delete them within six months at the latest. On the booking page itself, Google’s privacy policy applies. Booking a call loads nothing from Google on our own pages.

B. Google user data

When you connect a Google account, Quote 10X accesses Google user data through Google APIs. Quote 10X’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features of Quote 10X — finding requests for quotation in your inbox, reading the drawings and requirements attached to them, and preparing quotes.
• We do not use Google user data for advertising, including retargeting, personalized or interest-based advertising.
• We do not sell Google user data. We transfer it to third parties only as necessary to provide or improve those features (for example, to our hosting and processing providers), to comply with applicable law, or as part of a merger, acquisition or sale of assets, with notice to you.
• We do not allow humans to read Google user data unless you have given us permission for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

You can revoke Quote 10X’s access at any time in your Google Account permissions. To have the data we already hold deleted, contact us as described in this notice.

C. AI processing and AI assistants

AI reading in Quote 10X. To turn incoming requests into quotes, Quote 10X uses the Claude API of Anthropic, PBC (USA) as a sub-processor. It classifies incoming emails that are not part of an existing request, and it reads request emails and the drawings attached to them. For this it receives the sender’s name and email address, the subject, the email text, attachment names and the drawing files. Anthropic processes this data only to return the result to us, and under its commercial terms it does not use it to train its models. A team admin can ask us to turn AI reading off for their team; nothing of that team’s is then sent to Anthropic.

Connecting an AI assistant (Claude connector). You can connect an AI assistant such as Anthropic’s Claude to your Quote 10X account through our connector at app.quote10x.com/mcp. When you do:

• You sign in with your Quote 10X account and choose a team. The assistant receives an access token for the permissions you approve, never your password.
• The assistant can read or change your team’s data only with the permissions of your role in that team, and only when it uses one of the connector’s tools on your behalf. Sending email to your customers, and actions that cannot be undone, are shown to you for approval first.
• What the connector returns to the assistant (for example requests for quotation, quotes, customer contacts and email text) is processed by the assistant’s provider under that provider’s terms and privacy policy; for Claude, see Anthropic’s privacy policy. We do not receive your conversations with the assistant, its memory or the files you keep there.
• Our servers log requests to the connector as they do for the rest of the Services (for example time, IP address and the requested address), for security and troubleshooting.
• You can disconnect the assistant at any time in its settings; it then loses access to your account.

D. Legal bases for processing

We process personal information on the following legal bases under the GDPR:

• Contract (Art. 6(1)(b) GDPR): setting up and managing your account, providing the Services, support, processing payments, and job applications.
• Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and business records as commercial and tax law requires.
• Legitimate interests (Art. 6(1)(f) GDPR): the security and stability of our systems (for example server logs and abuse detection), improving the Services, enforcing legal claims, and telling existing customers about our own similar services.
• Consent (Art. 6(1)(a) GDPR): the newsletter and any other processing for which we explicitly ask for your consent. You can withdraw your consent at any time with effect for the future.

E. Controller and processor

For your account data and our website we are the controller. The data that you and your team work with in Quote 10X – such as requests for quotation, drawings, quotes, customer contacts and emails – we process on behalf of your company, which is the controller of that data. For this we enter into a data processing agreement under Art. 28 GDPR with our customers, which you can request at [email protected].

F. How long we keep data

• Account data and your team’s content: as long as your account or your company exists with us. After deletion we remove the data from our systems within 30 days and from all backups within a further 21 days.
• Invoices and accounting records: 10 years (German Fiscal Code § 147 AO, Commercial Code § 257 HGB).
• Business letters and contract-related emails: 6 years (§ 257 HGB).
• Server logs: overwritten continuously, and kept longer only when a security incident requires it, for as long as the investigation needs.
• Job applications: 6 months after the application process ends, unless you agree to us keeping them longer.
• Newsletter: until you withdraw your consent.

G. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent you have given at any time (Art. 7(3)). An email to [email protected] is all it takes.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time, without giving reasons.

If your request concerns data we process on behalf of your company (section E), please contact your company; we will support it.

Right to lodge a complaint: you can complain to a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

H. Data protection officer

We are not required by law to appoint a data protection officer. Your contact for data protection is Quote 10X at [email protected].

I. Providing data and automated decisions

We need the information required for your account (for example your name and email address) to perform our contract with you; without it we cannot provide the Services. All other information is voluntary. We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR: the AI reading (section C) prepares requests, and you make the decisions.