Privacy policy

We keep only what the workflow needs to produce a quotation and operate your account:

• Account data: name, email address and the business profile you enter.
• Commercial data: quotations, supplier and customer records, cost lines and calculated landed costs.
• Billing data: plan, subscription status and invoice references held by our payment processor.
• Operational data: notification logs and delivery status for the emails we send you.

Commercial data is processed to generate the quotations, comparisons and exports you request. Account and billing data are processed to provide access, enforce plan allowances, issue invoices and send transactional notices such as subscription confirmations, payment failures and usage warnings.

We do not sell your data, and we do not use your quotations or counterparties to train third-party models.

We rely on a small number of service providers, each limited to what the task requires: Stripe for payment processing and subscription billing, Resend for transactional email delivery, and Base44 for application hosting and data storage. Enterprise agreements can cover additional processors when required by your procurement review.

Quotations, suppliers and customers are private to the workspace that created them. Access follows the permissions configured in the application, and administrative access is restricted to the workspace owner and administrators.

Records stay available for as long as your account is active so your quotation history remains usable. You can delete individual quotations, suppliers and customers at any time, and you can request full account deletion by writing to contact@caafral.com. Billing records required for tax and accounting purposes may be retained by our payment processor independently.

You can request a copy of your data, correct inaccurate details, or ask for erasure of records we are not required to keep. Write to contact@caafral.com from the address on the account and we will respond with the next steps.

Access is authenticated and every request is authorised against the record's owner. Payment card details never reach our servers: card data is entered directly with Stripe, and only subscription identifiers and statuses are stored. Webhook events from Stripe are verified by signature before they can change a subscription, and paid access is granted only after a verified payment event.

Transactional email is delivered through Resend from notifications@caafral.com; replies go to contact@caafral.com.

The application uses the minimum browser storage needed to keep you signed in. It does not set advertising cookies or sell audience data to third parties.