Privacy Policy

Quill is the data controller for the information described here.

Questions about this policy or a privacy request can go to hello@quill.tc. We reply within one business day.

Depending on what you do on our site, we may collect:

• Information you give us directly: first name, last name, email address, phone number, brokerage or team name, approximate transaction volume, and the timing of your next expected transaction. We collect this when you submit the intake form or book a meeting with us.
• Transaction documents you forward to us: executed contracts, disclosures, party contact information, and related paperwork you send so we can coordinate your transaction.
• Information collected automatically: IP address, device information, browser information, operating system, language, session information, page views, referral source, and basic interaction events. Some of this is needed to deliver the site and keep it secure; some is used in aggregate by Google Analytics 4 to tell us which pages and content are resonating (see the Google Analytics 4 section below).

The contact fields on the intake form are required for us to respond to you. Everything else is optional, and choosing not to provide it won't prevent you from browsing the site.

If you're not sure which data is required, email us at hello@quill.tc and we'll tell you.

You're responsible for any third-party personal data you submit to Quill (for example, your client's contact information on a contract). You should have the authority to share that data with us.

How we process it

We use appropriate security measures to keep your data safe from unauthorized access, disclosure, modification, or destruction. Data is processed using computers and standard IT tools, following procedures tied to the purposes listed below. Only people who need access to do their job have it: administration, transaction coordination, legal, and system administration on our side, plus the third-party service providers listed in the next section. We can share the current list of providers on request.

Where it's processed

Your data is processed in the United States, where Quill and our service providers operate. Depending on where you are, using the site may involve transferring your data to a country other than your own. See the next section for the specific place of processing for each service we use.

How long we keep it

We keep personal data only as long as it's needed for the purpose it was collected for, or longer if we're required to by law or you've given consent for extended retention. Once the retention period ends, we delete the data.

We collect and process your data to:

• Provide transaction coordination to you
• Respond to your inquiries and schedule meetings
• Comply with our legal obligations
• Protect our rights and the rights of our users and third parties
• Detect and prevent fraud or abuse of the site

The next section lists every third-party service we use and exactly what data each one processes.

Quill uses a small set of third-party services to run the site. Each one, what it does, and what data it sees:

Calendly (Calendly, LLC)

We use Calendly to schedule meetings with prospective and active customers. When you book a call, Calendly collects the information you submit (typically first name, last name, and email address) plus technical information it needs to run the booking flow.

Personal data processed: first name, last name, email address, trackers, usage data.

Place of processing: United States.

Supabase (Supabase, Inc.)

We use Supabase for hosting, authentication, and database. It's where your account information, intake form submissions, and transaction records are stored so we can deliver the service.

Personal data processed: first name, last name, email address, phone number, brokerage or team name, answers to intake questions, and additional data necessary to provide the service.

Place of processing: United States.

Vercel (Vercel, Inc.)

Vercel hosts the site and serves our pages and static assets to your browser.

Personal data processed: IP address, usage data, and additional technical data as specified in Vercel's privacy policy.

Place of processing: United States.

Google Analytics 4 (Google LLC)

We use Google Analytics 4 to understand how visitors find and use the site. It tells us which pages are visited, where visitors come from, what device and browser they use, and their approximate country. We use that aggregate information to decide which pages need work and which content is resonating.

Personal data processed: IP address (anonymized by default in GA4), device and browser information, approximate geographic location, page URLs visited, referral source, and basic interaction events (page views, clicks, session duration). Google may set the _ga and _ga_* cookies in your browser to distinguish unique visitors and sessions.

Place of processing: United States.

We don't combine GA4 data with any advertising network, don't use GA4 for retargeting, and don't sell or share this data with third parties beyond Google's role as our processor.

What we don't do

As of the last-updated date on this page, Quill doesn't run advertising pixels (no Meta Pixel, no Google Ads conversion tracking, no LinkedIn Insight Tag), doesn't sell or share your personal information for cross-context behavioral advertising, and doesn't run behavioral profiling or session-replay tools (like HubSpot, Hotjar, FullStory, or Salesforce Marketing Cloud). If we add any of those in the future, this policy will be updated before collection begins.

Quill uses two categories of cookies and trackers:

• Strictly necessary: authentication session tokens and security cookies set by our hosting and backend infrastructure. These are required to run the site and can't be switched off.
• Analytics: Google Analytics 4 sets the _ga and _ga_* cookies to distinguish unique visitors and sessions. These cookies support the aggregate-traffic reporting described in the Google Analytics 4 section above.

We don't set marketing, advertising, or cross-site tracking cookies. If that changes, we'll update this policy and collect consent where the law requires it before setting any new trackers.

Under the GDPR, we can process your personal data on any of these bases:

• You've given consent for one or more specific purposes.
• The processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract.
• The processing is necessary to comply with a legal obligation we're subject to.
• The processing is necessary for our legitimate interests or those of a third party, and those interests aren't overridden by your rights.

We're happy to clarify which legal basis applies in your specific case. Email hello@quill.tc.

Data collected to perform a contract with you is kept until the contract is fully performed. Data collected for our legitimate interests is kept as long as needed to fulfill that purpose. We can keep data longer if you've given us consent or if the law requires it.

Once the retention period is over, we delete the data. After that point, we can no longer honor access, rectification, erasure, or portability requests for that data.

If the GDPR applies to you, you have the right to:

• Withdraw consent at any time, if we're processing your data based on consent.
• Object to processing when we're relying on a legal basis other than consent.
• Access your data to learn whether we're processing it, get details about the processing, and receive a copy of the data itself.
• Correct inaccurate data or complete incomplete data we hold about you.
• Restrict processing of your data.
• Have your data deleted in the circumstances the law allows for.
• Receive and port your data to another controller in a structured, commonly used, machine-readable format.
• Lodge a complaint with your competent data protection authority.

To exercise any of these rights, email hello@quill.tc. There's no fee, and we'll respond within one month.

This section applies if you reside in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or Montana. These states grant you additional rights beyond the GDPR section above.

Notice at collection

In the past twelve months, we've collected the following categories of personal information:

Identifiers: first name, last name, email address, phone number, IP address, device information, browser information, operating system, language, session information. Purposes: account registration and authentication, user database management, hosting and backend infrastructure, scheduling meetings, aggregate traffic analytics. Retention: as long as necessary to fulfill the purpose. Sold or shared: no. Targeted advertising: no. Third parties: Supabase, Inc.; Vercel, Inc.; Calendly, LLC; Google LLC.

Internet or electronic network activity: trackers strictly necessary for authentication and service delivery, analytics trackers, usage data, page views, referral source, and interactions with the intake form and booking widget. Purposes: hosting and backend infrastructure, account authentication, scheduling meetings, aggregate traffic analytics. Retention: as long as necessary to fulfill the purpose. Sold or shared: no. Targeted advertising: no. Third parties: Supabase, Inc.; Vercel, Inc.; Calendly, LLC; Google LLC.

Commercial information: brokerage or team name, approximate transaction volume, timing of your next expected transaction, and answers to intake form questions. Purposes: user database management, managing contacts and sending messages. Retention: as long as necessary to fulfill the purpose. Sold or shared: no. Targeted advertising: no. Third parties: Supabase, Inc.

Where does this information come from?

We collect the categories above directly from you (when you submit the intake form or book a meeting) and indirectly from your interactions with the site as you navigate it.

Your rights under U.S. state laws

To the extent state law grants them, you have:

• The right to access your personal information (the right to know).
• The right to correct inaccurate personal information.
• The right to request deletion of your personal information.
• The right to a copy of your personal information.
• The right to opt out of the sale or sharing of your personal information. (We don't sell or share it.)
• The right to opt out of targeted advertising. (We don't engage in it.)
• The right not to be discriminated against for exercising any of these rights.

How to exercise these rights

Email hello@quill.tc. We'll need to verify your identity before we respond, so that we only share your personal information with you. You don't need to create an account with us to submit a request.

If you'd rather signal an opt-out through a browser-level privacy control like Global Privacy Control (GPC), we honor that signal automatically.

Legal action

We may use your personal data for legal purposes in court or in the stages leading to legal action arising from improper use of the site or the services. We may also be required to disclose personal data at the request of a public authority.

System logs

For operations and maintenance, we and our third-party services may collect log files that record interactions with the site. Logs can include IP addresses and other technical identifiers.

Questions we haven't answered

If something about our data practices isn't covered here, email hello@quill.tc and we'll get back to you.

Changes to this policy

We can update this policy at any time by posting a new version on this page and, where technically and legally feasible, notifying you through the contact details you shared with us. It's a good idea to check this page periodically. The last-updated date at the top tells you when the current version took effect.

If the changes affect processing we do based on your consent, we'll collect fresh consent where the law requires it.

Personal Data (or Data) / Personal Information

Any information that directly, indirectly, or in connection with other information (including a personal identification number) allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through the site or through third-party services we use. Can include IP addresses, URI addresses, time of request, method used to submit the request to the server, size of the file received in response, numerical codes indicating server response status, country of origin, browser and operating system features, time per visit, and the path followed within the site.

User

The individual using the site who, unless otherwise specified, is the Data Subject.

Data Controller

The natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of Personal Data. Quill is the Data Controller for the personal data described in this policy.

Sale

Any exchange of personal information to a third party for monetary or other valuable consideration, as defined by applicable U.S. state privacy law. Exchanging personal information with a service provider under a written contract that meets applicable law isn't a Sale.

Sharing

Disclosing, disseminating, making available, transferring, or otherwise communicating personal information to a third party for cross-context behavioral advertising, as defined by California privacy laws.

Targeted Advertising

Displaying advertisements to a consumer where the advertisement is selected based on personal information obtained from that consumer's activities over time and across unaffiliated websites or applications to predict their preferences or interests, as defined by applicable U.S. state privacy law.

Cookie

A Tracker consisting of a small set of data stored in your browser.

Tracker

Any technology (including cookies, unique identifiers, web beacons, embedded scripts, e-tags, and fingerprinting) that lets a service track users, typically by accessing or storing information on the user's device.