Privacy Policy

QUAVA AI (“QUAVA”, “we”, “our”, or “us”) provides software that helps service businesses create, manage, send, and follow up on quotes and invoices.

QUAVA AI is operated by RB TECH LABS LTD (company number 17101213). RB TECH LABS LTD is the data controller for personal information processed as described in this policy.

This policy applies to visitors of quava.ai, people who join the launch list, and users of the QUAVA product.

Company particulars: Registered company: RB TECH LABS LTD. Company number: 17101213. Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF. Privacy questions can be sent to support@quava.ai.

You may provide information directly when you:

• join the launch list on our website
• create or sign in to a QUAVA account
• complete onboarding or update profile settings
• enter customer, quote, invoice, payment, or reminder details
• paste notes, messages, or voice-derived text for quote or invoice drafting
• contact us by email

Depending on how you use QUAVA, this may include your name, email address, password or OAuth credentials managed by our authentication provider, business name, branding details, payment preferences, delivery preferences, and related profile settings.

If you join the launch list, we collect your name, email address, and optional business name, plus technical attribution data such as UTM parameters or referrer where present.

QUAVA stores business records you create in the product for the Notes → Quote → Approval → Invoice → Follow-Up workflow. That may include customer contact details, job descriptions, line items, pricing, deposits, tax settings you configure, quote and invoice status, payment records, and related activity history.

You may submit free-text notes, pasted messages, or other job descriptions so QUAVA can help draft structured quotes or invoices. Where voice notes are used, audio may be transcribed to text and that text is used for generation and review.

That input is processed to generate suggested content for you to review before use. Generated drafts are assistive and should be checked before you send them to a customer.

Our systems and providers process technical information needed to operate and secure the service, such as authentication session data, request metadata, device or browser information, and product usage events related to quotes, invoices, payments, delivery, and automation.

On the public marketing site, optional analytics events (for example page views and waitlist funnel events) may be collected only if you allow analytics cookies and an analytics measurement ID is configured for that environment. Those events are designed to avoid ordinary personal identifiers such as names, emails, or free-text notes.

We use personal information to:

• operate the website and launch list
• create and manage accounts
• generate and store quotes, invoices, and related business records
• send documents and reminders through the channels you configure
• process subscription billing and payment status updates where enabled
• provide automation such as follow-ups and reminders
• respond to support requests
• maintain security, prevent abuse, and improve reliability
• measure public-site usage where analytics consent and configuration allow it
• comply with legal obligations

We do not sell personal information.

Where UK GDPR or related data protection law applies, we process personal information on one or more of the following bases, depending on the activity:

• Contract (or steps before a contract): account creation, providing the quoting/invoicing product, subscription billing, and sending documents or reminders you request
• Legitimate interests: securing the service, preventing abuse, operating the waitlist and website, product reliability, and limited operational analytics that do not require consent
• Consent: optional analytics and marketing cookies/tags on the public site, and any other processing where we specifically ask for consent
• Legal obligation: where applicable (for example responding to lawful requests or keeping records we are required to keep)

QUAVA is intended for business use. We do not seek to process special-category personal data as part of the ordinary product. Please do not submit special-category data unless it is necessary for your own business records and you are entitled to do so.

QUAVA uses AI systems to help provide requested AI-assisted features. In the current product this includes OpenAI models accessed through OpenAI’s API for draft generation and, where enabled, voice transcription.

When you use those features, relevant input (such as notes, messages, transcripts, or draft context) may be sent to the AI service provider so it can return a result for your request. Generated output is assistive and should be reviewed before you send it to a customer or rely on it for business decisions.

QUAVA does not intentionally use your customer business content to train its own general-purpose AI models for other customers, and your workspace content is not made available to other QUAVA customers as shared training material through the product.

Provider handling of API/business data is governed by the applicable OpenAI business/API terms and privacy documentation in force for our account. Those terms commonly provide that customer content submitted through the API is not used to train OpenAI’s models by default; they may change, and we do not claim that providers never retain data for security, abuse-prevention, legal, or operational reasons.

We share personal information with service providers only as needed to operate QUAVA. Based on the current product architecture, that includes:

• Supabase — authentication and application database hosting
• Vercel — application hosting and delivery of the web app
• OpenAI — AI model inference for drafting and voice transcription where those features are used
• Stripe — subscription payment processing and billing events
• Resend — transactional and service email delivery
• Google Analytics 4 — optional public-site analytics, only when consent and configuration allow

Optional marketing tags (for example Google Ads or Meta Pixel) load only if both a measurement ID is configured and you grant marketing consent. If those IDs are not configured, the tags stay dormant.

We may also disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction, subject to appropriate safeguards.

Some service providers may process data outside the United Kingdom or European Economic Area. Where that happens, we rely on appropriate transfer mechanisms required by applicable law. We do not claim that all data is stored only in the EEA.

We use access controls, authenticated sessions, tenant-scoped data access patterns, and restricted service-role operations in our systems to help protect account and business data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We keep personal information only for as long as needed for the purposes described in this policy, including to provide the service, maintain business records you create, resolve disputes, secure the platform, and meet legal requirements.

When you ask us to delete an account, or when information is no longer required, we will delete or anonymise it within a reasonable period, except where we must retain it for legal, accounting, security, or dispute-resolution reasons. A detailed operational retention schedule may be published separately when confirmed.

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, or portability of personal information, and to withdraw consent where processing is based on consent.

To exercise these rights, contact support@quava.ai. We may need to verify your identity before responding. Export or deletion requests for account data are handled manually through that contact route unless a self-serve tool is later made available.

QUAVA uses cookies or similar technologies in these categories:

• Necessary — always on. Required for authentication, session continuity, security, and essential site operation (including Supabase auth/session behaviour).
• Analytics — off until you consent. Used only if you allow analytics and a Google Analytics measurement ID is configured for the environment.
• Marketing — off until you consent. Used only if you allow marketing and a marketing tag ID is configured for the environment.

Optional tags load only when both (1) the relevant ID is configured via environment settings and (2) you have granted the matching consent category. If those IDs are not configured, the tags stay dormant and are not loaded.

You can Accept analytics, choose Essential only, or Manage choices in the cookie banner, and change your mind later via Cookie settings in the site footer or on the Cookie Policy page.

QUAVA is intended for business use and is not directed to children. We do not knowingly collect personal information from children for the purpose of providing the service.

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of QUAVA after an update means you should review the revised policy.

For privacy questions or requests, email support@quava.ai. Registered company: RB TECH LABS LTD. Company number: 17101213. Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF.

If you are in the United Kingdom and are unhappy with how we handle personal information, you may have the right to complain to the Information Commissioner’s Office (ICO).

ICO website: https://ico.org.uk/