QuoteVitals — Archiving, Retention and Account Deletion Policy

Effective 2026-10-22 · Fandonia LLC

1. Scope

This policy sets how long QuoteVitals keeps what you put into it, what archiving does, and how you delete a quote, a capital request, your account, or your whole organization. It applies to the web app at app.quotevitals.app, the iOS app and its App Clip. It is published by Fandonia LLC, the operator of QuoteVitals.

QuoteVitals is built for healthcare organizations (hospitals, surgery centers, physician groups, dental and veterinary practices, and senior living) comparing vendor quotes for capital equipment: biomedical and clinical engineering, supply chain, and practice and facility managers. It is not designed to receive protected health information (PHI), and you agree not to upload it. Because a vendor document sometimes carries patient data anyway, every file that becomes a quote is checked as it is read: patterns in our own code over the text we hold, and one question to the model provider that is already reading the document (section 10). A hit is shown to your team as a finding that blocks sign-off; an owner or reviewer purges the file with one click (the file, everything read from it, the request's export files and generated memos and workbooks, and the vendor's cover note for it) or clears the finding with a recorded reason. The check does not send the document anywhere it was not already going, and nothing is purged without a member's action. If patient data reached us some other way, tell us and we will purge it; see section 13.

Three commitments run through everything below:

You can delete your account yourself, at any time, from inside the app, with no email, no phone call and no waiting on us.
Your documents are yours. We hold them to run the product for you, and for no other purpose.
When we delete, we delete the files, the extracted data and the notes, not just the pointer to them.

This document describes how the product behaves. It is not legal advice and it does not replace the Terms of Use, the privacy notice at quotevitals.app/privacy or any data processing agreement your organization signs with Fandonia LLC. Where those documents and this one differ, the signed agreement governs.

2. What QuoteVitals stores

Everything below is scoped to your organization. No other customer can read it, and our staff cannot open your documents without your permission (section 11).

Data class	What it is	Where it lives
Quote documents	The PDFs, spreadsheets, saved emails and images you upload or photograph	Private file storage, under your organization's folder
Specification documents	The spec or RFP you attach to a capital request	Private file storage, same folder
MDS2 security disclosures	A vendor's Manufacturer Disclosure Statement for Medical Device Security (MDS2) that a member uploads into a capital request for that vendor, and what is read from it: the form version (2013 or 2019), the device model, software version, document id and release date the form names, each question's answer, the vendor's note text, and whether the text cited for each answer was found on the form. An MDS2 is the vendor's statement about its device, not proof of how the device is configured	The file in private file storage, in the capital request's folder; the answers in the database, on the capital request
Extracted data	Line items, prices, terms and vendor details pulled from each quote, with a confidence score our own code computes from the evidence (not the model's opinion of itself). While a quote is being read, the reading in progress is kept on the quote record for those minutes (at most about half an hour if a reading stalls) and cleared as soon as it is saved or the reading fails	Database, one record per quote
Flags and exceptions	The acuity flags raised on each quote and across vendors	Database
Corrections	Every edit a reviewer makes to extracted data, with who made it and when	Database; reused only inside your organization to make future extractions more accurate
Notes	Row notes and vendor notes; internal by default, included in the memo only when you tick the box	Database
Approval and audit trail	Who approved, reopened, archived, restored or purged which capital request, changed a role or the retention period, granted or used support access, took a vendor push-back draft (subject and the flags it covered) or sent the committee packet (recipients, subject and the names of the files on its link, not the body), each download from a committee packet link (the file name, not who downloaded it) and each revocation of one, changed the quotes email address setting, and when; the status history of each quote	Database
Outputs	Generated bid tabs (Excel), memos (PDF), and export files kept briefly so a download link can work (section 12)	Private file storage
Committee packet links	When a member sends the committee packet: the memo (PDF) and bid tab (Excel) as built at that moment, the sender's email, the number of recipients, the file names, whether the request was a draft or approved, when it was sent, when it expires and whether it was revoked; only a one-way hash of the link itself is kept. The original quote files are not copied: the link records which of the request's quote files it offers (a quote added later is not offered, and a quote with an open patient-information finding is never offered), and a recipient downloads each from the request's own storage through a link valid for 60 seconds, only while that quote is still on the request	The two files in private file storage that only our server can read; the record in the database
Account and team	Your name, work email, role, organization name and its industry, sign-in records, and the color scheme and order of request tabs you chose for the app	Database and authentication service
Phone notifications	If you allow notifications in the iPhone app: that phone's notification token, its name as set on the phone (for example “Bill's iPhone”), and whether notifications are on for it	Database; removed when you turn notifications off on that phone, sign out there, or delete the account
Lock Screen reading progress	When the iPhone app sends quotes to be read, it can show their progress on the Lock Screen (a Live Activity). We keep the activity's own push token, which request it is for, and when it started and ended, so the server can update it as each quote lands	Database; marked ended when the reading finishes (at the latest 8 hours later), removed 2 days after that, or with the account
Invitations	The work email an owner invites, the role offered, who sent it and when; a one-time link that works for 7 days	Database; the row is removed 30 days after it is accepted, withdrawn or expires
Sign-in factors	If you turn on two-factor sign-in, the shared secret for your authenticator app (authentication service) and the SHA-256 hashes of your eight recovery codes (our database, readable only by the server); your organization's two-factor setting (off, owners, everyone)	The secret is never shown again after setup; recovery codes are shown once, each works once, and using one removes the lost authenticator
Sign in with Apple token	If you sign in with Apple in the iPhone app: the token Apple issues to QuoteVitals at that sign-in and Apple's identifier for you, kept only so that we can end QuoteVitals' access to your Apple Account when you delete your account. The token is encrypted with a key that only our server holds	Database, readable only by the server; never shown in the app
Terms of Use acceptance	The version of the terms you accepted and when; also written to your organization's audit trail	Database, kept with the account
Billing	Plan, credits, invoices and payment status; card details are held by Stripe, never by us	Database and Stripe
Feedback	Feature requests and votes you submit in the Feedback area	Database, attributed to your account; each new idea is also emailed to Fandonia support with your name, email, role and organization so we can follow up
Usage metrics	Counts of quotes processed, extraction time, error rates; no document content	Database, aggregated
Folders	Folder names and which requests are in them	Database
Vendor submissions	When a vendor sends a quote to a capital request's own email address or upload link: the sender's name and email address, the email subject or the company name they typed, their cover note, the names of the files and whether each was added, held or skipped, and whether it arrived after the quote deadline. For link uploads, a one-way hash of the sender's network address, used only to limit abuse of the link	Database; deleted with the capital request
Quote deadline and intake address	The date quotes are due (and the time zone it was set in), the request's own email address and upload-link token, and the organization's setting for whether quotes may arrive by email at all (an owner can turn the quotes email address off; email sent to a quotes address while it is off is not added, and only the sender's name and address, the subject line and the reason are recorded)	Database, on the capital request; the address and token are cleared when the request is purged
Sign-off chain	Who outside your team must approve a capital request before your own sign-off, as your organization sets it (stage names and email addresses), and the trail each time a request is sent for sign-off: each approver's email address, the name they typed to sign, their decision, their comment, when they answered, and a one-way hash of their network address at that moment, used only to limit abuse of the link. Approvers need no account; their link is emailed to them and expires after 14 days	Database, on the organization (the default chain) and on the capital request (the trail); the trail is purged with the request and is printed on the committee memo and workbook made after it
Scorecard	The criteria your team lists on a capital request (text, weight, must-have) and, for each vendor quote, the model's verdict per criterion with the vendor's quoted words, the page reference and a one-line reason	Database, on the capital request; deleted with it
Test menu and cost per reportable	On a lab reagent rental request: the assays your team lists with the annual reportable results expected for each, the term, repeat and QC allowance and escalator cap your team sets, and, for each line of each vendor quote, what the model read it as (which assay's reagent, calibrator, control, consumable, analyzer rental or purchase, service, interface or other), how it is priced, and the tests per kit where the line states them. The cost per reportable is worked out from these and the quote's own line prices when shown or exported, not stored	Database, on the capital request; deleted with it, and a quote's line readings with that quote
Vendor invitations	Vendors your team keeps on a capital request to ask for a quote, whether typed or suggested by a search of public vendor sites: company name, website, the sales address, the search's one-line reason and the page it came from; and, for each request for quote sent, the subject and full text as sent, when, by whom, and the mail provider's message id	Database, on the capital request; deleted with it
Vendor messages	Emails sent to a vendor from a capital request on a member's behalf: a request to extend a quote's validity, a best-and-final request, an award notice, a thank-you to vendors not chosen. For each: the vendor name, the address, the subject and full text as sent, the date and terms asked for, when, by whom, and the mail provider's message id. The request also records which quote was awarded and when	Database, on the capital request; deleted with it
Vendor contacts your team keeps	Your organization's vendor address book: each vendor company (its name, website, your account number with the vendor and your notes) and the people there (name, email address, phone, role, territory or product line, which one is the primary contact, where the contact came from and whether your team has confirmed it), and, for each capital request, which contact to write to at each vendor. Contacts are suggested from normal use and wait for a member to confirm them: the name and address on the From line of an emailed quote (only under a vendor company already in the address book, and never from a quote flagged for patient information), the company and address typed on a request's upload link, the address a request for quote was sent to, and a vendor kept from Find vendors (company and website only). A business card read on the iPhone is saved as confirmed. Contact details are never taken from inside a quote document. These are business contacts, not patient information	Database, under the organization; kept until you delete them or the organization is deleted (section 4)
Contract price files	Price lists an owner uploads (GPO or local agreements): the file name, the name and source typed, the dates in force, and each row's catalog number, description, price, unit and tier; who uploaded it and when	Database, under the organization; removed when an owner removes the file or the organization is deleted
Quote ledger and capital books	For each vendor quote read: the vendor name, the quoted total and the date, kept after the quote is removed so the savings figure (a vendor's first quote against the accepted one) still adds up; and the capital books an owner builds: the name, the fiscal period and which requests are in it; and the organization's fiscal year start month and reporting time zone. A book file is built when downloaded and kept only long enough to hand out its link	Database; the ledger row goes with the capital request, a book when an owner removes it, the request is purged out of it, or the organization is deleted. Book files: removed after a day by the nightly sweep, at once when the book is removed, and whenever a request or a quote in the organization is purged
Calendar feed links and chat channels	A private calendar link each member makes for themselves (a random token, when it was made and last read), and the Slack or Teams webhooks an owner connects (the channel name typed, the webhook URL, which topics it gets, when it last posted and any error). Posts to a channel name the request, the vendor and what happened, with a link to the app, never amounts or documents	Database; a calendar link goes when the member removes it, leaves the organization or is deleted; a webhook when an owner removes it or the organization is deleted. Members never see a webhook URL

We do not keep card numbers or bank details. If you sign in with a password, only a salted hash of it is held by the authentication service; we never see or store the password itself. Emailed sign-in links and Google or Apple sign-in involve no password at all.

3. Archiving

Archiving is for capital requests where the decision has been made. It clears the board without losing the record.

When you archive a capital request:

It leaves the Open view and appears under Archived, with its decision date.
The bid tab, memo, notes, corrections, approval record and every quote file stay exactly as they were, read-only.
Anyone who could see it before can still open it, search it and download its outputs.
No new quotes can be added to it. Restore it first if a late quote arrives.
The retention clock starts (section 4).

Restore puts it back in Open at any time before the retention period ends. Restoring stops the retention clock; archiving again restarts it from the new archive date.

Archiving never deletes anything and is never automatic. Only an owner or reviewer can archive or restore; viewers cannot.

4. Retention schedule

Your organization chooses how long archived capital requests are kept. The default is 24 months from the archive date. An owner can change it in Settings to 12, 24 or 36 months, or to keep everything until someone deletes it. The choice applies to the whole organization and to requests archived before the change.

Open capital requests are never aged out. Retention only counts down on archived requests.

Data class	Kept for	Then
Archived capital request, with its quotes, MDS2 disclosures, extracted data, flags, notes, corrections, outputs and approval record	Your organization's retention period (default 24 months)	Purged: files removed from storage first, then every database row
Open capital request	Until archived or deleted	Enters the schedule above when archived
Account details (name, email, role)	Life of the account	Deleted with the account (section 6)
Phone notification tokens	Until notifications are turned off on that phone, you sign out there, or the account is deleted	Deleted
Lock Screen reading progress (Live Activity tokens)	Until the reading finishes, at most 8 hours	Removed 2 days after it ends
Committee packet files (memo and bid tab on a packet link)	30 days from sending, or until the link is revoked or the request is purged, whichever comes first	The link stops working at once; the files are deleted within a day of expiry and at once on revocation or purge; the record of the send stays with the request
Vendor submissions	Life of the capital request	Purged with it (section 5)
Vendor invitations and the requests for quote sent	Life of the capital request	Purged with it (section 5); a sent request for quote is kept on the request as the record of what went out until then
Vendor messages (extension requests and later letters)	Life of the capital request	Purged with it (section 5)
Vendor contacts your team keeps	Until you delete them or the organization is deleted	Deleted at once when a member deletes a contact, or a company with its contacts; an archived or dismissed contact is kept, hidden, until a member deletes it. Deleting or archiving a contact also clears any capital request's choice of that contact. The whole address book is deleted with the organization (section 7), and a request's choices are purged with the request (section 5)
Contract price files	Until an owner removes them	Deleted at once; findings they produced are cleared from open requests
Quote ledger (vendor name, total, date per quote read)	Life of the capital request	Purged with it (section 5)
Capital books	Until an owner removes the book	Deleted at once, with any stored build of it; the requests in it are untouched
Calendar feed link	Until the member removes it, makes a new one, leaves, or is deleted	Deleted at once; the old link stops working
Chat webhooks	Until an owner removes them or the organization is deleted	Deleted at once
Sign-off trail (approvers' names, emails, decisions, comments)	Life of the capital request	Purged with it (section 5); the organization's default chain lasts until an owner changes it or the organization is deleted
Sign-in and security logs (two-factor events in the audit trail, and the sign-in log of our authentication service)	12 months	Purged nightly
Authenticator secret and recovery codes	Until you turn two-factor off or delete the account	Deleted at once; a new setup gets a new secret
Sign in with Apple token	Until your next Apple sign-in replaces it, or the account is deleted	On account deletion we first ask Apple to revoke it, then delete it
Billing records and invoices	7 years from the transaction	Our billing records and deletion receipts are purged nightly once they are 7 years old, the record-keeping period tax rules require; invoices held by Stripe follow Stripe's retention
Feedback submissions	Life of the account	Anonymized when the account is deleted; the idea and votes stay, your name does not
Aggregated usage metrics	Indefinitely	Contain no document content and no personal data
Lapsed subscription	60 days after the last paid day	Read-only from day 1; owners are emailed at day 1 and day 30, then on day 46 the 14-day deletion window of section 7 starts, with its own reminders; the whole organization is purged at day 60 unless the plan is renewed

Thirty days before an archived request reaches the end of its retention period, the organization's owners get one email listing what will be purged. Nothing is purged until at least 30 days after that email has gone out, including when an owner shortens the retention period: requests already past a shorter period are warned first. Restoring the request, or extending the organization's retention period, stops the purge. The purge itself runs nightly and is logged in your organization's audit trail as a single line per request: which request, when, under which retention setting.

5. Deleting a quote or a capital request

Any owner or reviewer can delete a single quote while its capital request is still under review. The file, its extracted data, its flags, its row notes and the corrections made on it go at once, and so do that vendor's MDS2 security disclosure file and the answers read from it.

An owner or reviewer can also delete or replace one vendor's MDS2 security disclosure on its own while the request is under review. The file and the answers read from it are removed at once, and the request's device security findings are worked out again from the disclosures that remain; a finding the team already resolved keeps its note. Once a capital request has been approved, individual quotes cannot be deleted, because the approval record depends on them; delete the whole request instead.

Only an owner can delete a capital request. Deletion is immediate and cannot be undone. In order, QuoteVitals:

Removes every quote, spec, MDS2 disclosure and output file from storage.
Deletes all extracted data, MDS2 answers, flags, allocations, corrections, notes and events for that request.
Deletes the approval record and the request itself.
Writes one line to the organization's audit trail: request name, who deleted it, when.

Emails already sent from the request (a committee packet, or a push-back draft you sent from your own mail) are in the recipients' mailboxes and are not recalled.

Credits consumed on an approved request are not refunded when it is deleted.

6. Deleting your account

You can delete your account at any time, from Settings on the web or in the iOS app, without contacting us. You type your email address to confirm, and it takes effect immediately.

What happens the moment you confirm:

You are signed out everywhere and can no longer sign in.
Your name, email, role and sign-in records are deleted from the account database and the authentication service.
If you signed in with Apple, we ask Apple to end QuoteVitals' access to your Apple Account. If we cannot (for example, because your last Apple sign-in was made with an earlier version of the iPhone app), the confirmation tells you how to remove QuoteVitals under Sign in with Apple in your iPhone's Settings.
Your feedback submissions are anonymized.
In your organization's records, your name on past approvals, corrections and notes, and your name and email address in the audit trail and on committee packet links, are replaced with “Former member”; a sign-off you gave as an approver keeps your name and email address, as section 8 explains. The approvals and corrections themselves stay, because they belong to the organization's capital request, not to you. If you want your notes removed as well, delete them before you delete the account.

What happens to the organization depends on who you are:

Your situation	Result
A reviewer or viewer, or an owner with other owners	The organization is untouched. Its quotes and requests stay with the team.
The only owner, with other members	You must name another owner first, or choose to delete the organization. The app will not let you leave an organization ownerless.
The only owner and the only member	Deleting your account also schedules the organization for deletion (section 7).

Email confirmation of the deletion is sent to the address you used to sign in, and that copy of your address is not kept.

Your personal data is gone from live systems at once and from the last backup within 7 days (section 9). Records we are required to keep, or that the organization has a legitimate need to keep, are listed in section 8; none of them identify you by name.

7. Teams and organizations

An organization is the unit that owns quotes. People come and go; the capital record stays with the organization.

Joining. An owner invites a colleague by work email with a role; the link works for 7 days and puts them in the organization directly. Someone who already had an empty account of their own is moved across and that empty organization is removed. An account that already belongs to an organization with other members or capital requests is never moved silently; its owner is asked first.

Leaving or being removed. When a member leaves or an owner removes them, they lose access immediately. Their approvals, corrections and notes stay, still under their name, because the organization may need to show who approved what. Their account survives; it simply has no organization until they join or create one.

Owners. Every organization must have at least one owner. An owner can promote another member to owner at any time. The last owner cannot leave or delete their account without either naming a successor or deleting the organization.

Deleting the organization. Only an owner can do this, from Settings, by typing the organization's name. It is not immediate:

On confirmation the organization is frozen. Nobody can upload, edit, approve or send; everyone can still read and export.
Every owner is emailed at once, and again on day 7 and day 12, with a link to cancel.
Any owner can cancel during the 14-day window. Canceling restores the organization exactly as it was.
On day 14 the organization is purged: every capital request is deleted as in section 5, then the storage folder, the team, the retention setting, the feedback votes, the vendor address book, the audit trail and the organization record itself.
Members are told by email. Their own accounts are not deleted; each is left with an empty organization of their own to start again from, or to delete, with no new free trial.

The 14-day window exists because an organization's data usually belongs to more than one person, and a single owner should not be able to erase an organization's capital record by mistake or on their last day. If you need a faster purge, for instance under a contractual obligation, contact us (section 13) and we will complete it within two business days after confirming with a second owner or an authorized contact at your organization.

A paid plan is canceled at the start of the window and not charged again. Unused credits are not refunded.

8. What survives deletion, and why

After an account or organization is purged, this is everything that remains. Nothing on this list contains a quote document, extracted line items or notes, and only the row about an organization that continues can name a person.

Kept	For how long	Why
Invoices and payment records, with the organization's billing name and the last four digits of the card	7 years	Tax and accounting law requires it; Stripe holds the card itself
A one-line deletion receipt: organization ID, date, who requested it (as an internal user ID, not a name or email), what was purged	7 years	So we can prove to you or a regulator that the deletion happened
Aggregated usage metrics (counts, durations, error rates)	Indefinitely	Product health; cannot be traced to a document or person
Anonymized feedback ideas and votes	Indefinitely	The idea is useful to other customers; the name is not needed
When only an account is deleted and the organization continues: that person's name and email address on sign-offs they gave as an approver, on approver lists and the organization's default sign-off chain, and in the text of letters already sent to vendors	Life of the capital request, or until an owner changes the chain	The sign-offs, the chain and the letters are the organization's record of who approved and what was sent
Emails sent from a request (committee packets from QuoteVitals; push-back drafts you sent from your own mail)	In the recipients' mailboxes, outside our control	Sent mail cannot be recalled
Anything the organization exported before deleting	Wherever they stored it	It left our systems at export

The extraction provider (Anthropic) and the email provider (Resend) keep their own short operational logs; section 10 gives their retention windows. We do not keep copies of documents anywhere outside the systems listed in section 10.

9. Backups and how long deletion takes to propagate

Deletion from the live database and live file storage is immediate; the moment a purge finishes, the data cannot be read through the app or its API.

The database is backed up daily, and each backup is kept for 7 days before it is destroyed. File storage is replicated for durability but has no separate long-lived backup; a file deleted from storage is gone from all replicas within minutes. So the longest anything can persist after you delete it is 7 days, inside an encrypted backup that is never restored except to recover from a total failure of the service.

If we ever had to restore from a backup taken before your deletion, we would re-run every deletion recorded since that backup before bringing the service back. The deletion receipts in section 8 are what make that possible.

We do not keep copies of your data on laptops, in email, or in support tools. Support staff who look at a document at your request do so inside the app under your organization's permission grant, which you can revoke at any time.

10. Where your data sits: hosting and subprocessors

QuoteVitals runs on the providers below. Each one processes your data only to deliver the part of the service named, under a written agreement with Fandonia LLC. We will update this list and email organization owners at least 30 days before adding a subprocessor that would handle document content.

Provider	What it does for QuoteVitals	What it can see	Its own retention
Anthropic (Claude API)	Reads each quote and spec to extract line items, terms and flags; answers your questions on the bid tab and in Pulse, the helper inside the app; when a member presses Find vendors, searches the public web for companies that sell what the request describes	The document content and your questions, per request; for Pulse, your question and a summary read from your account at that moment (section 11), without members' or approvers' names or any email addresses; for a vendor search, only the request name, the category and the criteria text (no documents, prices, notes or names)	Deletes API inputs and outputs within 30 days; does not train on them (section 11)
Supabase	Database, sign-in, and private file storage	Everything in section 2	Live data until we delete it; daily backups kept 7 days
Vercel	Hosts the web app and its API	Requests in transit; short request logs	Logs held briefly for operations; no document storage
Inngest	Runs background jobs: extraction, rules, retention purges, reminder emails	Record IDs, statuses, counts, dates, confidence scores, organization, request, plan and vendor names, the names of the kinds of patient information found (never the values), the names, sizes and types of files emailed to a quotes address, and the short text of a Slack or Teams post (names, counts, dates and links); never document content or anything read from it (line items, prices, terms, findings, the vendor's words, email text) or a download link, in the job payloads or in the stored result of any job step	Job history for a limited window
Resend	Sends sign-in and confirmation emails, invitations, notices, committee packet emails and requests for quote to vendors on our behalf; receives email sent to a capital request's own quotes address (an address at quotes.quotevitals.app) and hands it to us	Outbound message content and recipient addresses (a committee packet email carries the sender's message and a private link, never the memo, the bid tab or a quote file); for a received message, the whole email including its attachments, on its way to us. An owner can turn the quotes email address off; Resend still receives what is sent to it, and we then add nothing from it	Resend keeps email data, sent and received, for 30 days (its published retention); we copy the attachments into your request's storage as soon as the message arrives
Google	Sign in with Google, if you choose it	Your name, email address and profile photo from Google, at sign-in only	Per Google's terms; we keep only the email address and name on your account
Apple	Sign in with Apple, if you choose it in the iPhone app; delivers push notifications to iPhones, including the Lock Screen reading progress; supplies the App Clip to an approver's iPhone when they open a sign-off link there	At sign-in, your name and email address (or the private relay address Apple gives us, if you choose to hide yours); for notifications, the notification text (a capital request's name and the member who acted) and the phone's notification token; for reading progress, the request's name, how many quotes are read and how many findings there are, sent straight to Apple with that activity's token; when you delete your account after signing in with Apple, our request to revoke QuoteVitals' access	Per Apple's terms; we keep the email address and name on your account and, encrypted, the token used to revoke access (section 2)
Expo (650 Industries, Inc.)	Passes push notifications from QuoteVitals to Apple for delivery to the iPhone app; delivers updates to the iPhone app's own code (EAS Update), which the app checks for each time it opens	For notifications, the notification text and the phone's notification token; for updates, the phone's network address, a random identifier for that installation of the app, the platform, the app version and update channel, which update it is running, and the text of the error if the app's previous launch failed; never account details or document content	Short delivery and update records per Expo's terms
Sentry	Error reports, when switched on, so we can find and fix failures	The error, where in the code it happened, record IDs, the page address and the browser or device type; set not to send names or email addresses, and never document content	Per our Sentry plan, up to 90 days
Stripe	Billing and payments by card, ACH debit or bank transfer	Billing contact, card or bank account details, invoices	Per Stripe's terms and card-network rules

All data is stored in the United States. Document files and database contents are encrypted at rest and in transit. Any organization that needs a data processing agreement, a completed security questionnaire or a copy of a provider's own terms can ask through section 13.

11. AI processing: what Claude sees and does not keep

When a member presses Find vendors on a capital request, the same API is asked, with web search switched on, which companies sell what the request describes; what goes with that question is the request name, the category and the criteria the team listed, never a document, a price, a note or a person's name. The vendors it lists are suggestions for the team to check; nothing is sent to a vendor until a member reads the request for quote and presses Send. Every quote you upload is read by Claude, Anthropic's model, through Anthropic's commercial API. That is how QuoteVitals turns a PDF into a bid tab. Documents therefore leave Fandonia's own systems for the duration of that processing. We tell you this plainly because a vendor-security review will ask, and because the alternative wording on many sites (“we never share your documents”) would not be true of any AI product.

What is sent: the document pages, the spec if attached, and the relevant extracted data and your question when you ask one. An MDS2 security disclosure uploaded for a vendor is sent the same way when it is a PDF, an image or a Word file; a spreadsheet form is read by our own code and is not sent unless that reading comes up short. What is not sent: your name, your email, your organization's name, other organizations' data.

Under Anthropic's commercial terms, Anthropic may not train models on content sent through the API, and Anthropic claims no rights in what we send or what comes back. As the Terms of Use say, all of it remains yours. Per Anthropic's retention policy, API inputs and outputs are deleted from Anthropic's systems within 30 days of the request; content flagged for a usage-policy violation can be held longer. Fandonia LLC does not train any model of its own on your documents, and does not use one customer's documents to improve results for another. Corrections you make are reused only inside your own organization.

Two features on the bid tab send data to Claude at your request rather than automatically. “Ask about these quotes” sends the extracted data, the fine print, the open findings (an above-contract-price finding names the contract and its price for that line) and your question, and returns an answer with the words it rests on; neither the question nor the answer is stored. “Push back” builds vendor emails from the open findings in code, without a model call; you edit and send them yourself from your own email, and the audit trail records only the subject, which findings it covered, and whether the draft was copied or downloaded; no recipient is recorded. Team notes are never sent to the model, a vendor or a committee unless a note is marked for the memo.

Pulse, the helper inside the app (the Pulse button on every screen of the iPhone app and the round button at the bottom right of the web app), is a third on-request feature. When you ask it a question, it sends to Claude a fixed help text, your question and the last few turns of that conversation, and a summary read from your account at that moment: your role and your organization's plan and trial state (not its name), the names, status and counts of your open capital requests, what needs your attention, and, when a request is open on screen, that request's quotes and their status (the same extracted data as “Ask about these quotes”), its open findings, the names and status of its sign-off stages and how many people are in each, the outputs that have been made, and the awarded vendor; and your organization's vendor address book: the company names and, for contacts your team has confirmed, their names, roles, territories and which one is primary. It never sends a vendor contact's email address or phone number, your organization's name, any member's name or email address, any approver's email address, signed name or comment, team notes, or a request's upload address or link; email addresses that appear in a quote are withheld. Pulse reads only; it cannot change, send, approve or delete anything. Neither the question nor the answer is stored, and the question is not written to the audit trail. The conversation is gone when the sheet or panel closes. Pulse on the quotevitals.app website is separate: it answers visitors from a fixed text about QuoteVitals, never reads an account, and sends only the visitor's question and the last few turns of that conversation to Claude; nothing the visitor writes is stored, and to limit abuse a hash of the visitor's network address is counted for an hour and the count is deleted within two days. The quotevitals.app privacy page describes it.

Organizations that require zero-data-retention processing with Anthropic, so that nothing is stored on Anthropic's side after the response is returned, can ask us; it is available where our agreement with Anthropic allows it, and we confirm in writing when it is in place for your organization.

Nobody at Fandonia reviews, approves or reads your comparisons, and our staff cannot open your documents unless an owner grants support access. Support access is granted by an owner, per organization, for 1 to 30 days, and can be revoked at any time; every grant, revocation and each time support opens something is written to your organization's audit trail, which you can see under Settings and take with you in the export. To set up plans and invoices, Fandonia billing staff can see each organization's name, plan, billing dates and number of members, never its documents; every plan change they make is written to your audit trail and billing history. Fandonia also receives an email for each billing event (a new plan, an invoice sent or paid, a failed payment, a cancellation, a paused plan) with the organization's name, plan, amount and billing email, never anything from its documents.

12. Export before you delete

Deletion is final, so take your data with you first; you can also take a copy at any other time. Every capital request has one Export menu, on its page on the web and on its screen in the iOS app, with three choices, all built on the spot from the current data:

Excel workbook: the whole request in one file. A summary (department, cost center, budget, 5-year cost of ownership per vendor, who approved it and when); the bid tab; every finding, grouped by vendor, with the vendor's own words, page, status and resolution note; one sheet per quote as read, with page references; every file on the request; every reviewer correction (was, now, who, when); every note, internal ones included (it is your data); an MDS2 sheet with each vendor's security disclosure answers side by side, when one was read; and the activity record (quote processing steps, approvals, archive and restore, category changes, push-back drafts, exports). Set up to print.
Memo: the committee memo as a PDF, marked DRAFT until the request is approved.
Full archive: one zip with the workbook and memo, every original quote and spec file exactly as uploaded (one folder per vendor), each vendor's MDS2 security disclosure exactly as uploaded (in an mds2 folder, one folder per vendor), every file generated earlier, and a machine-readable summary.

The Capital requests page adds Export all to Excel: one sheet with a row per request (status, approver, budget, low bid and the gap to budget, lowest 5-year cost of ownership, and how many findings are still open), available to any member.

The iPhone app also keeps two things on the phone itself, never on our servers: the counts the Lock Screen widget shows (how many things need the member, refreshed when the app opens or a notification arrives), and a search index of the member's capital requests (name, department, category, status and vendor names) so the iPhone's own search can open a request. Both are cleared on sign-out.

On the iPhone app a member can also keep a memo, bid tab or export on the phone, for a meeting with no signal. That copy lives in the app's own documents folder on that phone only, marked so that iPhone and iCloud backups leave it out; it is a snapshot as of the day it was kept, is never sent anywhere by us, and is removed by the member from the app (under On this phone), automatically when the member signs out, or when the phone's owner deletes the app. So that the app still opens with no signal, the same folder holds the list of open capital requests the home screen last loaded (names, departments, status and dates, nothing from the quotes) and the name of each request a file was kept from; both are replaced on the next load and removed on sign-out. None of it is part of what QuoteVitals holds, and deleting a request or an account on another device does not reach it. The app keeps its sign-in session in the iPhone's keychain, readable only by the app and never moved to another phone or restored from a backup.

An approver who opens their sign-off link on an iPhone may be offered the QuoteVitals App Clip, a small part of the app that shows the same page (the vendors' totals, the committee memo, the other stages) and takes the same decision, with no account and without installing the full app. It keeps nothing on the phone: the link is the only key, the decision is recorded exactly as from the web page (with a note in the audit trail that it came from the App Clip and whether Face ID or the passcode confirmed the person; never any biometric data), and iOS removes the clip itself after a period of disuse.

An owner can export the whole organization from Settings under Data and account, as one zip: every open and archived request in its own folder with its archive contents, plus an organization workbook with every request on one sheet, the team and roles, the full audit trail, the deletion receipts and the vendor address book (a Vendors and contacts sheet). Any member can also download the vendor address book on its own as a CSV file from Settings, under Vendors and contacts.

The export is built on request and stored in your organization's private storage only so the download link can work. The link expires after 10 minutes; the stored copy is removed within 2 hours for a single request (and with the request if it is purged), and within a day for a whole-organization export. Every export is written to the audit trail: who, when, and in which form.

What an export does not contain: other organizations' data, Claude's raw model responses, or card details.

When an organization deletion is started (section 7), the first email to owners links straight to the organization export so nobody has to hunt for it during the 14-day window.

13. Requests, changes and contact

If you cannot reach the app, or your organization's process requires a written request, email privacy@quotevitals.app from the address on your account. We act on account deletions within 2 business days and on organization deletions after confirming with a second owner or an authorized contact at your organization. We answer access and correction requests within 10 business days. There is no charge for any of these.

Patient information has its own clock. A document that should never have been uploaded (for example one containing patient data) is purged, with everything read from it, within 72 hours of your report or request, and we confirm in writing; any backup holding it is destroyed within 7 days (section 9). If we learn of patient data in your organization's documents by any route other than your own report, we tell your owners within 5 business days; the automated check in section 1 emails them the moment it flags a file.

If you are in a jurisdiction with a statutory right to erasure or access (GDPR, UK GDPR, CCPA/CPRA and similar), the self-service tools above are how we honor it; the email route is the fallback, not a prerequisite.

We review this policy at least once a year and whenever we change a retention period, add a subprocessor that handles document content, or change how deletion works. Changes that shorten a retention period or add a subprocessor are emailed to every organization owner at least 30 days before they take effect. Editorial changes are posted with a new date at the top of this page. Previous versions are available on request.

Fandonia LLC, operator of QuoteVitals. Privacy and data requests: privacy@quotevitals.app. General support: support@quotevitals.app. Both addresses reach the same small team; the privacy address exists so that a deletion, access or contract request is never lost among support tickets, and it is the address to give a security reviewer.