Privacy Policy
Last updated: 6 October 2026
Effective: 6 October 2026
This Privacy Policy explains how Henry (Harry) Pickering trading as Instaquote, ABN 38 193 580 481 ("Instaquote", "we", "us") collects, uses, stores, shares and protects personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
It applies to:
- Firms and their staff: trades businesses that sign up to Instaquote, and the people who sign in to the Instaquote firm console at firm.instaquoteai.app ("Firm Users").
- Homeowners and other end users: people who use the Instaquote chat widget on a firm's website to describe a job, get a quote estimate and request a booking ("Homeowners").
- Visitors to our website instaquoteai.app, including people who fill in our contact or demo forms.
1. Our role: service provider to firms
When a Homeowner uses the widget on a firm's website, the firm is the business the Homeowner is dealing with. Instaquote provides the software and handles the Homeowner's personal information on behalf of that firm, to produce a quote estimate and send the booking request to the firm. The firm decides what to do with the booking (for example, calling you back or attending the job), and the firm's own privacy policy governs what it does once it receives your details.
For Firm Users and Visitors, Instaquote handles your personal information for its own purposes, as described below.
2. What we collect
2.1 Homeowners (through the widget)
| Information | How we get it | Why |
|---|---|---|
| Name, email address, mobile number | You type them into the "Your details" form before your quote or booking is finalised. All of these fields are required. | To prepare your quote, send the booking request to the firm so it can contact you, and email you a copy. |
| Job address | The text you enter, the formatted address, latitude and longitude, and a Google place ID, checked with Google Maps Platform. | To confirm the firm services your area, choose the nearest branch and calculate the call-out (travel) fee. |
| Description of the problem and the chat conversation | Your messages and the assistant’s replies, which you type or dictate in the chat. | To understand the job, produce a diagnosis and quote estimate, and give the firm the job details. |
| Photos and short videos | Files you choose to upload or take with your camera, plus technical details (file type, size and a file fingerprint). | To help diagnose the problem. They may be analysed by our AI providers. |
| Preferred contact time, time window, urgency or emergency indicators | Chat and the details form. | So the firm knows when and how urgently to contact you. |
| Quote details | Diagnosis, job type, parts, prices, call-out fee, and whether you accepted the quote, generated by the service. | To show you the estimate and send it to the firm. |
| Technical and usage data | Widget session identifiers, events (for example, widget opened, quote shown, booking sent), the website the widget is on, browser and device type, and error reports, collected automatically by the widget and our servers. | To run, secure and improve the service, prevent abuse (rate limiting) and measure whether the widget is working. |
Voice dictation. If you use the microphone button, speech-to-text is performed by your web browser's built-in speech recognition (for example, Google Chrome or Apple Safari), not by Instaquote. Your browser vendor may process that audio under its own privacy policy. We receive only the resulting text.
We don't ask for, and you shouldn't give us, sensitive information (for example, health information) or payment card details through the widget. If something like that appears in your photos or messages, we handle it only as part of the job information. Payment cards for Instaquote's own fees are collected from Firms by Stripe, as described in section 2.2. Homeowners are not asked to pay Instaquote by card.
2.2 Firms and Firm Users
| Information | Why |
|---|---|
| Firm details: business name, trade, contact email, phone, branch addresses and business hours, service areas, logo, pricing (job prices, call-out fees, surcharges, parts lists), agent greeting and tone settings, websites where the widget is installed, webhook URLs and settings. | To provide and configure the service. |
| Firm User account: name, email address, role (owner or staff), password (stored only as a secure hash) if you use email sign-in, the date you accepted our terms, and your marketing email preference. | To create and secure your account and manage team access. |
| Google sign-in data. See section 3. | To let you sign in with Google. |
| Security and session data: session tokens, IP address, browser user agent and sign-in times. | To keep you signed in and protect accounts. |
| Activity in the console, such as notes on bookings, quote overrides, settings changes and audit logs. | To provide the service, keep an audit trail and help with support. |
| Commercial and support information: correspondence, and billing records for the booking fee (10% of the ex-GST quote value per booking, a $5 minimum, no maximum, with the first 5 bookings free), which is added up and charged monthly. Payment card details are collected and stored by Stripe. We receive the billing information we need to manage the account, such as whether a card is on file, the monthly charges made and the itemised statements. | To manage our relationship with you, charge the fee once the free bookings are used, and provide support. |
2.3 Website visitors and prospective customers
- Contact and demo forms: name, email, job title, company name, trade, and marketing attribution (UTM parameters and referring page). Used to respond to you and follow up about Instaquote.
- Analytics (PostHog): on instaquoteai.app, only after you consent in the cookie banner. The widget also records usage events needed to operate and measure the service (for example, that it was opened or a booking was sent). Those widget events are not controlled by the marketing-site cookie banner. They use pseudonymous identifiers.
- Error monitoring (Sentry): technical error data (browser, device and error details). This is not consent-gated, because it is needed to keep the site working. We configure it not to intentionally collect personal information.
3. Google user data (Sign in with Google)
Firm Users can sign in to the Instaquote firm console with their Google account. This section describes what we do with Google user data.
What we access. When you choose "Continue with Google", we request only the basic OpenID Connect scopes (openid, email and profile). From Google we receive:
- your name
- your email address and whether Google has verified it
- your profile picture URL
- your Google account identifier (a unique ID for your Google account)
- the sign-in tokens Google issues for this sign-in (ID token and, where issued, access and refresh tokens)
We do not request access to your Gmail, Google Drive, Calendar, Contacts or any other Google service data.
How we use it. Only to:
- create your Instaquote account and sign you in
- show your name and picture in the console and to your team
- match you to your firm and send you service emails (for example, booking notifications and account notices)
We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
How we store it. In our account database hosted on Cloudflare (D1), with encryption in transit and at rest, and access restricted to the systems and personnel that need it. Sign-in tokens are kept only as long as needed for your session and account.
How we share it. We don't share Google user data with third parties except: (a) the service providers that host and operate Instaquote (Cloudflare, and Resend for account emails), acting on our instructions; (b) other members of your own firm's team, who can see your name and email on the Team page; and (c) where required by law.
Deletion. You can ask us to delete your account and the Google user data associated with it at any time by emailing support@instaquoteai.app from the email address on your account, or from within the console once that option is available. We'll delete it within 30 days, except where we need to keep limited records to meet legal obligations, resolve disputes or enforce our agreements. You can also revoke Instaquote's access at any time from your Google Account at myaccount.google.com/permissions (opens in a new tab). Revoking access stops future Google sign-in. It does not by itself delete data we already hold, so email us to request deletion.
Limited Use. Instaquote's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.
4. How we use personal information
We use personal information to:
- provide the widget and firm console: run the chat, produce AI-assisted diagnoses and quote estimates, check service areas, calculate call-out fees and parts prices, and deliver booking requests to firms by webhook or email
- send service emails (for example, a copy of your booking to the Homeowner, and new booking and urgent-job notifications to the firm)
- secure the service: authentication, rate limiting, abuse and fraud prevention, and audit logs
- monitor, troubleshoot and improve the service: error tracking, usage analytics, quality review of conversations and quote accuracy, and testing changes to the AI assistant using de-identified or firm-approved examples
- charge Firms the booking fee described in our Terms of Service, once the five free bookings have been used
- provide support and communicate with firms, including product updates, and marketing only if a Firm User opts in (you can opt out at any time)
- comply with law and enforce our terms
AI. Chat messages, photos and job details are sent to our AI model providers to generate the assistant's replies, diagnoses and estimates. Those providers are OpenAI-compatible model hosts, Anthropic, and Google. We configure these providers so that customer content is not used to train their general models. Pricing is calculated by Instaquote's own rules from the firm's configured prices, and AI output is checked by automated rules, but quotes are estimates: see our Terms of Service.
We don't sell personal information, and we don't use Homeowner information to market Instaquote to Homeowners.
5. Who we share it with
- The firm whose widget you used: your details, address, conversation summary, photos, quote and booking request.
- Service providers (subprocessors) that help us run Instaquote, listed below.
| Provider | What for | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, storage and email routing (including Workers, the D1 database, R2 file storage, queues and security). | All service data, including email routed for our instaquoteai.app addresses. | Global edge network. Data may be stored or processed outside Australia, including in the United States. |
| Stripe, Inc. | Card storage and payments. | Firm payment card details and billing records for the booking fee. Card numbers are stored by Stripe. Homeowners are not asked for card details in the widget. | United States and other countries where Stripe operates. |
| Google LLC | Sign-in with Google, and Google Maps Platform (Places Autocomplete, Place Details and address validation, and Distance Matrix). | For sign-in: name, email, profile picture and Google account ID. For Maps and Places: address text and coordinates. | United States and Google’s global infrastructure. |
| AI model providers | OpenAI-compatible model hosts, Anthropic, and Google. Generating chat replies, diagnoses and estimates, and analysing photos. | Chat messages, photos and job details. We avoid sending contact details where they are not needed for the reply. | United States and other countries where those providers operate. |
| Resend (Plus Five Five, Inc.) | Transactional email, sent from bookings@instaquoteai.app. | Recipient email address and the booking details included in the email. | United States. |
| Bunnings Group Limited | Query Pricing API, for retail parts prices used to price materials. | Part names, item numbers and store or location parameters only. No Homeowner personal information. | Australia. |
| Sentry (Functional Software, Inc.) | Error monitoring. | Technical error data, configured to minimise personal information. | United States. |
| PostHog, Inc. | Product analytics. On this website, analytics run only after cookie consent. The widget sends usage events as part of operating the service. | Usage events and pseudonymous identifiers. | United States. |
| Vercel and Railway | Legacy hosting that is being phased out. | Service data that those hosts still handle until they are decommissioned. | United States. |
| Webhook destinations chosen by the firm | The firm chooses the system that receives the booking. We send it to the URL the firm configures. | Booking data. | Wherever the firm’s receiving system is hosted. |
Other disclosures. We may also disclose personal information to professional advisers; to a buyer or successor if the business is sold, under confidentiality; or where required or authorised by law (for example, a court order).
6. Overseas disclosure (APP 8)
Some of our service providers store or process data outside Australia, including in the United States and other countries where Cloudflare, Stripe, Google, our AI model providers (OpenAI-compatible hosts, Anthropic and Google), Resend, Sentry, PostHog, Vercel and Railway operate. Bunnings pricing queries are handled in Australia and do not include Homeowner personal information. We take reasonable steps, including contractual terms, reputable providers and security controls, so those providers handle personal information consistently with the APPs.
7. How long we keep it
| Data | Retention |
|---|---|
| Homeowner photos and videos | Deleted automatically 7 days after the job’s quote case is closed, and in any case within 30 days. |
| Homeowner contact details, address, conversation, quote and booking records | Kept for the firm while the firm’s account is active, then deleted or de-identified 24 months after the case is created, or within 90 days of the firm closing its account, unless the firm has exported the records or the law requires us to keep them longer. |
| Firm User accounts and Google sign-in data | While the account is active. Deleted within 30 days of an account deletion request or account closure, except limited records we must keep. |
| Firm configuration (pricing, branches and similar settings) | While the firm is a customer, then deleted within 90 days of closure. |
| Server logs | Up to 7 days (Cloudflare Workers Logs). |
| Error reports | Up to 90 days (Sentry). |
| Database backups | Rolling 30-day point-in-time recovery, plus encrypted backups kept for up to 90 days. |
| Website contact-form leads | Up to 24 months from last contact, or until you ask us to delete them. |
| Invoices and business records | 7 years, for tax and business-record obligations. |
8. Security
We use encryption in transit (HTTPS/TLS) and at rest, access controls and multi-tenant separation so each firm sees only its own data, short-lived widget tokens, restricted origins for the widget, rate limiting, secrets management, audit logs and error monitoring. No system is completely secure. If we become aware of a data breach that is likely to cause serious harm, we will act in line with the Notifiable Data Breaches scheme, including notifying affected firms, individuals and the Office of the Australian Information Commissioner (OAIC) where required.
9. Access, correction and deletion
- Homeowners: contact the firm you requested the quote from, or email us at support@instaquoteai.app. Because we act for the firm, we may pass your request to the firm or ask it to confirm, and we will help you either way.
- Firm Users and Visitors: email support@instaquoteai.app.
We'll respond within 30 days. We may need to verify your identity. We may refuse access or deletion where the Privacy Act allows, and we'll tell you why. There is no charge for making a request.
10. Cookies and similar technologies
- The firm console uses essential cookies to keep you signed in.
- The widget stores a short-lived session token in memory or browser storage to keep your chat connected. It does not set advertising cookies. Usage events described in section 2.1 are part of operating the service and are separate from the cookie banner on this marketing website.
- Our website uses PostHog analytics cookies only with your consent.
11. Children
Instaquote is for businesses and adult homeowners. It is not directed at children under 16, and we don't knowingly collect their information.
12. Complaints
If you have a privacy question or complaint, email support@instaquoteai.app. We don't publish a postal address. Email is the contact for privacy, support and legal notices. We'll acknowledge a complaint within 5 business days and aim to resolve it within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au (opens in a new tab), 1300 363 992.
13. Changes
We may update this policy. We'll post the new version here with a new "Last updated" date and, for material changes, tell firms by email or in the console.
14. Contact
Henry (Harry) Pickering trading as Instaquote, ABN 38 193 580 481
Victoria, Australia
Email: support@instaquoteai.app (privacy, support and legal)
Website: https://instaquoteai.app (opens in a new tab)
The firm console is at firm.instaquoteai.app. Questions about this policy can be sent to the email address above.