Privacy Policy

QUOTEY, INC. · Last updated 20 September 2026

Introduction

This policy explains how QUOTEY, INC. ("Quotey", "we", "us") handles personal information about the people we deal with directly: the individuals who use our platform, the brokers, insurers, underwriters and other businesses we sell to, the people who subscribe to our mailing lists, and visitors to our websites.

It applies to information we collect:

• On quotey.io, app.quotey.io, quotey.ai and app.quotey.ai, together our "Websites"
• In the Quotey platform, in respect of the individuals who log in and use it
• In email and other electronic messages between you and us
• At events, in sales conversations, and through business contact channels

Canadian privacy law defines "personal information" as information about an identifiable individual. Information about a business, on its own, is not personal information.

We are committed to handling personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Act respecting the protection of personal information in the private sector in Quebec, and other applicable Canadian privacy legislation.

Information brokers enter about their clients

Quotey licenses software to insurance brokerages. Brokers use that software to quote, place and service commercial insurance for their own clients. In doing so, they enter personal information about those clients into the platform.

Quotey is not the organization accountable for that information. The brokerage is. The brokerage holds the relationship with the insured, obtained the consent to collect the information, and decides what it is used for. Quotey holds and processes it only as a service provider, on the brokerage's instructions and under the terms of our agreement with them.

What this means in practice:

• We do not collect this information from individuals directly, and we do not use it for our own purposes.
• We do not sell it, and we do not use it for marketing.
• We access it only as needed to provide, support, secure and maintain the platform for the brokerage.
• Our obligations in respect of it are set out in our agreement with the brokerage, not in this policy.

Sub-processors used for this information. Providing the platform involves a small number of specialist providers that process client information on our instruction — including cloud hosting and storage, document processing, electronic signature, address lookup, and AI providers used for document extraction and quote analysis. We contract with each of them on terms consistent with our obligations to the brokerage, and brokerages can ask us for the current list at any time. Where a brokerage prefers not to use AI-assisted features, or wishes to use its own model, those features can be turned off for that brokerage.

Transmission to insurers. Obtaining quotes requires sending client information to insurers, and the platform does this on the brokerage's instruction as part of the quoting process. Insurers are not our service providers. Each is an independent organization accountable for the information under its own privacy policy, and decides for itself how and where it processes what it receives. Brokerages are responsible for having the consent needed to submit their clients' information for quoting, and insureds should direct questions about an insurer's handling of their information to that insurer or to their broker.

We apply the same security, retention and breach notification practices to this information as to our own records, and in some cases stricter practices where a brokerage's agreement requires it.

Who this policy covers

We are accountable for personal information about four groups.

Platform users sit in a particular position worth stating plainly. Your employer is our customer and holds the contract, but the record of you as a user — your credentials, your activity in the platform, your support history — is information about you, and we determine what it is used for. We are accountable for it, and the rights set out in this policy apply to it.

What we collect

Platform users. Name, business email address, job title, employer, telephone number, login credentials, authentication and session records, activity and audit logs showing actions taken in the platform, support tickets and correspondence, and user preferences.

Business contacts and prospects. Name, business email address, job title, employer, telephone number, business mailing address, records of meetings and correspondence, notes made by our team about commercial discussions, and the stage of any opportunity.

Subscribers. Email address, and where you give it, name and employer. We also record whether and when you consented to receive messages, which messages we sent, and whether you opened or clicked them.

Website visitors. IP address, browser type and version, operating system, device type, referring page, pages viewed, time spent, and similar technical and usage information.

We do not ask any of these groups for social insurance numbers, government identification numbers, credit scores, health information, or financial account details. If you send us information of that kind unprompted, we will delete it.

We do not knowingly collect information about individuals under 18, and our Websites and platform are not directed at them.

How we collect it

Directly from you, when you register for or use the platform, fill in a form on our Websites, subscribe to a mailing list, contact us, meet us at an event, or correspond with us.

From your employer, when a brokerage, insurer or other customer sets up user accounts for its staff or gives us contact details for the people we will be working with.

Automatically, as you use our Websites and platform, through cookies, server logs and similar technologies.

From third parties and public sources, including business directories, industry associations, publicly available professional profiles, and partners who refer business to us. Where we do this, we collect business contact information only.

How we use it

We use personal information to:

• Provide, operate, secure and support the Quotey platform, and authenticate users
• Administer our agreements with customers, including billing and collections
• Respond to enquiries, provide support, and investigate issues
• Notify users of changes to the platform, security matters, and service availability
• Manage our sales pipeline and commercial relationships
• Send marketing communications where we have consent to do so, as described below
• Understand how our Websites and platform are used, and improve them
• Comply with legal and regulatory obligations, and establish or defend legal claims

We rely on your consent for marketing communications and for non-essential cookies. For the other purposes above we rely on the consent given when information was provided to us, or on the exception in Canadian privacy law for business contact information collected to communicate with someone in relation to their employment.

We do not sell personal information. We do not use personal information to make decisions about individuals by automated means without human involvement.

Marketing emails

We send commercial electronic messages only where Canada's Anti-Spam Legislation permits it — either because you gave express consent, or because we have an existing business relationship with you that gives rise to implied consent.

Express consent. When you subscribe through a form on our Websites, you are giving express consent to receive marketing messages from us. We keep a record of when you subscribed, the form you used, and what the form said at the time.

Implied consent. If you are a customer, or have enquired about Quotey, CASL treats that as implied consent for a limited period. We treat implied consent as expiring in line with the statutory periods and stop sending on that basis once it lapses.

Every message we send includes:

• Our legal name and, where we use one, the name we carry on business under
• A physical mailing address at which we can be reached
• An email address or web address for contacting us
• A working unsubscribe link

Unsubscribing. You can unsubscribe from any message using the link in it, or by emailing info@quotey.io. We action unsubscribe requests promptly and in any event within 10 business days, as CASL requires. Unsubscribing from marketing does not stop service messages about the platform, such as security notices, billing, or changes to terms — those are not marketing and are sent to users as part of providing the service.

Withdrawing consent to marketing is separate from withdrawing consent to our handling of your personal information generally, which is dealt with below.

Who we share it with

We disclose personal information to service providers who perform functions on our behalf, under contracts requiring them to keep it confidential, use it only for the purposes we specify, and protect it to standards consistent with this policy.

This names our principal providers. Others support specific features from time to time; you can ask our Privacy Officer for the current list.

We also disclose personal information:

• To professional advisers, including lawyers, auditors and insurers, where needed
• In connection with a sale, financing or reorganization of our business, subject to the recipient being bound to use it for the same purposes
• To comply with a court order, law, or lawful request from a government or regulatory authority
• To establish, exercise or defend legal claims, or enforce our agreements
• With your consent, or where otherwise permitted or required by law

We do not disclose personal information to third parties for their own marketing purposes.

Transfers outside Canada

Platform data is stored in Canada. Our production database is in Montreal and our backups are in Calgary, both on Amazon Web Services.

Some processing takes place outside Canada:

• Application hosting. The Quotey platform runs on Railway, in the United States. Personal information is processed on that infrastructure while the service is running, even though it is stored in Canada.
• Email marketing through MailerLite, in the European Union.
• Payment processing through Stripe, and authentication through Stytch, in the United States.

While personal information is outside Canada it is subject to the laws of that country, and courts, law enforcement and regulatory authorities there may be able to obtain access to it under those laws.

Before engaging a provider outside Canada we assess the privacy and security practices it applies, and we contract for protection consistent with this policy and with Canadian privacy legislation. Where Quebec law applies, we complete the privacy impact assessment it requires before the information is transferred outside the province.

You can ask us where information about you is held by contacting our Privacy Officer.

Cookies and analytics

Our Websites use cookies and similar technologies. Strictly necessary cookies keep the site working, maintain your session and support security; these are set without consent because the service cannot be provided without them.

We do not use analytics cookies, advertising cookies, or any technology that tracks you across other websites. We do not build profiles of visitors and we do not run behavioural advertising.

If that changes we will update this policy and, for visitors in Quebec, ask for consent before setting any non-essential cookie.

Most browsers let you refuse or delete cookies. Blocking strictly necessary cookies may stop parts of our Websites working.

Security and breaches

We protect personal information with physical, organizational and technical safeguards appropriate to its sensitivity, including encryption in transit and at rest, access controls and least-privilege permissions, multi-factor authentication for staff and platform users, logging and monitoring, background checks and privacy training for staff, and regular security testing.

No method of transmitting or storing information is completely secure. Where we have given you credentials, you are responsible for keeping them confidential and for activity under your account.

If a breach of security safeguards involving personal information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, and keep records of breaches as the law requires. Where a breach affects information a brokerage entered about its clients, we will notify the brokerage without delay so it can meet its own obligations to those individuals.

How long we keep it

We keep personal information only for as long as it is needed for the purposes described in this policy, and for as long as required to meet legal, accounting and reporting obligations. When it is no longer needed, we delete it or anonymize it so that it can no longer be associated with an individual.

In general, information about platform users and business contacts is kept while the relationship is active and for a period afterwards; subscriber information is kept until you unsubscribe; and records we are required to keep for legal or accounting reasons are kept for the period the relevant law sets.

We are establishing defined retention periods for each category of information described in this policy, and will set them out here once they are in place.

You can ask us to delete personal information we no longer need for the purpose it was collected for. See Your rights, below.

Information brokers enter about their clients is retained according to our agreement with the brokerage and their instructions, not the periods above.

Your rights

You can ask us to:

• Confirm and give access to the personal information we hold about you, and tell you how it has been used and who it has been disclosed to
• Correct information that is inaccurate, incomplete or out of date
• Withdraw consent to our use or disclosure of your information, subject to legal and contractual limits
• Stop sending marketing communications
• Delete information we no longer need for the purpose it was collected for

Write to our Privacy Officer at info@quotey.io. We respond within 30 days, and will tell you if we need more time and why.

We may need to confirm your identity before acting. In limited cases the law allows or requires us to refuse access — for example where responding would reveal personal information about someone else, or where the information is protected by solicitor-client privilege. If we refuse we will tell you why and how to challenge that decision.

Withdrawing consent may mean we can no longer provide a service to you. Where that is the case we will explain the effect before acting.

Requests about a broker's client data. If you are an insured and your request concerns information a brokerage entered into our platform, contact the brokerage. We cannot act on that request without their instruction.

If you are in Quebec

Quebec's private sector privacy legislation gives you additional rights, and we apply them to everyone we deal with in Quebec.

Privacy Officer. Nick Kidd, Chief Executive Officer, is responsible for the protection of personal information at Quotey and can be reached at info@quotey.io.

Portability. You can ask us to give you the computerized personal information you provided to us in a structured, commonly used technological format, or to send it to another organization, within the limits the legislation sets.

Automated decisions. We do not make decisions about individuals based exclusively on automated processing. If that changes we will tell you at the time of the decision and give you the opportunity to make representations to a member of our staff.

Transfers outside Quebec. We carry out a privacy impact assessment before entrusting personal information to a provider outside Quebec, and proceed only where the information will receive adequate protection.

Confidentiality by default. Where we offer a product or service with privacy settings, those settings provide the highest level of confidentiality by default, without any action required from you.

Complaints. If you are not satisfied with our response, you may complain to the Commission d'accès à l'information du Québec.

A French-language version of this policy is available at quotey.io/privacy-fr.

Changes, and how to reach us

Changes to this policy. We post any changes on this page and update the date at the top. Where a change materially affects how we handle personal information, we will give notice on our Websites and, for platform users and subscribers, by email.

Contact. Questions, requests and complaints about this policy or our handling of personal information go to:

Nick Kidd, Chief Executive Officer and Privacy Officer QUOTEY, INC. 1555 Wentworth St, Suite 200, Whitby, Ontario L1N 9T6 info@quotey.io

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, to the Commission d'accès à l'information du Québec. If you are an insurance client, complaints about how your information was handled should go to your broker first.