QuotePDF Privacy Policy
Last updated: 2026-11-02
Who operates QuotePDF
QuotePDF is operated by Onnuri Stationery (Onnurimun). Contact [email protected] for privacy, access, correction, deletion, or security requests.
Data and purposes
At the merchant's instruction, QuotePDF reads the Ecwid store profile and catalog to generate PDF quotations. The profile can include the merchant's business name, contact details, logo, currency, and address. Buyer details and notes entered by the merchant are processed only to calculate and generate the requested quotation. The merchant is responsible for having an appropriate basis to use buyer information and for handling the PDFs they download.
We request only control-panel embedding, store-profile read access, and catalog read access. We do not read orders or customer accounts, change the catalog, send marketing messages, or sell quotation or buyer information.
Storage and retention
Quotation contents and recipient details are processed in memory and are not saved to a database or quotation archive on our server. PDFs are returned to the merchant for download. The merchant controls downloaded copies.
Ecwid access tokens and cached store information are held in server memory. A session expires after 12 hours without activity; unused sessions are also cleaned up by the hourly cleanup job. A verified uninstall or personal-data removal event invalidates the store's sessions. The browser keeps only an opaque session identifier in session storage, not an Ecwid access token.
To avoid processing webhook retries twice, we retain only an opaque event ID and receipt time. Receipts expire after seven days and are removed from the receipt file on startup, on subsequent events, and during hourly cleanup while the service is running. Webhook payloads, store IDs, and customer details are not stored in this receipt file.
Minimal operational logs can include timestamps, event types, store IDs, and technical error codes for security and troubleshooting. Application logging redacts sensitive fields and does not intentionally record quotation contents, recipient details, tokens, or passwords. Contact us about access to or removal of any operational records relating to your store.
Service providers and security
Ecwid provides the store API and installation/billing services. Our hosting infrastructure runs the application, and Cloudflare provides HTTPS delivery and network protection. These services process traffic needed to operate the app, which can include connection information such as IP addresses. We do not send quotation content to AI, advertising, or analytics services.
Traffic is encrypted with HTTPS. Ecwid access tokens stay server-side; requests to generate quotations require an authenticated session and a CSRF token. Incoming Ecwid webhooks are checked against the application secret.
Privacy requests and uninstall
We handle privacy requests received from Ecwid and through the contact email above. We do not retain an archive of buyer or quotation data to export. We invalidate relevant sessions on removal requests and address any retained operational records separately. If you contact us directly, provide your store ID and the nature of the request; do not send access tokens or unnecessary buyer information. We may verify the request before responding.
Uninstalling removes the app's access through Ecwid. On receipt of the verified uninstall webhook, QuotePDF invalidates the store's active sessions. QuotePDF does not modify the storefront. App billing is managed by Ecwid.