Privacy Policy
This policy explains what [[COMPANY]] (“CoatEngine”) collects when you use coatengine.com, why, who else sees it, and how long we keep it. It covers three different groups of people, and the answers differ for each:
- Contractors — account holders who subscribe to the Service.
- End Clients — people whose details a contractor enters, and who may open a quote link we host.
- Visitors — anyone browsing the public site.
The short version. We do not sell your data, we do not share it for advertising, we run no analytics or tracking product, and we never see or store a payment card number. The data we hold is the data the Service needs to estimate jobs, produce quotes, and bill a subscription.
1. What we collect from Contractors
Account and profile
Your name, email address (used as your sign-in identifier), password (stored only as a salted hash, never in readable form), phone number, company name, estimator name, and business address.
Branding you upload
Company logo, certification logo, partner logo, and quote cover image. These are resized on upload and stored on our server so they can be rendered into your quote documents.
Business configuration
Roughly thirty numeric settings you configure — profit margin, tax rate, deposit percentage, labour burden, paint yields, surface and preparation multipliers, workday hours, and similar. These are commercial settings, not personal data, but they are yours and we treat them as confidential.
Billing
Your subscription plan, status, billing interval, period dates, and the Stripe customer and subscription identifiers. If you use payment links, we also store your Stripe connected account identifier and whether it is enabled for charges.
We never receive, see, or store card numbers, CVCs, or bank details. All card handling happens on Stripe's systems. We store references, not instruments.
Usage and technical data
Server logs record a request identifier, the HTTP method and path, response status, duration, and your user ID. Our web server keeps a separate access log that includes IP addresses. IP addresses are also used, unhashed, as short-lived keys for rate limiting.
Two specific events — a public quote being viewed and a public quote being accepted or declined — are logged with the originating IP address.
We do not record browser user-agent strings anywhere, and email addresses are deliberately kept out of application logs.
2. What we collect about End Clients
Contractors enter details about their own customers. That data typically includes a first and last name, email address, phone number, and postal address, plus the address of the job site and a description of the work.
When a contractor shares a quote link, we additionally record, for that quote:
- the date and time it was first opened;
- whether it was accepted or declined;
- the date and time of that response;
- the IP address the response came from, kept as evidence that the acceptance happened.
If you are an End Client: we hold this data on behalf of your contractor, who decides what to collect and why. They are the controller; we are their processor. To see, correct, or delete your details, contact your contractor first — they can do it directly in the application. You may also write to support@coatengine.com and we will pass the request on and assist them in answering it.
Contractors also record workers by name, with hourly or daily pay rates, to calculate labour costs.
3. What we collect from Visitors
Ordinary web server logs, as described above. The public site runs no analytics, no advertising pixels, no session recording, and no tracking of any kind.
Note that our pages load web fonts from Google's servers. See Section 5.
4. Why we use it, and on what basis
| Purpose | Data |
|---|---|
| Providing the Service — calculating estimates, generating quotes | Project, client, worker and configuration data |
| Creating and securing your account | Name, email, password hash, verification codes |
| Billing and subscription management | Email, Stripe identifiers, plan and period data |
| Transactional email — verification, password reset, billing notices | Email address |
| Preventing abuse and brute-force attacks | IP address (short-lived counters) |
| Evidencing quote acceptance | Response, timestamp, IP address |
| Diagnosing faults and keeping the Service running | Server logs |
We process this data to perform our contract with you, to pursue our legitimate interest in operating and securing the Service, and to meet legal obligations such as tax record keeping. We do not rely on consent for any of it, and we do not process it for advertising.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
5. Who else processes it
| Provider | Role | What it receives |
|---|---|---|
| Stripe | Subscription billing, checkout, customer portal, and payment links on contractors' own connected accounts | Your email address, billing details you give Stripe directly, and payment card data, which goes to Stripe and never to us |
| Hostinger | Server hosting and outbound email | Everything stored by the Service, as our infrastructure provider, and the contents of transactional emails |
| Google Fonts | Web fonts on our pages | Your IP address and browser request headers, when your browser fetches a font |
| Let's Encrypt | TLS certificates | No personal data |
About the fonts. Our public pages — including the page an End Client opens to read a quote — load fonts from Google's servers. That means your IP address reaches Google when the page loads, before you have interacted with anything. We do not send Google anything else, and we receive nothing back. If this concerns you, most browsers and extensions can block those requests; the pages remain usable.
Error monitoring through Sentry is supported by the Service but is currently disabled. If we enable it we will update this policy first, and it is configured not to send personal data.
We may also disclose data where we are legally required to, to enforce our terms, or to protect the rights and safety of our users. If our business is sold or merged, data may transfer with it; we will say so here beforehand.
6. Where it is stored
All application data is held on a single server operated by Hostinger, located in [[HOSTING_REGION]]. Stripe processes data on its own infrastructure under its privacy policy. If you use the Service from outside that country, you are sending your data there.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, projects, quotes, clients, workers, financial records | Indefinitely, until you ask us to delete it — see Section 9 |
| Generated PDF documents | Never written to disk. Held in a memory cache for one hour, then regenerated on demand |
| Sign-in sessions | 8 hours |
| Email verification and password reset codes | 15 minutes |
| Team invitations | 72 hours |
| Public quote links | Stop working 90 days after the quote's validity expires |
| Rate-limiting counters | 1 to 5 minutes |
| Processed payment event records | 30 days |
| Backups | 30 days, then deleted |
Be aware that we do not delete business data automatically. Cancelling your subscription stops your access; it does not erase your account. We keep it so you can come back. If you want it gone, ask — see below.
8. Security
What we actually do, stated plainly:
- Traffic is encrypted in transit with TLS, with HTTP Strict Transport Security enabled.
- Passwords are stored as salted hashes and are never recoverable, by us or anyone else.
- Cookies are HttpOnly and same-site; they are marked secure in production.
- Every data-bearing endpoint filters by the signed-in account, and a test suite checks that one account cannot reach another's records.
- Sign-in, registration, verification, password reset and document generation are rate limited.
- The application runs as an unprivileged user inside a container, under a memory limit.
- The document renderer makes no outbound network requests: it resolves only permitted local file paths, and this is enforced by test.
- Payment webhooks are cryptographically verified before they are acted on.
- Dependencies are scanned for known vulnerabilities on a regular schedule.
No system is perfectly secure, and we do not promise that ours is. We take daily backups for operational continuity, but they are not a guarantee that data can be recovered. Keep your own copies of anything your business depends on.
9. Your choices and rights
Whatever jurisdiction you are in, we offer everyone the same rights:
- Access — ask for a copy of the personal data we hold about you.
- Correction — most of it you can edit yourself in the application; ask us for the rest.
- Deletion — ask us to erase your account and its data.
- Objection or restriction — ask us to stop a particular use.
- Complaint — raise it with us, or with your local data protection authority if you have one.
Write to support@coatengine.com from the address on your account. We respond within 30 days. We will not discriminate against you for exercising any of these rights.
On deletion: we remove your account and the projects, quotes, client records, workers and images attached to it. We keep what the law requires us to keep — principally payment and tax records — and copies persist in backups until those expire on their normal 30-day cycle. Deletion cannot be undone; export what you need first.
Marketing: we send transactional email only. We do not run marketing campaigns from the Service. Transactional messages about billing and security cannot be opted out of while you hold an account, because they are part of the service you are paying for.
10. Cookies
We use only what the Service needs to function, and no advertising or analytics cookies:
- a session cookie, so you stay signed in;
- a CSRF cookie, which protects your forms from being submitted by another site;
- a theme preference, stored in your browser's local storage and never sent to us.
Because these are strictly necessary, we do not show a consent banner. Blocking them will stop sign-in from working.
11. Children
The Service is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child's data reached us, write to us and we will remove it.
12. Changes
If we change this policy we will update the version and date above, and we will tell you before any material change takes effect.
Contact
[[COMPANY]]
[[ADDRESS]]
support@coatengine.com
Terms of Service · Privacy Policy · Data Processing Addendum