Privacy Policy

This policy explains what QuickBOQ, operated by NSA Constructions ("we", "us"), does with your personal data when you use quickboq.in (the "Platform"). It is written to describe what the software actually does, not what a template says a website might do.

We are based in India and serve users in India. Your data is processed under the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023.

1. What we collect

Your account

Sign-in is handled by Google Firebase Authentication. Depending on how you sign in, we receive and store: your name, email address, mobile number (for mobile-OTP sign-in), your profile picture URL (Google sign-in), and a Firebase account identifier. You may optionally add a designation (for example "Assistant Engineer"), which is printed on documents you generate.

We do not store your password. If you sign in with an email and password, that password is held by Firebase, not by us.

Your work

The projects, estimates, BOQ items, measurements, rate analyses and non-scheduled items you create. This is your content. We store it so the Platform can show it back to you, and we process it only to run the features you use.

One exception you control: if you choose to share a non-scheduled item with the community, its code, description and rate build-up become visible to other users. Sharing is opt-in, per item.

Payments

Payments are processed by Razorpay. Card numbers, UPI IDs and bank credentials are entered on Razorpay's systems and are never sent to, seen by, or stored on ours. What we store is the order identifier, the plan, the amount, the payment status and the date, so we can show you your invoice history and activate your subscription.

Technical and security data

• A session cookie (session_token) that keeps you signed in. It expires after 30 days.
• Your IP address, used to apply rate limits that protect the service from abuse.
• A last-seen timestamp and a coarse activity label (for example "Editing an estimate", "Browsing the catalogue") so we can tell which accounts are active and support you when something goes wrong. This is derived from requests you are already making; we do not run any background tracker, and we do not record your screen or your keystrokes on the Platform.

Diagnostics

To find faults we cannot see from the server, your browser reports two things:

• Errors — when a page breaks, we record the error message, the page it happened on and the top of the technical stack trace.
• Searches that returned nothing — we record the search text, so we can tell whether our catalogue is missing an item or our search failed to find one that is there.

These reports carry your account identifier if you are signed in, and nothing identifying if you are not. Search text is stored as you typed it, so please do not type personal or confidential information into the search box. Diagnostic records are deleted automatically after 90 days.

Analytics, only if you allow it

If you accept analytics or marketing cookies in our cookie banner, we use Google Analytics 4, Microsoft Clarity and the Meta Pixel to understand how the Platform is used and how people arrive at it. Microsoft Clarity records how pages are interacted with, including mouse movement and clicks, to produce heatmaps and session playback. None of this runs until you agree, and you can change your mind at any time from the "Cookies" link in the footer. We strip anything that looks like an email address before it is sent to these services.

2. AI features, and what is sent where

QuickBOQ uses Google Gemini for two features: explaining a schedule item in plain language, and turning a plain-English search into a structured filter.

What is sent to Google: the question you typed, and the code, description and published rate build-up of the CPWD schedule item you are asking about — public reference data from the schedule of rates.

What is never sent to Google: your estimates, your measurements, your quantities, your totals, your project or client names, your contact details, or our item catalogue.

Your plain-English search text is stored on our servers so the same question does not have to be sent to the model twice, and so we can correct a bad interpretation. We do not use your data to train AI models, and we do not permit our providers to use it to train theirs.

3. Why we are allowed to process it

4. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's advertising. We use the following processors, each for the single purpose listed:

Some of these providers operate servers outside India. We will also disclose personal data where we are required to by law, by a court, or by a government authority acting under legal power.

5. How long we keep it

• Account and your estimates — until you ask us to delete the account.
• Sign-in sessions — 30 days, then deleted automatically.
• Error and empty-search reports — 90 days, then deleted automatically.
• Payment records — retained as long as tax and accounting law requires, even after account deletion.

6. Your rights

• Get a copy. Your Account page has an export that downloads everything we hold about you as a single file. No request needed.
• Correct it. You can edit your name, mobile number and designation from your Account page.
• Delete it. Your Account page has a deletion request. We act on it within 30 days and confirm when it is done. Payment records are kept where the law requires, and anything you chose to share with the community may remain.
• Withdraw consent. The "Cookies" link in the footer turns analytics and advertising off again. The Platform keeps working without them. Every marketing email carries an unsubscribe link; unsubscribing does not affect service emails about your account, your payments or your subscription.
• Complain. Write to our Grievance Officer below. If you are not satisfied, you may complain to the Data Protection Board of India.

7. Security

Traffic is encrypted in transit. Sign-in is delegated to Firebase so we never hold a password. Sessions expire. Administrative screens are restricted to named administrator accounts. Card details never touch our systems. No system is perfectly secure, and we do not claim otherwise — if a breach affects your data, we will notify you and the authorities as the law requires.

8. Children

QuickBOQ is a professional tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

9. Changes to this policy

If we change how we handle your data, we will update this page and the version date at the top. Where the change is significant, we will ask you to agree again the next time you sign in.