Privacy Policy
Last updated: 5 July 2026
This Privacy Policy describes how QuillJet ("we", "us", "our") collects, uses, and protects personal data when you use our Webflow Marketplace application ("Service"). QuillJet is a Webflow Marketplace application that synchronizes events from a user's connected Webflow site (orders, form submissions and CMS items) into the user's connected third-party email marketing tool.
1. Controller
The provider of the Service is:
QuillJet, registered in the Netherlands, Chamber of Commerce (KvK) no. 97282812.
For privacy questions and data requests, use the contact form at https://quilljet.com/support.
2. What we collect
| Category | Examples | Lawful basis (GDPR) |
|---|---|---|
| Account data | Email address, Webflow user ID | Contract performance |
| Site data | Webflow site IDs, site names, connection status | Contract performance |
| Contact data (synced on your behalf) | Email address, first and last name, tags, and any additional Webflow field you map (which may include order details, phone, or address), contained in Webflow events and delivered to the email tool you connect | Processing on your behalf (you are the controller; see the DPA) |
| Usage data | Feature usage, event and delivery counts | Legitimate interest (analytics, abuse prevention) |
| Billing data | Stripe customer ID, subscription status (payment details handled by Stripe) | Contract performance |
| Support data | Messages you send us through the contact form | Contract performance |
| Technical data | IP address, browser user-agent, session timestamps | Legitimate interest (security) |
3. How we use it
- To provide the Service (receive Webflow events, extract a contact, and upsert it into the email tool you connect, and render your dashboards and event log)
- To bill you and handle subscriptions (via Stripe)
- To send you transactional email about your own account (for example, a notice when a delivery finally fails)
- To respond to support requests
- To improve the Service (aggregate, anonymized analytics)
- To comply with legal obligations
We do NOT sell your data. We do NOT use your data for advertising. We do NOT use your data to train AI models.
4. Sub-processors
We use the following third parties to operate the Service:
| Sub-processor | Purpose |
|---|---|
| Hetzner Online GmbH | Cloud hosting and database (EU, Germany) |
| Resend | Transactional email delivery |
| Stripe | Payment and subscription processing |
| Webflow | The source platform you connect (OAuth and webhooks) |
| Sentry | Error monitoring (only if enabled) |
In addition, the email tool you choose to connect is a recipient of personal data at your instruction. Depending on your setup this is one or more of: Mailchimp, Klaviyo, Brevo, MailerLite, ActiveCampaign, Omnisend, or GetResponse. Each receives only the contact email, name, mapped fields, and tags your sync rules send it, under your own agreement with that provider. A current list is maintained in the Data Processing Agreement at https://quilljet.com/legal/dpa.
5. Data retention
- Account and site data: retained while your subscription is active, and deleted within 30 days of account deletion.
- Billing records: retained as required by applicable tax and accounting law.
- Support messages: retained for a reasonable period for quality and audit purposes.
- Event and delivery logs: retained to power your event log and troubleshooting, and removed on account deletion.
6. Your rights (GDPR)
- Access: request a copy of the data we hold about you (one-click export from the panel)
- Rectification: correct inaccurate data
- Erasure: delete your account and all associated data (available in-app; processed within 30 days)
- Portability: receive your data in a machine-readable format
- Objection: object to processing based on legitimate interest
- Restriction: limit how we process your data
- Complaint: file a complaint with your local data protection authority
To exercise any right, use the contact form at https://quilljet.com/support. We respond within 30 days.
7. International transfers
Hosting and the primary database are located in the EU. Where personal data is transferred outside the EU/EEA (for example, to an email tool you connect that is based elsewhere), we and the receiving party rely on Standard Contractual Clauses or adequacy decisions. See the DPA for specifics.
8. Security
- Connection tokens and API keys are encrypted at rest with AES-256-GCM. The delivery adapters never see the encryption key.
- Incoming Webflow webhooks are verified by HMAC signature before we act on them.
- We request least-privilege, read-only Webflow scopes for the triggers you enable.
- Each account's data is isolated from every other account.
- Sessions use HMAC-signed tokens, and all connections are HTTPS-only.
- Hosting and the database are located in the EU.
To report a security issue, use the contact form at https://quilljet.com/support.
9. Cookies and tracking
The app panel uses one essential cookie or token to keep you signed in. We do not use advertising or cross-site tracking cookies.
10. Children
The Service is not directed at children under 16. We do not knowingly collect data from children.
11. Changes
Material changes to this policy will be communicated via the account email you provide at least 30 days in advance.
12. Contact
For privacy questions and GDPR data requests, use the contact form at https://quilljet.com/support.