Effective & last updated — August 21, 2026
Privacy Policy
1. Who we are
JohnnyAI Quote is a product of JohnnyAI Labs LLC ("JohnnyAI," "we," "us," "our").
You can reach us at:
- Email: quote@johnnyai.io
This Privacy Policy explains what information we collect when you use the JohnnyAI Quote website at johnnyai.io and related services (the "Service"), how we use it, when we share it, and the choices you have about it.
2. Scope
This policy applies to:
- Visitors to our marketing website
- People who create an account and use our document analysis tool at
/app - People who receive analysis results by email or shared link
- People who contact us directly
This policy does not apply to third-party services we link to or that you integrate on your own (for example, if you paste a link from our results into a Google Doc, Google's privacy policy governs what happens there).
3. Information we collect
We collect the minimum information needed to provide the Service. Categories:
3.1 Information you provide directly
Account information. When you create an account, we collect your email address and authentication credentials (managed by our authentication provider, Supabase). We may also collect a display name, company name, and billing information if you subscribe to a paid plan.
Analysis submissions. When you use the document analyzer, you provide:
- Uploaded documents (PDFs, Word, Excel files — typically fixture schedules, spec books, vendor quotes, EC counts, and related lighting-project documents)
- An optional recipient email address if you request RFI emails or analysis delivery
- Follow-up questions you ask about your documents
- Optional brand/letterhead information (company name, logo, terms) if you configure a brand profile for exported quotes
Direct communications. If you email us or fill out a contact form, we receive whatever you send.
3.2 Information collected automatically
Server logs. Our web server records standard technical information for every request: IP address, timestamp, request path, HTTP status, response size, referrer, and browser user-agent.
Analytics. We use Plausible Analytics, a privacy-focused analytics service that does not use cookies, does not collect personal data, and does not track you across websites. Plausible tells us aggregate information like which pages get visited and which buttons get clicked. It does not tell us who you are as an individual.
Rate-limiting. Our servers keep short-lived records of requests by IP address and account to prevent abuse. These records expire automatically within an hour.
3.3 Information we do NOT collect
- We do not use tracking cookies for advertising
- We do not sell your data to advertisers or data brokers
- We do not fingerprint your device
4. How we use your information
| Purpose | Categories used |
|---|---|
| Deliver document analysis you request | Uploaded documents, account email |
| Send RFI emails or analysis results by email | Recipient email, generated results |
| Bill your subscription | Account email, billing information (via Stripe) |
| Reply to your inquiries | Direct communications |
| Operate, monitor, and improve the Service | Server logs, aggregate analytics |
| Detect and prevent abuse | IP addresses, rate-limit records |
| Comply with legal obligations | All of the above, when required |
We do not use uploaded documents to train AI models. (See §6.)
5. Storage, retention, and deletion
Where your data lives. Data is stored on servers hosted by Amazon Web Services in the United States. Account and billing data is stored with our providers Supabase and Stripe. If you are located outside the United States, your information will be transferred to and processed in the US.
| Data type | Current practice |
|---|---|
| Uploaded documents & analysis results | Retained until you request deletion or close your account (see note above) |
| Account & billing data | Retained while your account is active, plus a reasonable period after closure for legal/accounting purposes |
| Server access logs | Rotated on a rolling basis |
| Rate-limit records | Expire automatically within about an hour |
| Analytics data (Plausible) | Aggregated only; no individual retention |
| Email correspondence | Until the matter is resolved, kept afterward for reference |
Requesting deletion. You can ask us to delete your data at any time by emailing quote@johnnyai.io. We will honor deletion requests except where retention is required by law.
6. AI processing and third-party model providers
JohnnyAI Quote uses Anthropic's Claude API to analyze the lighting documents you upload. When you use the analyzer:
- Your documents are transmitted to Anthropic for processing
- Anthropic processes them under its Commercial Terms of Service and its Usage Policy
- Anthropic does not use your data to train its models (per Anthropic's published API terms as of the effective date of this policy)
- Anthropic may retain data briefly for abuse-detection purposes, per its own policies
We do not authorize Anthropic or any other AI provider to use your documents for model training. If Anthropic's policies change, we will update this document and notify existing users.
7. When we share information
We share information only in these circumstances:
Service providers. We use a limited set of vendors to operate the Service:
| Vendor | Purpose | Data shared |
|---|---|---|
| Amazon Web Services (AWS) | Hosting | All operational data |
| Supabase | Account authentication, application database | Account email, application data |
| Anthropic | AI document analysis | Uploaded documents, follow-up questions |
| Postmark | Transactional email delivery | Recipient email, message content |
| Stripe | Payment processing | Billing details |
| Plausible Analytics | Anonymous usage analytics | Aggregate page views, no personal data |
Each vendor is contractually required to protect your information and use it only to provide the specific service.
Legal requirements. We will disclose information if required by law, court order, or valid government request. We will notify you before doing so unless legally prohibited.
Business transfers. If JohnnyAI Labs LLC is acquired, merged, or reorganized, information may transfer to the successor entity. We will notify you and give you the opportunity to delete your data before any transfer of personal information.
With your consent. We may share information for other purposes if you explicitly tell us to.
We do not sell your personal information. We do not share it with advertisers or data brokers.
8. Confidentiality of your project documents
The lighting documents you upload frequently contain third-party confidential material: manufacturer pricing, spec book content owned by lighting designers, project addresses, and vendor terms. We treat this content as confidential to you and to the third parties whose IP it contains.
- Your uploaded documents are not shared with other users
- Your results are not shared with other users
- Shareable result URLs at
/r/<id>are unlisted (they don't appear in search engines and require the exact link to access) but they are technically public — anyone with the link can view. Only share the link with parties who should see the analysis. - We do not aggregate your uploads into training data, benchmark sets, or marketing collateral
If you upload documents you are not authorized to process, you accept responsibility for that use — see the Terms of Service.
9. Your rights and choices
Depending on where you live, you may have specific rights over your personal information. Regardless of jurisdiction, we honor these rights for all users:
- Access. Request a copy of what we have about you
- Correction. Ask us to fix inaccurate information
- Deletion. Ask us to delete your data (see §5)
- Objection. Ask us to stop using your data for a specific purpose
- Portability. Request your data in a machine-readable format
- Withdrawal of consent. Where processing is based on consent, withdraw at any time
To exercise any of these, email quote@johnnyai.io with your request. We will respond within 30 days.
9.1 California residents (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA:
- Right to know what personal information we collect, use, and share
- Right to delete personal information we collect
- Right to correct inaccurate personal information
- Right to opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined under the CCPA)
- Right to limit use of sensitive personal information (we do not collect sensitive personal information as defined by the CCPA)
- Right to non-discrimination for exercising these rights
To exercise these rights, email quote@johnnyai.io with the subject line "CCPA Request."
9.2 European Economic Area and United Kingdom
If you are in the EEA or UK, you have rights under the GDPR and UK GDPR including the rights above plus the right to lodge a complaint with your local data protection authority.
Our legal bases for processing: Contract (providing the analysis you request and your subscription), consent (optional email delivery, marketing communications), and legitimate interests (operating and securing the Service, preventing abuse, improving the product).
10. Security
We use standard industry practices to protect your information:
- HTTPS (TLS) for all data transmitted between your browser and our servers
- Account authentication via Supabase, with credentials never stored in our own database
- API keys and secrets stored in root-owned files with restrictive permissions, outside the web root
- Rate-limiting on endpoints that accept uploads or perform analysis
- Regular software updates on our servers
No system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you as required by applicable law.
11. Children
JohnnyAI Quote is intended for professionals in the lighting industry. You must be at least 18 years old to use the Service. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.
12. International visitors
The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to, stored, and processed in the US. By using the Service, you consent to this transfer.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this document, post a notice on the Service, and — for users we have contact information for — send an email notification before the changes take effect.
Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
14. Contact
Questions, requests, or complaints about this Privacy Policy or our data practices: quote@johnnyai.io