Privacy Policy

1. Introduction & Roles

Welcome to CostTrack. We are committed to protecting your personal data and respecting your privacy in compliance with the UK GDPR and EU General Data Protection Regulation (GDPR).

For the purposes of data protection laws, You (the user) are the Data Controller regarding the financial documents, invoices, and quotes you upload. CostTrack acts as the Data Processor, providing the platform and tools to process this data on your behalf.

2. Data Storage & Residency (Sub-processors)

All core application data—including your profile, project details, and financial ledgers—is stored securely using our primary infrastructure provider, Supabase.

We enforce strict data residency. Your data is stored on servers located within the UK/EU, ensuring compliance with local data protection regulations. We do not transfer your core database outside of these jurisdictions.

3. AI Processing & Third-Party Training

When you upload documents for AI-powered scanning, we utilise Google Cloud Platform (GCP) and Google Gemini to extract the data. Google acts as a sub-processor in this context.

Crucially, we use GCP under their strictly controlled "Paid Services" terms. This explicitly means that your documents, financial data, and personal information are NEVER used to train Google's AI models or any other third-party models.

The processing by Google is transient, used solely to return the extracted JSON data to your CostTrack ledger, and is not retained by Google for model improvement.

4. Data Retention and Right to Erasure

Under UK/EU GDPR, you have the "Right to be Forgotten". We have built self-serve tools directly into CostTrack to allow you to exercise this right instantly, without needing to contact support.

You can permanently purge your uploaded documents (receipts/invoices) from our cloud storage buckets at any time via the Privacy tab in your settings. You may also permanently delete your entire account and all associated projects. Once deleted, this data is removed from active databases and will drop out of our encrypted backups after 30 days.

5. Contact Us

If you have any questions about this Privacy Policy, our sub-processors, or how we handle your data, please contact us at support@costtrack.build.