Privacy policy
1. Who we are
costin is job management software for builders, made by site software Ltd, a company registered in England and Wales (company number 17471847), registered office 8 Mostyn Road, Bushey, Hertfordshire, WD23 3PN. In this policy, “we”, “us” and “our” mean site software Ltd.
We are registered with the Information Commissioner’s Office (ICO), registration number ZC263204.
For anything about your personal data, email [email protected].
2. Two different roles
We handle personal data in two different capacities, and it matters which one applies to you.
| Whose data | Our role |
|---|---|
| People who visit costin.app, contact us, sign their firm up, or use costin as a named login at a building firm | Controller. We decide how and why this data is used. This policy explains it. |
| People whose details a building firm keeps in costin: its customers, employees, subcontractors, suppliers and contacts | Processor. The building firm is the controller and decides what is kept and why. We only store and process it on the firm’s instructions, under our terms of service. If you are one of those people, please contact the building firm first. We will pass any request we receive to them. |
3. What we collect, and why
If you visit costin.app
Cloudflare, which hosts this website, counts visits for us with Cloudflare Web Analytics: which pages are viewed, the page you came from, and your browser, type of device and country. It uses no cookies, does not follow you across other websites, and we only see totals, not individual visitors. Lawful basis: our legitimate interest in knowing which pages are useful.
If you email us
Your name, email address, company name and anything you choose to tell us. We use it to reply, and to understand what builders need. Lawful basis: our legitimate interest in answering enquiries and building the product, or your consent where we ask for it.
If you have a login to costin
- Account details: name, email address, the firm you work for and your role in it.
- Sign-in records: when you signed in and were last active, the type of device and browser, and the internet (IP) address used, so you and your firm can see where a login is in use and sign out a lost device. We also record failed sign-in attempts (the email address tried and the IP address) to protect accounts against guessing.
- Passwords are stored only as a one-way scrambled form (a “hash”). We cannot read them, and nobody at site software Ltd ever asks for your password.
- Support: anything you send us when asking for help, including, where your firm agrees, a copy of a document that wasn’t read correctly (see section 5).
Lawful basis: performing our contract with your firm, and our legitimate interest in keeping accounts secure.
If your firm signs up and pays for costin
When a firm signs up, the person signing up gives their name, email address, phone number, the firm’s name, the web address they would like for their costin, and how many logins they need. We use these to set up the firm’s costin and send its first sign-in link. We also keep the billing contact’s details and records of invoices and payments.
Payments are taken by our payment provider, Stripe. Sign-up and payment happen on Stripe’s own secure page, so card and bank details go straight to Stripe and are never seen or stored by us. Stripe also sends receipts and payment reminders on our behalf, and runs its own fraud checks; for those checks Stripe acts as a separate controller under its own privacy policy. Lawful basis: contract, and our legal duty to keep financial records.
4. Cookies
The costin.app website does not use cookies for advertising, tracking or analytics. The costin app itself sets one essential cookie that keeps you signed in. It is needed for the app to work, so no consent banner is required for it.
5. Who we share data with
We do not sell personal data, and we do not use it for advertising. We use a small number of suppliers to run costin:
| Supplier | What for | Where |
|---|---|---|
| Fly.io, Inc. | Hosting the app, its database, documents and backups | London, UK data centre. Fly.io is certified under the UK Extension to the EU–US Data Privacy Framework. |
| Cloudflare, Inc. | Domain name service for costin.app, hosting this website and counting visits to it, and keeping an off-site copy of each nightly backup | Backups: the EU, locked (encrypted) on our servers before they are sent, so Cloudflare cannot read them. Otherwise its global network. |
| Microsoft (Microsoft 365) | Receiving and answering emails to costin.app addresses, including support requests and any screenshots or documents attached to them | UK or EU data centres. Covered by Microsoft’s Data Protection Addendum. |
| Resend (Plus Five Five, Inc.) | Delivering the emails a builder sends from costin (invoices, quotes, orders, progress updates), with the attached PDF | Resend is a US company; covered by its Data Processing Agreement and the UK International Data Transfer Addendum. Emails are sent from its EU (Ireland) region where that is enabled for our sending domain. |
| Twilio Inc. | Only if a firm turns on texts from costin: sending a short text, shown as from the firm’s name, with a link to a quote, invoice or progress update, to the customer’s mobile number | US. Covered by Twilio’s Data Protection Addendum and the UK International Data Transfer Addendum. |
| Stripe Payments UK, Ltd. | Taking card and Direct Debit payments for costin, sending receipts and payment reminders, and letting firms update their payment details or cancel | UK and EU, with some processing in the US under the UK International Data Transfer Addendum. Covered by Stripe’s Data Processing Agreement. |
| AssemblyAI, Inc. | Only if a firm records a voice note on a site visit: turning the recording into text | Its EU servers. Recordings sent there are not used to train its models, and costin asks for each one to be deleted as soon as its text comes back. |
| Xero or Intuit (QuickBooks) | Only if your firm connects its accounting software: invoices, bills and the matching contacts are sent to that firm’s own accounts, and whether an invoice has been paid is read back | Under Xero’s or Intuit’s own terms |
| HM Revenue & Customs | Only when a firm verifies a subcontractor for CIS, or makes a return or submission to HMRC, through costin: the details the firm sends, with the device and connection details HMRC requires by law | UK, under the firm’s own duties to HMRC |
| GitHub, Inc. | Holds the list of costin app names (the part of each firm’s address before costin.app) for a scheduled job. No personal data. | US |
Reading supplier invoices, making PDFs and making backups all happen on our own servers. The documents are not sent to any outside or AI service to do this. The one exception is a voice note recorded on a site visit, which is sent to AssemblyAI (above) to be turned into text; the recording itself stays in costin with the visit.
A building firm can send its own customer a quote, invoice, progress update or price breakdown from costin, on a private link. A progress update holds the progress notes and photos from that job’s site diary; only what the firm marks for sharing is included, and the firm decides who receives the link. When one of these links is opened, costin records the time and whether it was opened on a phone or a computer, and tells the firm, so it knows the document has been seen. It is the firm’s responsibility to tell its customers this.
If a login turns on costin’s calendar feed, the visits and jobs in it, with the customer’s name, address and phone number, go to that person’s own calendar provider (for example Apple or Google). If a login turns on notifications, the short wording of each one goes through the push service of their phone or browser (Apple, Google, Mozilla or Microsoft). Both are off until the person turns them on, and stop when they turn them off.
If a firm chooses to send us a document that costin read incorrectly, so we can improve the reading, a copy is kept only until we have looked at it, and then deleted.
We may also share data where the law requires it, or to protect the rights and safety of our users, or as part of a sale or reorganisation of the business (in which case this policy would continue to apply).
6. Outside the UK
costin’s data is stored in the UK, with an encrypted off-site copy of the backups in the EU. Some of our suppliers are based in the United States and may access data from there, for example to provide technical support. Where that happens we rely on the safeguards the law requires, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework. Fly.io and Cloudflare are both certified under the UK Extension. Twilio (texts) and Resend (email) are US companies; our contracts with them include the UK International Data Transfer Addendum.
7. How long we keep it
- Emails from people who aren’t customers: until you ask us to stop, or 12 months after we last contact you.
- Account details: while your firm uses costin. A sign-in record is removed when it expires, 30 days after the login was last used. Failed sign-in attempts are removed after an hour.
- Billing records: six years, as HMRC requires.
- Backups: each app is backed up nightly. Backups roll off automatically, within 30 days on the servers, within 60 days in our encrypted off-site copy, and within 8 weeks in our offline copy. So a record that has been deleted from costin remains in encrypted backups for up to 60 days before it is gone everywhere.
- When a firm leaves costin, its data is deleted as set out in our terms of service.
8. Keeping it safe
All connections use encryption (HTTPS). Each building firm has its own separate copy of the app and its own database, so one firm’s data is never stored alongside another’s. Logins have roles, so site staff don’t see prices or wages unless their firm allows it. Backups are checked when they are made. The off-site copy is encrypted before it leaves our servers, and offline copies are kept on encrypted equipment.
9. Your rights
You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict or object to how we use it, or to move it to another provider. Where we rely on consent, you can withdraw it at any time. Email [email protected]. We will reply within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
10. Changes
We will update this page if how we handle personal data changes, and tell account holders by email about anything significant.