Costrix
Legal

Privacy policy

What we hold, where it lives, who else touches it, and what you can ask us to do about it.

Last updated 22 August 2026

1. Who we are, and which hat we are wearing

Costrix is expense management software for UK and Irish businesses, run by [TODO: legal entity name, company registration number and registered address]. This policy explains how we handle personal data under UK GDPR and the Data Protection Act 2018.

We wear two different hats, and which one we are wearing changes who is answerable for what:

  • For your company’s expense data we are a processor. The receipts, expenses, approvals, statements and mileage your people put into Costrix belong to your company. Your company decides what goes in and why; we only handle it to run the service. Your company is the controller.
  • For account and billing data we are a controller. The company name, the admin’s name and email, the plan, and the record of what has been paid — we decide how that is used, because it is how we run Costrix as a business.

If you are an employee of a company that uses Costrix and you want to see, correct or delete your own data, talk to your employer first: they are the controller and we act on their instructions. [TODO: confirm with a solicitor whether a separate data processing agreement is offered to customers, and link it here if so]

2. What we hold

This is the full list, taken from the database itself rather than written from memory.

  • People. Name, work email, a hashed password (never the password itself), whether they are an admin or in finance, whether the account is active, their team, their line manager, their default currency, and whether they are expected to submit expenses at all.
  • Company car details, for people who have one: registration, fuel type, engine size band and the starting odometer reading.
  • Expenses. Merchant, date, amount, currency, VAT amount and the supplier’s VAT number, what the expense was for in the person’s own words, category, cost centre, how it was paid, how many people or nights it covered, and its status.
  • Receipts. The image or PDF that is uploaded, its file name, type and size, the text read from it, and the fields extracted from that text with a confidence score for each.
  • Approvals. Who approved or rejected an expense, when, and any comment they left.
  • Mileage. Date, destination, the customer or purpose of the trip, whether it was business or private, and either an odometer reading or a distance.
  • Credit card statements. The uploaded statement PDF, a masked card number and its last four digits, the statement date and balance, the cardholder’s name as printed on it, and every line on it — date, merchant text, reference and amount.
  • An audit log. Who did what, to what, and when. This is what makes an approval trail worth anything, so it is kept even when the thing it describes changes.
  • Sessions. An opaque random token and the date it expires, so you stay signed in.
  • Billing. Company name, the admin’s email, the plan and billing period, and the Stripe customer and subscription references. Card numbers never reach Costrix — they go straight from your browser to Stripe, and we only ever see a reference to a customer Stripe already holds.

We do not ask for and do not want special-category data — health, ethnicity, beliefs — and our terms ask you not to put it into Costrix.

3. What we use it for, and our lawful basis

  • To run the service — capturing receipts, routing approvals, reconciling statements, exporting to finance. Lawful basis: performance of our contract with your company.
  • To bill you. Lawful basis: performance of that contract, and our legal obligation to keep proper financial records.
  • To keep the service secure and honest — the audit log, session handling, and looking into abuse or a suspected breach. Lawful basis: our legitimate interest in a service that is not being misused, balanced against the fact that these records are about ordinary work activity, not private life.
  • To support you when you ask us for help. Lawful basis: our legitimate interest in answering the customer in front of us.

We do not profile anyone, we do not make automated decisions with a legal effect, and we do not sell data to anybody, ever.

4. Automatic receipt reading

When someone photographs a receipt, Costrix sends that image to an AI provider to read the merchant, date, total, VAT amount, VAT number and currency from it. The provider is configured by us on the server, and today it is one of Anthropic (Claude), Google (Gemini) or Meta (Llama). [TODO: name the single provider that is actually live in production, and delete the other two from this sentence]

Nothing else about the expense goes with it — not the person’s name, not their email, not their company. Just the picture of the receipt and a request to read it.

If AI reading is switched off, or the provider cannot read the file, Costrix falls back to text recognition that runs on our own server and sends the image nowhere at all. PDFs always take that route.

Costrix also asks Anthropic to suggest a category from an expense’s merchant name and purpose text. [TODO: confirm the provider’s contractual position on retention and model training, and state it here plainly]

5. Where your data is kept

Costrix runs on Railway. The application, the Postgres database holding everything described above, and the disk volume holding uploaded receipts and statement PDFs are all hosted in Railway’s US West (San Francisco) region. Your data is therefore stored in the United States, not in the UK or the EU.

Uploaded files are stored outside the web root. Nothing on that volume can be fetched directly by URL — every receipt image is served through a route that checks first that you are signed in and that the file belongs to your company.

6. Sending data outside the UK

Because our hosting is in the United States, and because some of the suppliers below are based there too, personal data you put into Costrix is transferred outside the UK. UK GDPR allows that only where an approved safeguard is in place.

[TODO: confirm the transfer mechanism — UK IDTA, or the UK Addendum to the EU SCCs, with Railway and with each sub-processor named below — and state which one applies to each before launch]

[TODO: decide whether to move the Railway project to an EU or UK region instead; UK finance customers may require it, and it is far simpler than papering the transfer]

7. Who else touches your data

These are our sub-processors — the suppliers we use to run Costrix. We do not add one without a good reason, and we will update this list when we do.

  • Railway — hosting, the database, and file storage for receipts and statements. Region: US West (San Francisco).
  • Stripe — payments and subscriptions. Stripe receives the admin’s email and your company name, and holds your card details directly. We never see the card number.
  • The AI provider used for receipt reading — receives receipt images and nothing else. See section 4.
  • Resend — transactional email. [TODO: Resend is installed but nothing in the app sends email through it yet — either wire it up and keep this row, or delete this row before launch]

Chasing somebody for a late expense claim does not go through us: Costrix opens a pre-written message in the manager’s own email client and they send it themselves, so no chase leaves your organisation through our systems.

We may also share data where the law requires it — a court order, or a properly made request from a regulator.

8. How long we keep it

While your account is live, we keep your data for as long as you keep it there. Nothing is deleted behind your back, and a person who leaves your company is deactivated rather than erased, so the expense history they are part of survives — which is what accounting records have to do.

When a trial runs out or a subscription is cancelled, the account goes read-only. Your data is still there and can still be exported in full.

A signup that is abandoned at the checkout is swept away automatically along with the hashed password it carried, and the short-lived record of the payment events we have already handled is only useful for a few days.

[TODO: set a written retention schedule — in particular, how long a cancelled read-only account is kept before it is deleted, and how long billing records are kept for HMRC purposes (usually six years). It must match section 7 of the terms of service]

9. Deleting your data

Ask us and we will delete your company’s data. The database is built so that removing a company removes everything that belongs to it — every user, expense, receipt, approval, statement, mileage entry and audit row — in one operation, deliberately, so that an erasure request is not a scavenger hunt.

Uploaded files on the storage volume and records held by Stripe for accounting purposes are handled separately. [TODO: confirm the deletion timescale offered to customers, e.g. within 30 days of the request]

10. Your rights

Under UK GDPR you can ask for:

  • a copy of the personal data held about you
  • anything wrong to be corrected
  • your data to be deleted
  • processing to be restricted, or to object to it
  • your data in a portable form — every plan, including a read-only one, has a one-click CSV export

Where we are the processor, send the request to your employer and they will pass it to us; where we are the controller, send it straight to hello@costrix.app. We will respond within one month.

If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first so we can put it right.

11. How we keep it safe

  • Passwords are hashed with bcrypt. We cannot read anybody’s password.
  • Signing in creates a random token stored in the database, held in a cookie the browser cannot read from JavaScript, sent only over HTTPS in production, and revocable by us at any time.
  • One company can never see another’s data. Every table that belongs to a customer carries the company it belongs to, and the database layer refuses to run a query at all unless it knows which company is asking — it fails closed rather than guessing.
  • Uploaded receipts and statements sit outside the web root and are served only through a route that checks who is asking.
  • Our own administrative accounts are separate from customer accounts, have their own login, and require a second factor from an authenticator app with no bypass.
  • When our support needs to see the app as one of your users to solve a problem, that session is recorded in the audit log with the name of the person who started it.
  • The audit log records who did what and when.

No system is perfect. If there is ever a personal data breach that is likely to be a risk to people, we will report it to the ICO within 72 hours and tell affected customers.

12. Cookies

Costrix sets two cookies and no more: one holding your session token, and one holding the date that session expires so we can keep you signed in without a database lookup on every page. Both are strictly necessary to sign you in, so there is no cookie banner to click through.

There is no analytics, no advertising, and no third-party tracking on this site or in the app. Our own administrative area sets two further cookies of the same kind, which no customer ever receives.

13. Children

Costrix is a business tool sold to companies. It is not aimed at children and we do not knowingly collect data about anyone under 18.

14. Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change matters to you — a new sub-processor, or a new use of your data — we will tell your admin before it takes effect.

15. Getting in touch

Email hello@costrix.app with anything at all about your data — a question, a request, or a complaint. [TODO: postal address for data protection correspondence] [TODO: confirm with a solicitor whether a data protection officer or a UK representative is required; if one is appointed, name them here]