Privacy Policy

This policy explains how Shobha Gupta, trading as CostReveal, a sole proprietorship based in Gurugram, India ("CostReveal", "we"), handles personal data when you visit our websites, request a demo, or use the CostReveal service. For data we process on behalf of a customer organization, the customer is the controller and our Data Processing Agreement applies.

Who we are

CostReveal, Gurugram, India. You can reach us about anything in this policy at privacy@costreveal.com.

What we collect

• Account data. Your name, work email address, a hash of your password (never the password itself), your two step verification settings, and the organizations and roles you belong to.
• Organization data. The organization's name, verified company domain, projects, settings, and the members and invitations it manages.
• Provider data. Billing and usage records that a customer connects, such as an AWS Cost and Usage Report. These describe spend and resources, and can include resource names and tags that the customer chose.
• Security records. Sign in events, active sessions, the IP address and browser of each session, and an audit trail of changes made in the organization.
• Demo requests. The name, work email, company, role, spend band and note you enter on the demo form.
• Support tickets. What you write to us in a ticket, and our answers.
• Email. The messages we send you, such as verification links, invitations and security notices.
• Billing data. For a paid plan: the billing contact's name and email, the billing address, and any tax ID entered at checkout. Card details are entered on Stripe's checkout and never reach CostReveal.
• Usage analytics. Only if you agree, where Google Analytics is turned on: the pages visited and how the app is used, with the account's opaque ID, its role context and its organization's plan. Never a name or an email address.

We do not buy personal data, and we use no advertising trackers.

Why we use it

• To provide the service: to sign you in, attribute your organization's spend, and show it to the people it chooses. This is necessary to perform our contract with you or your organization.
• To keep the service secure: to detect abuse, limit repeated attempts, and investigate incidents. This is our legitimate interest in protecting customers and the service.
• To answer a demo request, which you ask us to do.
• To meet legal obligations, such as tax and accounting records for paid plans.

We do not sell personal data, and we do not use customer provider data to train models or for any purpose other than providing the service to that customer.

Cookies

The CostReveal app needs three cookies to work: a session cookie, a refresh cookie, and a cookie that protects forms against cross site request forgery. Where Google Analytics is turned on, we ask first. Only if you agree do the app and our websites set Google Analytics cookies (_ga and _ga_ followed by an ID) to measure visits and use, and we keep your choice in one cookie of our own for a year. Change it at any time from Cookie settings at the foot of our websites, or in the app under your account's preferences; withdrawing consent stops measurement and removes those cookies.

Who we share it with

• Service providers that host and operate CostReveal on our behalf, under contracts that bind them to protect the data and use it only for us. The current list is available on request from privacy@costreveal.com.
• Stripe, which takes payment for paid plans and keeps their invoices, as an independent controller of card data under its own privacy policy.
• Google, which measures visits and use where Google Analytics is turned on and you agreed.
• Your organization. Owners and admins of an organization can see its members, their roles and its audit trail.
• Authorities, when the law requires it. We push back on requests that are not legally valid, and tell the affected customer unless we are prohibited from doing so.

How long we keep it

• Account and organization data: for as long as the account or organization exists, then deleted on erasure.
• Sessions: removed 30 days after they end. Expired sign in and reset links: removed after 7 days.
• Audit trail: 90 days, or 365 days on the Enterprise plan.
• Refused requests, such as failed sign ins, with their IP address: one year, to trace an attack back.
• Demo requests: one year.
• Billing records and invoices: for as long as tax and accounting law requires, kept by Stripe.
• Provider data: for as long as the customer keeps the connection and the organization, as set out in the customer's agreement with us.

Your rights

Depending on where you live, including under the GDPR, the UK GDPR, India's Digital Personal Data Protection Act and the California Consumer Privacy Act, you can ask to access, correct, export or delete your personal data, and object to or restrict how we use it.

You can export your personal data and erase your account yourself from Your account, Privacy in the app. For anything else, write to privacy@costreveal.com. If your data is held for an organization you belong to, we may refer your request to that organization as the controller. You can also complain to your local data protection authority.

Security

We protect personal data with tenant isolation in the database, encryption of stored credentials, Argon2id password hashing, and least privilege access for staff. The security overview describes these controls in detail.

International transfers

CostReveal may process data outside the country where you live. Where the law requires it, we protect transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

Children

CostReveal is a business service and is not intended for anyone under 16.

Changes

If we change this policy in a way that matters, we will update the date above and tell account owners by email before the change takes effect.