Privacy Policy

1. Who we are

Monteca Group OÜ, registered in Estonia, is the data controller for GetCostify (getcostify.app) and is responsible for your personal data under this Privacy Policy and, where applicable, the EU General Data Protection Regulation (GDPR).

2. What we collect

• Account data — your email address and password (stored in hashed form by our authentication provider; we never see it in plain text).
• Business data you enter — ingredients, recipes, prices and related figures you create in the app. If you're signed in, this syncs to our database; if you're not, it stays only in your browser.
• Payment data — handled entirely by Stripe. We receive confirmation that a payment succeeded and a subscription status, never your card number.
• Basic technical data — standard web server logs (IP address, browser type, request timestamps) generated automatically by our hosting and infrastructure providers for security and reliability.
• Analytics data — if you accept our cookie banner, Google Analytics records anonymized usage patterns (pages viewed, general location, device type) to help us understand how GetCostify is used. This only runs after you consent; if you decline or ignore the banner, no analytics cookies are set.

We do not use advertising cookies or ad tracking. Analytics only runs with your consent — see Section 6 (Cookies) below.

3. How we use it

We use your data to: provide and operate the Service (including syncing your data across devices); authenticate you and secure your account; process PRO subscription payments and manage billing; send you transactional emails (e.g. confirming your email address); and to detect, prevent and respond to fraud, abuse or security issues.

We do not sell your data, and we do not use your business data (ingredients, recipes, prices) for any purpose other than providing the Service to you.

4. Legal basis (GDPR)

We process your data under the following legal bases: performance of our contract with you (providing the Service you signed up for); our legitimate interest in operating, securing and improving the Service; and compliance with legal obligations (e.g. tax records for payments).

5. Who else processes your data

We use a small number of trusted service providers ("processors") to run GetCostify, each bound by their own data protection commitments:

• Supabase — hosts our database and handles authentication (account login, password storage).
• Stripe — processes PRO subscription payments and acts as merchant of record for these transactions.
• Resend — delivers transactional emails (e.g. email confirmation) on our behalf.
• Google Analytics — measures site usage, only after you accept the cookie banner.

These providers may process data on servers located in the EU or in countries recognized as providing an adequate level of data protection, or under appropriate safeguards such as Standard Contractual Clauses.

6. Cookies

If you use GetCostify without signing in, your ingredient and recipe data is saved using your browser's local storage — a standard web technology, not a tracking cookie. This data stays on your device and is never sent to us unless you create an account and sign in to sync it.

We use one category of cookie beyond that: analytics cookies (Google Analytics), which are off by default. The first time you visit, a banner asks whether you're OK with them. If you accept, Google Analytics sets its cookies and starts measuring anonymized usage; if you decline or close the banner without choosing, no analytics cookies are set and nothing is measured. We don't use advertising cookies at all.

You can change your mind at any time by clearing your browser's site data for getcostify.app, which resets the banner so you can choose again.

7. How long we keep it

We keep your account and business data for as long as your account is active. If you ask us to delete your account, we will delete your personal data and business data within a reasonable time, except where we're required to retain certain records (e.g. payment/tax records) for legal or accounting purposes.

8. Your rights

Under GDPR, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your account and data; export your data in a portable format; object to or restrict certain processing; and lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at support@getcostify.app — we'll respond within a reasonable time and, in any case, within the timeframes required by law.

9. Security

We rely on industry-standard security practices from our infrastructure providers, including encrypted connections (HTTPS/TLS) and database-level access controls that restrict each account to its own data. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information.

10. Children's privacy

GetCostify is not directed at children, and accounts require you to be at least 16 years old. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above whenever we do.

12. Contact

Monteca Group OÜ
Estonia
Email: support@getcostify.app