Last updated October 21, 2026
Privacy Policy
This policy explains what information CostTrace collects when you use costtrace.us and the CostTrace app, what we do with it and the choices you have. In short: we use your data to run the service for you, we share it only with the providers that help us do that, and we don't sell it.
What we collect
- Account details: your name, e-mail address, company name, password (stored only as a secure hash) and account settings.
- Fleet records: units with their numbers, VINs, plates and notes; expenses; odometer readings.
- Invoices and e-mails: files you upload, and e-mails sent to your CostTrace invoice address, including attachments, the sender's address and the subject. These documents can contain details about vendors, drivers or other people; we process them on your behalf.
- Connected services: if you connect Samsara, the vehicle list and odometer readings it provides. Your Samsara API token is stored encrypted.
- Billing: your plan, invoices and payment status. Card details are entered on Stripe's pages and never reach our servers.
- Technical data: basic logs such as IP address, browser type and error reports, used to keep the service secure and working.
How we use it
- To provide CostTrace: reading invoices, filing expenses, calculating reports and cost per mile.
- To check uncertain invoices: CostTrace staff may look at a document and its results to correct them.
- To answer your questions and send service e-mails such as sign-in links, receipts and important changes.
- To bill you, prevent abuse and keep the service secure.
We don't sell your personal information, share it for advertising or use it to show you ads.
Who processes it for us
We rely on these providers, under agreements that let them use your data only to provide their service to us:
- Supabase: database, sign-in and file storage, on servers in the United States.
- Anthropic: the AI that reads invoices. Documents are sent to it only to get the reading back; under our agreement Anthropic doesn't use them to train its models.
- Postmark: receives e-mails sent to your invoice address and delivers our e-mails to you.
- Stripe and Link: payments, subscriptions and sales tax. Link acts as the merchant of record and handles payment data under its own privacy policy.
- Cloud hosting in the United States that runs the CostTrace app.
We may also disclose information when the law requires it, to protect our rights or users, or as part of a sale or reorganization of the business, in which case this policy continues to apply to it.
How long we keep it
We keep your data while your account is open, including after a trial ends, so nothing is lost if you come back. If you ask us to close your account, we delete your data within 30 days, except records we must keep for tax, accounting or legal reasons. Backups roll over and are removed on their regular schedule.
Security
Data is encrypted in transit (HTTPS) and at rest by our providers. Tokens for connected services, such as Samsara, are encrypted again by CostTrace. Access by staff is limited to what is needed to review invoices and support customers. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Your choices and rights
You can see and edit most of your data in the app. To get a copy of your data, correct something you can't edit, or have your account deleted, write to info@costtrace.us. We answer within 30 days.
If you live in California or another state with a consumer privacy law, you may have rights to know, correct and delete personal information and to not be discriminated against for using them. We don't sell or share personal information as those laws define it.
Children
CostTrace is a business tool and isn't meant for anyone under 18.
Changes to this policy
We may update this policy. For significant changes we will e-mail you or show a notice in the app before they take effect. The date at the top shows the latest version.
Contact
Questions about privacy: info@costtrace.us.
See also the Terms of Service.