Privacy policy

The data controller is the publisher of CostHuntr: Alexandre Vassard, 10 rue de la Paix, 75002 Paris, SIREN 880 024 864 (sole proprietor). For any question about your data: contact@costhuntr.fr.

For the invoices your organization forwards to CostHuntr (invoice import), your organization decides what is sent: CostHuntr then acts on its behalf, as a processor under article 28 of the GDPR. A data processing agreement is available on request.

• Your account: e-mail address, name, language, password (stored hashed, never in clear) or, if you sign in with Google or Microsoft, the identifier of that account and, for Google, the address of your profile picture. Basis: performance of the contract (providing the service).
• Your sign-in sessions: IP address and browser, to secure your account. A session lasts 7 days. Basis: performance of the contract and our legitimate interest in protecting accounts.
• What your organization enters: expenses (names, costs, renewals, notes, owners), categories, members and invitations (e-mail address of the invited person, valid 7 days), notification preferences. Basis: performance of the contract.
• Payment: it happens at Stripe. We never see your card; we only keep Stripe's customer and subscription identifiers. Basis: performance of the contract.
• Invoice import: from a forwarded e-mail, we keep the sender, the subject and the fields read from the invoice (vendor, amount, currency, period, seats, unit price, date, number, lines). The e-mail itself and its attachments are never stored by CostHuntr: they only live in memory while being read. An e-mail that is not an invoice is ignored and nothing is kept. An e-mail from an unknown sender is quarantined with only its sender and subject, deleted after 30 days. The confirmation code Gmail sends during setup is kept until the next one, with the Gmail address that requested it.
• Audience measurement: on public pages only (home, legal pages, guides) and on the sign-up and sign-in pages, with Umami, an open-source tool we host ourselves. No cookie, no identifier, aggregated figures only: page views, referrers, and clicks on the buttons and links of those pages (which plan draws attention, which guide is opened). Your browser's "Do Not Track" signal is honored. The signed-in application is not measured. Basis: our legitimate interest.
• Your messages: if you write to us, your address and message are used to answer you.

No data is sold, rented or used for advertising, and no profile is built from your usage.

CostHuntr only sets cookies needed for the service or your preferences, which require no consent:

• the session cookie (better-auth.session_token): keeps you signed in, 7 days;
• costhuntr_active_org: the organization you chose, 90 days;
• costhuntr_onboarding_solo: a sign-up choice, 1 hour;
• costhuntr_expenses_view: list or grid view of your expenses, 1 year;
• NEXT_LOCALE: the display language, for your visit.

No audience measurement, advertising or social network cookie.

The application and its database run on our own server, in the European Union. Encrypted backups go to another server of the publisher, in the European Union. Nobody but the publisher has access.

A few providers take part, each for a precise task:

• Scaleway (France): sending e-mails (sign-in codes, reminders, invitations, digests). Forwarded invoices reach our own server directly, without going through it.
• Stripe (Ireland, United States): paying for plans; receives your e-mail address and your organization's identifier.
• Google and Microsoft (United States): only if you choose to sign in with them.
• Slack (United States): only if your organization connects its alerts; receives the name, cost and renewal of the expenses concerned.
• Google's icon service: receives an expense's domain name (for example slack.com) to show its logo, no personal data.
• Frankfurter: European Central Bank exchange rates, no personal data.

Transfers outside the European Union are covered by the safeguards of each provider's data processing agreement (European Commission standard contractual clauses or the EU / US Data Privacy Framework).

AI reading of invoices: disabled today. Invoices are read without AI. If we ever turn on the Claude (Anthropic) fallback for unknown formats, it will be added to this list and announced beforehand.

• Account, organization and their data: as long as they exist; deleted as soon as you delete them.
• Read invoices: kept as the history of the expense's cost, as long as the organization exists.
• Quarantine: 30 days. Sessions: 7 days. Sign-up code: 10 minutes. Password reset link: 1 hour. Invitations: 7 days. Reminder action links: 30 days, single use.
• Backups: encrypted, continuously renewed; deleted data disappears from them after 6 months at most.
• Server technical logs: a few days (automatic rotation).
• At our providers: Stripe keeps payment invoices according to its legal obligations; Scaleway keeps sent e-mails according to its own policy.

You do it yourself, without writing to us, and it takes effect immediately:

• Your account: Settings, "Delete my account", then confirm by typing your e-mail address. If you are the last administrator of an organization, delete it or appoint another administrator first. Expenses you created stay with your organization, without your name.
• Your organization (administrators): Organization, "Delete the organization", then confirm by typing its name. The Stripe subscription is cancelled, and everything is erased: expenses, members, invitations, read invoices, logos.

E-mails already sent stay in their recipients' mailboxes, and backups are erased as they are renewed (6 months at most).

You can access your data, have it corrected or erased, restrict or object to its processing, and get it back in a readable format (CSV export of expenses on Pro and Team, the rest on request). Write to contact@costhuntr.fr: we answer within one month at most.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Encrypted connections (HTTPS) everywhere, hashed passwords, short-lived single-use codes, services isolated in unprivileged containers, encrypted backups. Only the publisher has access to the servers.

If this policy changes on an important point (new data, new provider), organization administrators are told by e-mail before the change applies. The date of the last update is at the bottom of the page.