Privacy Policy

1. Information we collect

Depending on how you use CosTruss, we may collect the following categories of information:

• Account information: your name, email address, account details, and authentication information used to create and manage your account.
• AI usage and cost data: usage records, token counts, model names, timestamps, request status, estimated costs, and other information retrieved from the AI providers you connect, including OpenAI and Anthropic, where supported.
• Provider credentials: API keys or other credentials you choose to provide to connect your AI provider accounts. These are encrypted at rest and never exposed to the browser.
• Subscription and billing information: subscription plan, payment status, billing currency, transaction references, and related billing records. Payments are processed through our payment provider; we do not intentionally collect or store complete payment card details, as those are handled by the payment provider.
• Technical and diagnostic information: error logs, service activity, and technical records needed to maintain security, troubleshoot issues, and operate the platform, where collected.

Please avoid submitting unnecessary personal or confidential information through CosTruss.

2. How we use your information

• To provide, operate, and maintain the CosTruss service.
• To sync and display your AI usage and cost data.
• To send budget alerts and account notifications you have enabled.
• To process subscription payments and manage billing.
• To improve our features and detect abuse or fraud.

3. Your AI provider credentials

CosTruss uses your provider API keys solely to read your usage and cost data on your behalf. We never use your credentials to make API calls on your behalf beyond reading usage, never share them with third parties, and never resell access. You can disconnect a provider at any time, after which we stop syncing and purge the stored credential.

4. Data retention

We retain your usage data for as long as your account is active so you can view historical trends and reports. When you delete your account, we remove your personal data and stored credentials within 30 days, except where retention is required by law.

5. Sharing of information

We do not sell your data. We share data only with service providers that help us operate (such as payment processing via Razorpay and cloud infrastructure), under contracts that require them to protect it, or where required by law.

6. Sub-processors

We rely on the following third parties to process customer data on our behalf, under contracts that require them to protect it:

• Base44 — hosting and application platform.
• Razorpay — payment processing.
• Our transactional email provider — delivery of account and alert emails (provided through the Base44 platform).

7. Security

Credentials are encrypted at rest and in transit. Access to production systems is restricted and audited. No security measure is perfect, but we apply industry-standard safeguards to protect your data.

8. Your rights

You may access, correct, or delete your personal data, and export your usage data, from your account settings or by contacting us. Where applicable, you also have rights under applicable data protection laws.

9. Cookies

CosTruss uses essential cookies to keep you signed in and remember your preferences. We do not use cookies for cross-site advertising.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or an in-app notice and post the updated date above.

11. Contact

Questions about this policy? Email costruss.team@gmail.com.