Privacy policy

The controller for personal data processed through SysCost is SysCost. Contact us at [email protected]. For data you put into a workspace about other people (for example, a teammate’s email), your organisation is the controller and we process it on its behalf.

• Account data: your email address, a hash of your password (never the password itself), your timezone and preferences, and whether your email is confirmed.
• Workspace data: the subscriptions, vendors, amounts, payment records, categories, notification rules and the names and emails of workspace members and invitees.
• Integration settings: destinations you configure for reminders, such as webhook URLs, chat tokens or email addresses.
• Billing data: if you subscribe to a paid plan, our payment provider processes your payment details. We receive a membership reference, plan and status, never full card numbers.
• Technical data: IP address and request metadata, used transiently for rate limiting and security logs.
• Sign-up source: the campaign tags and ad click identifiers in the link you followed to sign up, the first page you visited and the site that referred you, which we read from the link itself and keep with your account, without cookies, tracking pixels or anything stored in your browser, to learn which of our campaigns work.
• AI smart-add input: if you use it, the receipt or invoice text you paste, sent to our AI provider to extract subscription details.

• To provide the service you signed up for: accounts, workspaces, reminders, billing (performance of a contract).
• To keep SysCost secure and prevent abuse: rate limiting, audit logs, fraud prevention (legitimate interests).
• To learn which of our campaigns bring sign-ups, from the sign-up source above (legitimate interests).
• To send service emails you need: confirmations, password resets, invitations, security notices and the weekly digest you can turn off (contract; legitimate interests).
• To meet legal obligations such as keeping billing records (legal obligation).

We share data only with providers that help us run SysCost, under contracts that require them to protect it:

• Hosting and infrastructure: stores and runs the application and database.
• Resend: delivers transactional and reminder emails.
• Our payment provider: processes payments for paid plans.
• OpenAI: processes the text you submit to AI smart-add, only when you use that feature.
• hCaptcha (Intuition Machines, Inc.): checks that a sign-up comes from a person, using your IP address and browser signals at the moment you create an account.
• The destinations you configure (Slack, Discord, Telegram, your webhooks) receive the reminder content you choose to send them.

Currency rates are downloaded from the European Central Bank; no personal data is sent.

Some providers may process data outside your country. Where data leaves the European Economic Area or the UK, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses.

• Account and workspace data: until you delete it or your account. Deleting a workspace or account removes its data immediately from the live database.
• Notification delivery logs: 180 days.
• Single-use email links: until used or expired.
• Billing records: as long as tax and accounting law requires.
• Backups: deleted data can remain in backups for a limited time until they are overwritten.

Depending on where you live, you can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interests. Many of these are self-service:

• Export: download your workspace as CSV or JSON from the app.
• Delete: Settings → Danger zone → Delete account.
• Correct: edit any record directly in the app.

For anything else, email [email protected]. You may also complain to your local data protection authority.

SysCost uses only storage that is strictly necessary to run the app (your session, theme and selected workspace). There are no advertising or third-party tracking cookies. See the cookie policy.

We protect data with hashing, single-use tokens, role-based access, network safeguards and an audit trail. See our security overview.

SysCost is a business tool and is not directed at anyone under 16.

We will post changes here and update the date above. For material changes we will notify account owners by email in advance.