Data Processing Agreement
Last updated: 3 November 2026
1. Parties and roles
This Data Processing Agreement ("DPA") is between the customer identified on the account ("Customer", the controller) and Costcreep Ltd (company number 17369484) ("CostCreep", the processor), and forms part of the Terms of Service. It applies whenever CostCreep processes personal data on the Customer's behalf, and is governed by UK GDPR and the Data Protection Act 2018.
2. What the processing is
| Subject matter | Checking the Customer's purchase and sales invoices, credit notes, payments and related documents: what the Customer paid its suppliers, what it charged its customers, what was received and paid, and how its costs and prices relate; preparing evidence, letters and packs; corresponding with suppliers on the Customer's instructions; matching recoveries. |
|---|---|
| Duration | The term of the Terms of Service, plus the export and deletion period below. |
| Nature and purpose | Ingesting accounting and document data on both the purchase and the sales side, including documents already attached in the accounting platform and documents the Customer uploads or forwards; reading documents (OCR); detection and reporting; fetching public reference data for context; sending, receiving and threading email correspondence with the Customer's suppliers — invoice and pricing queries, and requests for statements and price lists — as a declared cost-review function acting on the Customer's documented instructions. This agency is a named purpose of the processing, not incidental to it. No correspondence with the Customer's customers takes place. |
| Data subjects | The Customer's personnel and advisers, including personnel of an accountancy practice the Customer has authorised; personnel of the Customer's suppliers (accounts and sales contacts); personnel of the Customer's customers as named on sales invoices, credit notes and remittance advices; company officers named in public registers. |
| Categories of data | Business contact details (names, business email addresses, phone numbers, job roles); invoice, payment and transaction data that may contain names; correspondence content with suppliers; product costings and trade terms, which describe products and prices rather than people. No special-category data is sought or required, and none should be submitted. |
3. CostCreep's obligations
- Instructions. We process personal data only on the Customer's documented instructions — including each approval to send a challenge and each automation policy the Customer enables — unless UK law requires otherwise, in which case we tell the Customer first where the law allows.
- Advisers. Where the Customer authorises an accountancy practice or other adviser to access its account, instructions given through that adviser are the Customer's instructions, and the adviser's personnel are authorised users of the Customer's account.
- Identity in correspondence. Every email to a supplier identifies the Customer, states that CostCreep's cost-review function is acting for the Customer, and never presents a fictitious person as the sender.
- Confidentiality. Everyone we authorise to process the data is bound by confidentiality obligations.
- Security. Appropriate technical and organisational measures, including: encryption in transit and at rest; per-company tenant isolation enforced in the application and tested; accounting connections limited to reading, with a single approved write (a draft bill) and no other; role-based access; suppression lists honoured on all outbound email; and audit logging of actions taken on the Customer's behalf.
- Assistance. We help the Customer respond to data-subject rights requests, and with security, breach notification, DPIAs and consultations, as UK GDPR arts. 32–36 require.
- Breach. We notify the Customer without undue delay after becoming aware of a personal data breach affecting their data, with enough detail to meet their own obligations.
- Return and deletion. The Customer can export all their data at any time from within the product. On termination or on request we delete the Customer's personal data from the live service — including files in storage — within 30 days, unless law requires retention. Encrypted off-site backups are taken daily and are not selectively editable; a deleted Customer's data therefore persists in backups until each one expires on its own retention schedule, which is a maximum of 35 days. Backups are used only to restore the service after a failure, are never read for any other purpose, and are held under the same safeguards as the live data.
- Audit. We make available information reasonably necessary to demonstrate compliance, and allow audits on reasonable notice, no more than once per year unless required by a regulator or following a breach.
4. Sub-processors
The Customer authorises the sub-processors below. We'll give at least 30 days' notice before adding or replacing one; if the Customer reasonably objects and we can't resolve it, they may terminate the affected service. We remain responsible for our sub-processors' performance.
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Supabase | Database, authentication, file storage | EU — Frankfurt, Germany (UK adequacy for the EEA; UK Addendum / SCCs with the provider) |
| Render | Application hosting | EU — Frankfurt, Germany (UK adequacy for the EEA; UK Addendum / SCCs with the provider) |
| Postmark (ActiveCampaign) | Transactional email sending and inbound processing | US — UK Addendum / SCCs |
| Microsoft Azure | Document reading (OCR) | UK — UK South region |
| Cloudflare | Encrypted off-site database backups (R2 object storage) | EU jurisdiction (UK adequacy for the EEA; UK Addendum / SCCs with the provider) |
| Functional Software, Inc. (Sentry) | Application error monitoring — diagnostic reports that may incidentally contain personal data present in a failed request | EU — Germany (UK adequacy for the EEA; UK Addendum / SCCs with the provider) |
| Stripe | Payment processing | US — UK Addendum / SCCs |
| Vercel | Website and application front-end hosting | US company; global edge network including the UK and EU — UK Addendum / SCCs |
| Anthropic, PBC | Language-model review: reading the unit and pack size printed on an invoice line; checking a finding against its own evidence; and, where switched on, proposing matches between product descriptions, proposing which column of an uploaded spreadsheet holds which field, and reading the ingredients and quantities on a recipe or product specification the Customer hands over. Every proposal is confirmed by a person. It never computes a figure, decides a claim or acts, and is not used to train models. | US — UK Addendum / SCCs |
Xero, Intuit (QuickBooks), Sage and Microsoft (Business Central) are not our sub-processors: they are the Customer's own providers, from which we read data under the Customer's authorisation. Companies House, the Office for National Statistics, the Bank of England and HMRC are public sources; nothing is sent to them beyond a company name, number or VAT number. The language-model provider (Anthropic) is listed above; it processes Customer data only once the review is switched on, and any other provider is added to this table before it processes any.
5. International transfers
Where processing involves a transfer outside the UK, it relies on an adequacy decision or on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus supplementary measures where appropriate.
6. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service, except where UK GDPR doesn't permit that. If this DPA conflicts with the Terms on a data-protection matter, this DPA wins.