Privacy Policy

Last updated: 3 November 2026

1. Who we are

CostCreep is a cost-and-price checking service for goods businesses, operated by Costcreep Ltd (company number 17369484), registered at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ ("CostCreep", "we"). We read our customers' purchase and sales invoices, credit notes and payments, and the documents attached to them, keep a dated price history of what they pay each supplier and charge each customer, and check what was paid, what was charged, what came back, and how the two relate. Where a customer instructs it, we draft and send queries to their suppliers on their behalf. We never contact a customer's customers. For questions about this policy or your data, contact privacy@costcreep.co.uk.

We are registered with the Information Commissioner's Office under number ZC209669.

2. The four groups of people this policy covers

Visitors to this website. We collect very little: server logs and, if you contact us, whatever you send us.

Users of the CostCreep application. Our customers' owners, staff and advisers — including an accountancy practice a customer has authorised to act for it — who sign in. For this data we are the controller.

People who work at our customers' suppliers. When a customer connects their accounting data, the invoices and contact records in it include names, business email addresses and phone numbers of people at their suppliers, and CostCreep sends emails to some of those addresses on the customer's behalf. For this data our customer is the controller and we act as their processor, under our Data Processing Agreement. Section 8 below explains what this means if that's you.

People who work at our customers' customers. Sales invoices, credit notes and remittance advices carry the names, business email addresses and phone numbers of people at the businesses our customers sell to. We hold these only because they appear on the invoices and payments we read. CostCreep never emails or otherwise contacts anyone at a customer's customer; anything a customer chooses to send to its own customers, it sends itself. For this data our customer is the controller and we are their processor.

3. What we collect and why

Account data (we are controller)

• Name, email address and sign-in credentials (authentication is handled by our identity provider; we never see your password).
• Billing details when you subscribe, handled by our payment provider — we do not store card numbers.
• Product activity needed to operate the service: what was approved, edited, sent and when, kept as an audit trail your business can inspect and export.

Customer business data (we are processor)

• Purchase and sales invoices, credit notes, payments and their allocations, contacts and items from your accounting platform (read-only), and the documents attached to them.
• Mailbox, where you connect one. With your authority we read a connected mailbox, including a shared mailbox you have access to, for documents from the suppliers and customers already in your books. We store the attachment, and a record of which message it came from — the provider's message id, when it arrived, which contact it matched and what we did with it. We also read the text of a supplier's message for a price or price change it states, such as "£28 a bag from Monday" or "prices rise 4% from 1 April". We keep only the sentence that states it, for us to confirm, and delete it after 365 days if nobody has confirmed it. We do not store the rest of the message body. We do not store subjects, except where you forward a message to us, in which case we keep the sender, subject and date you sent. A message from someone who is not a supplier or customer in your books is counted and nothing about it is kept. You can disconnect at any time, which stops all reading.
• Files you upload or forward: supplier statements, price lists, contracts and terms, rebate agreements, delivery notes, sales exports and remittance advices.
• Product costings and trade terms you enter. These describe products, quantities and prices, not people.
• Supplier contact details — accounts email addresses and phone numbers, whether synced, uploaded or learned from correspondence — and customer contact details as they appear on invoices and remittances.
• Correspondence between the cost-review function and suppliers, including replies.
• Public reference data we fetch to give your figures context: Companies House, ONS price indices, Bank of England exchange rates, HMRC VAT checks and published tariffs. Companies House records name company officers; we use them only to identify a supplier company, never to contact anyone.

Lawful bases: performance of our contract with you; our legitimate interest in operating, securing and improving the service; and legal obligations (for example, accounting records). We do not sell personal data, and we do not use your business data to train models or benchmark you against other customers without separate, explicit consent.

We do not use your business data to train models. Where a language model is used in the service it is limited to reading the wording of a document (such as the unit and pack size printed on an invoice line), checking a finding against its own evidence, proposing matches between product descriptions and drafting the wording of letters and summaries for a person to confirm; it is never used to compute a figure, decide a claim or act. The provider is Anthropic, which processes what it is sent in the United States, and it appears in the DPA's sub-processor annex.

Advisers. If your accountant or bookkeeper has been given access to your account, they see your data under your authority and act on your instructions. Where a practice introduced you to CostCreep, your plan page says so.

4. Emails sent to suppliers

Where a customer instructs it, CostCreep sends invoice and pricing queries to the customer's suppliers. Every such email is sent by a declared cost-review function acting for the named customer — never an invented person — states the relationship in the body, and offers a direct way to verify it with the customer. The customer controls whether each email is sent.

The same applies to a request, sent only where you have asked us to, for a supplier's statement of account or current price list. We never email a customer's customers.

5. Who we share data with

Only service providers who process it for us, under contract: hosting and database infrastructure, identity/authentication, transactional email delivery, document-reading (OCR), language-model review, encrypted off-site backup storage, application error monitoring, and payment processing. The current list, including locations and transfer safeguards, is in the DPA's sub-processor annex. We also share data where the law requires it. Some providers are outside the UK; where they are, transfers rely on the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Account and business data are kept while your subscription is active. On closure, you can export everything we hold, and we delete your company's data — including uploaded files in storage — within 30 days of a deletion request, except what we must keep by law. Server logs rotate within 90 days. We take encrypted off-site backups daily so the service can be restored after a failure; these cannot be edited selectively, so deleted data persists in them until each backup expires, within 35 days. Backups are never read for any purpose other than restoring the service.

Supplier correspondence (emails sent to and received from a customer's suppliers) is kept while that customer's account is active, because it forms part of the customer's evidence and audit trail, and is deleted with the customer's data. Suppression-list entries — the email addresses of people who have asked not to be contacted — are kept for as long as needed to honour that request, and are used for no other purpose.

7. Security

Data is encrypted in transit and at rest, access is limited to what each account is entitled to see, every company's data is isolated from every other's, and the only write we make to your accounting software is a draft bill you have approved. A summary of technical measures is in the DPA.

8. If you work for one of our customers' suppliers or customers

You may have received an email from a CostCreep address on behalf of one of your customers. What we hold about you is limited to business contact details and the correspondence itself, processed on our customer's instructions so that they can query invoices with your company. If you'd rather we didn't email you, reply saying so or write to privacy@costcreep.co.uk — we keep a suppression list and honour it. For rights requests about this data we may refer you to the customer, who is the controller, but we'll always help route it.

If you work for one of our customers' customers, we hold your business contact details only because they appear on invoices and payments we read for that customer. We will never contact you. Rights requests are routed the same way: the customer is the controller, and we will always help.

9. Your rights

You have the rights UK GDPR gives you: access, correction, deletion, restriction, portability and objection, and the right to withdraw consent where consent was the basis. Write to privacy@costcreep.co.uk; we respond within one month. If you're unhappy with our answer you can complain to the ICO at ico.org.uk.

10. Cookies

The application uses strictly necessary cookies and local storage for signing you in. This marketing site sets no analytics or advertising cookies.

11. Changes

We'll post changes here and, for material changes affecting application users, tell you by email. Continued use after a change takes effect means the updated policy applies.