Privacy Policy

1. Who we are

TheCost.ai is operated as a joint venture by Paul Waine and Bobby Nastase, sole traders based in the United Kingdom. We act as joint controllers of the personal data described in this policy. You can reach us at paul@thecost.ai and bobby@thecost.ai.

2. Data we collect

• Waitlist signup: your email address, optional company name, and any free-text feedback you submit.
• Booking: if you book a call, Calendly collects your name, email, and calendar availability on our behalf.
• Analytics (only with your consent): pageviews, clicks, device and browser info, approximate location derived from IP, and session recordings via PostHog (EU region).
• Server logs: IP address and request metadata retained short-term for security and abuse prevention.

3. Lawful bases

• Consent (UK GDPR / GDPR Art. 6(1)(a)) — analytics, session replay, and product-update emails.
• Legitimate interests (Art. 6(1)(f)) — running and securing the site, preventing abuse, and responding to enquiries you send us. You can object at any time.
• Legal obligation (Art. 6(1)(c)) — retaining records required by law.

4. Processors we use

• Supabase — database & auth (EU region).
• Lovable / Cloudflare — hosting and CDN.
• PostHog — product analytics (EU cloud).
• Calendly — meeting scheduling (US; loaded only when you open the booking modal).

Where transfers outside the UK/EEA occur, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

5. Retention

Waitlist records are kept for up to 24 months from signup, or until you ask us to delete them — whichever is sooner. Analytics data is kept per PostHog's default (up to 7 years) but only if you consented. Server logs are retained for up to 30 days.

6. Your rights

Under the UK GDPR and the EU GDPR you have the right to access, rectify, erase, restrict or object to processing, port your data, and withdraw consent at any time. Exercise any right by emailing paul@thecost.ai.

You can also lodge a complaint with the UK ICO or your local EU data protection authority.

7. Cookies

See our Cookie Policy for the specific storage keys and cookies used, and how to change your consent.

8. Changes to this policy

We'll update the "last updated" date above whenever we make material changes. For significant changes we'll also notify you by email if you're on the waitlist.