CostLatch Privacy Policy
Effective: 16 Oct 2026
Last updated: 19 October 2026
1. Who we are
CostLatch is operated by Dennis Yates, sole trader trading as CostLatch (ABN 52 137 373 213), Anna Bay NSW, Australia ("we", "us"). Privacy contact: privacy@costlatch.com.
We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Where the EU or UK GDPR applies, we are the controller of account, billing and waitlist data. We are a processor of request content that passes through the proxy on your behalf.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Waitlist | email address, signup time | you, via the waitlist form |
| Account | email, login (magic-link) records, session data | you |
| Billing | Stripe customer ID, plan, subscription status. We do not see or store full card numbers. | Stripe |
| Provider API keys | your OpenAI/Anthropic API keys (encrypted) | you |
| CostLatch proxy keys | stored only as a one-way hash | generated by us |
| Usage and spend data | per-key token counts, cost estimates, budget state, block events, loop-detection fingerprints (a one-way hash of prompt text, not the text) | the Service |
| Sign-up source | the website that referred you (domain and page path only, never the query string), any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the first page you landed on and when; plus the dates you started a trial, made your first proxied request and first paid | your browser when you start checkout; the Service |
| Technical data | IP address, request timestamps, user agent, error logs | your devices and our hosting provider |
| Support | messages you send us | you |
Prompts and completions: requests pass through our servers to the provider you choose. We do not store prompt or completion content. It is processed in memory only to forward the request and to calculate cost and loop-detection fingerprints.
3. Why we use it (and GDPR lawful bases)
| Purpose | GDPR lawful basis |
|---|---|
| Provide the Service: forward requests, enforce budgets, detect loops | contract |
| Billing and tax records | contract; legal obligation |
| Security, abuse and fraud prevention (including trial-abuse prevention: applying our one-trial-per-customer rule), troubleshooting | legitimate interests (keeping the Service secure) |
| Understanding which channels bring customers (counting sign-ups, trials, first use and paid conversions by source) | legitimate interests (knowing where our customers come from so we can spend our small marketing budget sensibly). Only aggregate counts are used for decisions. |
| Waitlist invitations and product updates | consent (you can unsubscribe at any time) |
| Service notices (for example price or Terms changes) | contract; legal obligation |
We do not sell personal information, we do not use it for targeted advertising, and we do not use your prompts to train models.
4. Who we share it with (service providers and processors)
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | hosting, edge network, storage, website analytics (aggregate, cookieless) | United States, and the countries where Cloudflare's global network has data centres, including Australia |
| Stripe (including Link) | payments, subscriptions, customer portal. As merchant of record, Stripe also collects payment and tax data as an independent controller under its own privacy policy (stripe.com/privacy); and the sign-up source details above, stored as metadata on the checkout session and subscription | United States, Ireland and other countries where Stripe operates |
| Resend | transactional email (login links) | United States |
| OpenAI and/or Anthropic | receive your requests at your direction, using your own key, under your agreement with them | United States (and other countries under their own terms) |
We may also disclose information:
- where required by law;
- to protect rights or safety;
- to a buyer of the business (we will tell you first).
5. Overseas disclosure (APP 8) and international transfers (GDPR)
We are based in Australia, but our providers store and process data overseas, mainly in the United States, and also in Ireland and other countries where Stripe operates, and in the countries where Cloudflare's global network has data centres (which include Australia). Because Cloudflare's network is global, a request may be processed at the data centre nearest to you. We take reasonable steps (APP 8.1), including contractual data protection terms, to make sure overseas recipients handle information consistently with the APPs.
For transfers of personal data from the EU/EEA, Switzerland or the UK to countries without an adequacy decision (including Australia and the United States), we rely on:
- the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum or the UK International Data Transfer Agreement (IDTA) for UK data, as included in our providers' data processing terms; and
- for US providers certified under it, the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US framework, where applicable).
You can ask us for more information about these safeguards at privacy@costlatch.com.
6. Security of your API keys and data
- Provider API keys are encrypted at rest using envelope encryption: a per-account data key, itself encrypted by a master key held in our hosting provider's secret store.
- Keys are decrypted only in memory at the moment a request is forwarded.
- They are never written to logs, and they are not shown back in the dashboard.
- Proxy keys are stored as hashes and shown once.
- Error messages from providers are sanitised.
- Access to production systems is restricted.
No system is completely secure. We recommend using a dedicated, limited-scope provider key and rotating it regularly. If a data breach is likely to cause serious harm, we will notify affected users, and the OAIC or relevant supervisory authorities, as required by law. Contact security@costlatch.com about security issues.
7. How long we keep it
| Data | Retention |
|---|---|
| Waitlist emails | until you unsubscribe, or 12 months after we invite you if you don't sign up |
| Usage and spend totals (per key: daily, monthly, per run) | Solo: 30 days. Pro: 90 days. Monthly totals are kept until 30 (Solo) or 90 (Pro) days after the calendar month (UTC) ends. Deletion runs daily. Everything is deleted within 30 days of account closure. |
| Loop-detection fingerprints (one-way hashes) | about 10 minutes |
| Blocked-request records | 30 days |
| Provider keys | deleted immediately when you remove them, or within 7 days of account closure |
| Account data | life of the account plus 30 days |
| Trial eligibility records | a one-way salted hash of your email and of your card's Stripe fingerprint, kept for 3 years after your trial so we can apply our one-trial-per-customer rule |
| Consent records (what you agreed to and when) | 3 years, as evidence of your agreement |
| Unsubscribe records | your email and the date you unsubscribed, kept for as long as needed to make sure we don't email you again |
| Sign-up source and funnel dates | life of the account plus 30 days; daily aggregate counts (no personal information) may be kept indefinitely |
| Billing records | 7 years (Australian tax law) |
| Security and access logs | 30 days, unless needed longer to investigate a specific security incident |
8. Your rights
You can ask to:
- access or correct your information (APPs 12 and 13);
- export or delete it;
- object to or restrict certain processing (GDPR);
- withdraw consent.
Email privacy@costlatch.com. We respond within 30 days, and we may need to verify your identity. California and other US residents may make similar requests; we don't sell or "share" personal information for cross-context advertising.
9. Complaints
Contact us first and we'll respond within 30 days. If you're not satisfied:
- Australia: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, 1300 363 992.
- EU/EEA: your local data protection supervisory authority.
- UK: the ICO (ico.org.uk).
10. Cookies
We use one essential cookie to keep you signed in to your dashboard. When you visit our website we also keep a small note in your browser's session storage (not a cookie) recording the site that referred you, any campaign tags in the link, the page you first landed on and the time. Your browser deletes it when you close the tab. It's sent to us only if you start checkout, so we can see which channels bring customers. We don't use it for advertising or to track you across other sites. We don't do this for visitors from the EU, EEA, UK or Switzerland. We also use Cloudflare Web Analytics to count page visits and measure site performance. It does not use cookies, local storage or fingerprinting, and does not track you across sites; Cloudflare processes basic request data (such as page URL, referrer, browser type and country) to produce aggregate statistics. We do not use advertising or cross-site tracking. If that changes, we will update this policy and ask for consent where the law requires it.
11. Children
The Service is not for under-18s.
12. Changes
We'll post updates here, and we'll email account holders about material changes.