Privacy Policy

1. Data Controller

CostLens
Email: privacy@costlens.dev
Website: costlens.dev
Data Protection Officer: dpo@costlens.dev

Legal Basis for Processing: Contract performance (Article 6(1)(b) GDPR), Legitimate interests (Article 6(1)(f) GDPR), and Consent (Article 6(1)(a) GDPR) where applicable.

2. Data We Collect

Account Information

• Email address: For authentication and communication
• Name: For personalization
• Password: Hashed and encrypted (via Clerk)

Usage Data

• API requests: Model, tokens, cost, latency
• API keys: Hashed with bcrypt (never stored in plain text)
• Quality feedback: Ratings and comments
• Audit logs: Account actions for security

Billing Data

• Payment information: Processed by Stripe (we never see card numbers)
• Billing history: Invoices and receipts

GitHub Integration Data

When you connect GitHub (for AI Efficiency Score or productivity reports), we collect:

• PR metadata: Timestamps (opened, merged, closed), branch names, commit counts, review counts, files changed count
• Review states: Approved, changes requested, commented (no review content)
• GitHub username: For attribution in team reports
• OAuth access token: Encrypted at rest (AES-256), used only to fetch PR metadata

We never access: code content, diffs, commit messages, issue bodies, private conversations, or repository source code.

Retention: GitHub data is deleted immediately when you disconnect. For active connections, PR metadata is retained for the duration of your subscription.

Deletion: Go to Settings → GitHub → Disconnect to delete all GitHub and commit data immediately. No waiting period.

Legal basis: Consent (Article 6(1)(a) GDPR) — you explicitly connect GitHub via OAuth.

Git Hook Data

If you opt in to git hooks (via npx @costlens/mcp-server hooks), we collect:

• Commit metadata: Hash, message (first 200 characters), branch name, files changed count, insertions, deletions

We never access: file contents, diffs, or full commit history.

Opt-in only: Hooks are never installed automatically. You must run the hooks command explicitly.

Uninstall: Remove .git/hooks/post-commit from your repository.

3. How We Use Your Data

4. Data Retention

5. Third-Party Processors

We use the following trusted service providers:

All processors have Data Processing Agreements (DPAs) in place and comply with GDPR.

6. International Data Transfers

Your data may be transferred to and processed in the United States and other countries. We ensure adequate protection through:

• Data Privacy Framework (DPF): For US transfers
• Standard Contractual Clauses (SCCs): EU-approved contracts
• Adequacy decisions: Where available

7. Your Rights (GDPR)

You have the following rights:

• Right to access: Request a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure: Delete your account and data
• Right to portability: Export your data in JSON format
• Right to object: Object to certain processing
• Right to restrict: Limit how we use your data
• Right to withdraw consent: At any time

To exercise your rights, visit your account settings or email privacy@costlens.dev

We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

8. Security

• Encryption: HTTPS for all connections, encrypted database
• Hashing: API keys hashed with bcrypt (10 rounds)
• Access control: Role-based permissions
• Monitoring: 24/7 security monitoring
• Auditing: All actions logged

9. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

10. Children's Privacy

Our service is not intended for users under 16 years old (EU) or 13 years old (US). We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the service.

12. Contact Us

For privacy questions or to exercise your rights:
Email: privacy@costlens.dev
Response time: Within 30 days