Privacy policy

Costline is a costing product operated by Qelo, a South African software studio. In this policy, “Costline”, “we”, “us” and “our” refer to that service and the studio behind it.

This policy explains what personal information we collect, why, how we look after it, and the choices you have. It is written to be consistent with South Africa’s Protection of Personal Information Act (POPIA).

For any privacy question, or to exercise a right described below, contact us at hello@costline.co.za.

We collect only what we need to run Costline for you:

• Account details — your name, email address and the organisation you belong to, used to sign you in and scope your access.
• Operational data you enter — cost centres, rate types, activities, materials, people you track, and the labour and input logs you record. This is your business data; you control it.
• Enquiry details — if you contact us through the site, the information you send so we can respond and set you up.
• Technical data — basic, privacy-scrubbed error and performance information used to keep the service reliable (see “Sub-processors”).

We do not collect special categories of personal information, and we ask that you don’t store any in Costline that isn’t needed for costing.

We use your information to:

• Provide the service — run your organisation’s costing, resolve rates as of a work date, and produce reports from your stored data.
• Support and onboard you — set up your operation, import your history, and answer questions.
• Keep the service secure and working — authentication, tenant isolation, and diagnosing faults.
• Communicate with you — service messages, invitations and responses to your enquiries.

We do not sell your data, and we do not use your cost data to train machine-learning models.

Under POPIA we process your information because it is necessary to perform our agreement with you (delivering the service you’ve signed up for), to pursue our legitimate interest in running and securing the product responsibly, and to meet our legal obligations. Where we rely on consent — for example an enquiry you initiate — you may withdraw it at any time.

Costline is hosted on Supabase in the European Union (eu-central-1, Frankfurt). Your data is encrypted in transit (HTTPS/TLS) and at rest, and separated from other organisations by row-level security enforced in the database.

Because our infrastructure is in the EU, some processing takes place outside South Africa. We only use processors that provide an adequate, comparable level of protection for your information. South-African data residency is on our roadmap; talk to us if it’s a requirement.

We rely on a small number of trusted providers to run Costline. Each processes only what its role requires:

• Supabase — database, authentication and hosting (EU region).
• Vercel — application hosting and content delivery.
• Sentry — error monitoring, configured to scrub personal and cost data before it is sent.
• Resend — sending transactional email such as invitations.

Each provider processes your data under its own security and privacy commitments and only on our instructions.

We keep your data for as long as your organisation uses Costline. Because the product’s purpose is an accurate historical record, operational logs are retained for the life of your account so your history stays complete.

When you leave, we return your data on request and delete it from our active systems, subject to any short period needed for backups to cycle out and any records we’re legally required to keep.

Under POPIA you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Ask us to delete information where we’re not required to keep it.
• Object to certain processing, and withdraw consent where we relied on it.
• Export your data — your cost data is yours, and you can take it with you.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these, email hello@costline.co.za and we’ll respond promptly.

We protect your data with encryption in transit and at rest, database-enforced tenant isolation, role-based access within each organisation, and privileged operations restricted to a controlled server path. Our error monitoring is configured not to receive your personal or cost data.

No system is perfectly secure, but security is central to what Costline is for. You can read more on our security page.

We may update this policy as the product evolves. When we make a material change we’ll update the date above and, where appropriate, let you know directly. Continuing to use Costline after a change means you accept the updated policy.