Privacy Notice
Last updated 9 October 2026
This notice explains what personal information the iCost platform collects, why, who it is shared with, how long it is kept and the rights you have. It covers the iCost application at https://www.i-cost.co.uk/uat/public. Our marketing website has its own website privacy policy.
1. Who we are
iCost is provided by I-Cost Ltd, a company registered in England and Wales (company number 09789057), registered office Suite 3, 22e West Station Yard, Spital Road, Maldon, England, CM9 6TS. Our trading address is 24 Holborn Viaduct, London, EC1A 2BN.
We are registered with the Information Commissioner's Office (ICO), registration number ZA787294. For anything about your personal information, email info@i-cost.co.uk.
2. Our role: controller and processor
- We are the controller for information about the people who sign up for and use iCost (accounts, billing, support, security logs).
- Our customers are the controller for the information they put into their iCost workspace, for example their staff, clients, suppliers and project records. We process it only on their instructions, under our Data Processing Addendum. If your details are in a customer's workspace, please contact that company first; we will help them respond.
3. What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, phone number, company name and address, job role, password (stored only as a secure hash), profile picture | You, or your company administrator when they invite you |
| Workspace content | Projects, estimates, purchase orders, quotations, supplier contacts, timesheets, carbon assessments, reports, uploaded documents and photos | Our customers and their users |
| Billing details | Billing contact, plan, number of users, invoices and payment status. Card details are entered on Stripe's secure pages and never reach our servers. | You and Stripe |
| Support | Help-desk tickets, emails to us, questions typed into the Costa assistant | You |
| Technical and security | IP address, browser type, sign-in times, error and security logs, cookies (see the Cookie Policy) | Your device, when you use iCost |
We do not need, and ask you not to upload, special category data (such as health information) into iCost.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account and providing iCost | Contract with you or your company |
| Billing, invoices and keeping financial records | Contract; legal obligation (tax and company law) |
| Service emails: confirmations, invitations, password resets, trial and billing notices | Contract |
| Answering support requests and running the Costa assistant | Contract; legitimate interests in helping customers |
| Keeping iCost secure: sign-in protection, bot checks on sign-up, logs, investigating misuse | Legitimate interests in protecting the service and its users |
| Improving iCost using overall usage information | Legitimate interests (we use totals, not individual profiles) |
| Meeting legal duties and responding to authorities | Legal obligation |
We do not sell personal information, use it for advertising, or make decisions about you by automated means that have legal or similar effects.
5. Who we share it with
We use a small number of trusted providers (subprocessors) to run iCost, such as our UK hosting provider, email provider and payment provider. They act on our instructions under written contracts. The current list is on our Subprocessors page.
We may also share information with professional advisers (lawyers, accountants), with a buyer if our business is sold, or with authorities when the law requires it.
6. Where it is stored and international transfers
iCost and its database are hosted in the United Kingdom. Some providers process limited information outside the UK (for example Stripe and Cloudflare in the United States, Botpress in Canada and the United States). Where that happens we rely on UK adequacy regulations or the UK International Data Transfer Addendum / UK Extension to the EU-US Data Privacy Framework.
7. How long we keep it
- Workspace content and user accounts: while the subscription is active, then deleted 90 days after it ends.
- Sign-ups never confirmed and invitations never accepted: 30 days.
- Billing records: 6 years after the end of the financial year, as tax law requires.
- Records of the terms a customer accepted: 6 years after the contract ends.
- Help Desk queries in iCost: deleted 30 days after the query is closed, with their replies and attachments. Support emails: 2 years after the issue is closed. Assistant conversations: 90 days.
- Security logs: 14 days. Backups: rolling 30 days.
Company administrators can download all their company's data at any time from My Account, including after the subscription has ended until the workspace is deleted.
8. How we protect it
Data is encrypted in transit (HTTPS), passwords are stored as one-way hashes, each customer's data is kept separate and access is limited to people who need it. Uploaded documents are stored privately and only shown to the company they belong to. See Security.
9. Your rights
You have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have information deleted, or its use restricted, in certain circumstances;
- object to our use of it where we rely on legitimate interests;
- receive your information in a portable format;
- withdraw consent at any time, where we rely on consent.
To make a request, email info@i-cost.co.uk. We may ask you to confirm your identity. We reply within one month and there is normally no charge.
10. Complaints
If you are unhappy with how we have handled your information, please tell us first at info@i-cost.co.uk. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
11. Changes to this notice
We will update this notice when our practices change and show the date at the top. If a change is significant we will tell account holders by email or in iCost.