Privacy policy
Last updated October 27, 2026
CostVault is run by Apuri Studio Inc., Ontario, Canada ("we"). This policy explains what we collect, why, where it's kept, and your rights under Canada's privacy law (PIPEDA).
What we collect
- Your account details: your name, email, password (stored only as a one-way hash), restaurant name and province.
- The invoice photos and PDFs you upload, and what's on them: suppliers, items, quantities and prices.
- What you enter in the app, such as item names, notes, price alert decisions and money found.
- Basic technical logs (time, page, errors) that our hosting provider keeps to run the service.
We use one sign-in cookie to keep you logged in. We don't use advertising or tracking cookies.
Why we use it
- To read your invoices, track your prices, show price alerts, spend reports and money found.
- To run your account, contact you about it, and fix problems.
We don't use your data for anything else without asking you first.
Our pledge
We never sell your data, and we never share your prices with any supplier, not in a report, not anonymised, not for a fee.
Where it's kept and who helps us
Your data is stored in Canada. We use these service providers, under contract, only to run the app:
- Supabase: database and invoice files, in Canada (Central), Montreal.
- Amazon Web Services: automatic invoice reading (Textract), in the United States (Ohio). Each invoice photo is sent there only to be read; the photo and what was read are stored in Canada.
- Fly.io: hosting of the app, in Toronto.
- Resend: sending the app's emails (password resets, invites and weekly summaries), in the United States. It sees only the email address and the message.
These companies may be subject to foreign laws. If we ever move your data outside Canada, we'll tell you first.
How we protect it
Connections are encrypted, passwords are hashed, invoice files are kept in private storage, and each restaurant can only see its own data.
How long we keep it
We keep your data while your account is open. If you ask us to close your account, we delete your data and files within 30 days, except what the law requires us to keep.
Your rights
You can export your invoices and prices at any time from the app. You can ask us to see, correct or delete your personal information by emailing info@costvault.ca. We'll answer within 30 days. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before it applies.