Privacy Policy

1. Who We Are and Data Controller Identification

Tracost is a specialized construction cost control platform that enables general contractors, quantity surveyors, civil engineers, and property developers to manage site cash advances, vendor credit liabilities, project budgets, receipt records, automated digests, and team communication.

For personal data collected through your direct account creation and billing relationships, the data controller is:

Where an organization contracts Tracost to manage company project data, the contracting organization acts as the Data Controller for its project records and workforce data, and Tracost acts as the Data Processor.

2. Data Minimization Principle & Information We Collect

Under our strict data minimization policy, we only collect information necessary to deliver authentic, secure cost accounting and team collaboration services. We collect:

• Account & Profile Details: Full name, professional work email, telephone/WhatsApp number, user initials, assigned organizational role, and assigned construction sites.
• Authentication Identifiers: Secure identity tokens provided by Google OAuth or email sign-in (passwords are hashed securely by Supabase Auth and never visible in plaintext).
• Project & Financial Ledger Records: Project names, client labels, Ghana administrative regions, approved budget amounts, allocated field cash balances, expense categories, vendor payees, item quantities, unit rates, receipts, and payment method details.
• Vendor Credit Obligations: Unsettled vendor invoices, partial debt settlements, and supplier contact identifiers entered by authorized site staff.
• Operational Communications: In-app team messages exchanged between site managers, operations managers, and directors regarding project costs.
• Notification Logs: Delivery timestamps and delivery statuses for daily email digests and SMS alerts.
• Technical Session Data: IP address, device operating system, browser type, and timestamps for security audit trails and fraud prevention.

3. Legal Grounds for Processing

We process personal and organizational data in full compliance with the Ghana Data Protection Act, 2012 (Act 843) and applicable international privacy principles (including the EU/UK General Data Protection Regulation):

• Performance of Contract: To establish and maintain your organization's workspace, verify site manager permissions, process transactions, and deliver cost control tools.
• Legitimate Interests: To prevent financial leakage, secure the service against unauthorized access, maintain audit logs, and provide customer support.
• Legal & Tax Obligations: To comply with mandatory statutory record-keeping and corporate governance requirements under the laws of the Republic of Ghana.
• Consent: For optional SMS and email digest updates, which you can adjust or withdraw at any time in your profile settings.

4. Third-Party Service Providers and Subprocessors

We only share data with vetted, enterprise-grade technology partners required to host, secure, and operate Tracost:

• Supabase Inc.: Cloud database infrastructure, real-time sync, and encrypted authentication.
• Paystack Payments Ltd.: Bank of Ghana licensed payment service provider for Visa, Mastercard, and Mobile Money (MTN MoMo, Telecel Cash) billing. Tracost never stores raw credit card numbers or Mobile Money PINs.
• Google LLC: Identity verification via Google Sign-In and cloud communication services.
• Twilio / Resend: Encrypted SMS and transactional email delivery for project digests and critical cost alerts.

We do NOT sell, rent, or trade your personal or business data to advertisers, data brokers, or marketing networks.

5. Cookies & Tracking Technologies

Tracost does not use third-party advertising cookies or cross-site tracking scripts. We only deploy strictly necessary local storage and session tokens required for authentication and active workspace preferences. For full itemized details, please review our Cookie Policy.

6. International Data Transfers & Cloud Security

Tracost stores data in secure, tier-3 cloud data centers with AES-256 encryption at rest and TLS 1.3 encryption in transit. Where data is processed across borders, we implement appropriate safeguards in compliance with Section 49 of the Ghana Data Protection Act, 2012 (Act 843) and standard contractual clauses.

7. Data Retention & Erasure

We retain organizational data for the duration of your active subscription and as necessary to satisfy statutory tax, audit, and legal obligations. When an organization cancels its account, data undergoes a soft-deletion recovery window, followed by irreversible database purging upon formal request.

8. Your Statutory Rights

Under the Ghana Data Protection Act (Act 843), GDPR, and other applicable laws, you have the right to:

• Access: Request confirmation and a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete records.
• Erasure (Right to be Forgotten): Request deletion of your personal account data, subject to legal record-keeping requirements.
• Data Portability: Export your transaction histories and reports in standard CSV / Excel formats.
• Objection / Restriction: Object to specific processing activities or withdraw consent for optional alerts.

9. Contact Business Information