Effective 6 September 2026 · UK GDPR, EU GDPR, PECR
Privacy
CostPerJob is operated by Media Yard LLC (“we”, “us”), a United States limited liability company. New Jersey is our place of establishment. Postal address: Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. This notice is for people who use costperjob.com and, when it is live, the magic-link sign-in. It covers what Media Yard LLC collects as a controller. Job records you store in the shop OS are handled as a processor under the DPA.
We do not sell personal data. We do not train a model on your jobs. Contact: hello@costperjob.com.
Controller
The controller is Media Yard LLC, trading as CostPerJob. We have not appointed a DPO; hello@costperjob.com is the privacy contact. We have not appointed an Article 27 representative in the Union. If we do, this section will name them.
What we collect as controller
- Work email and workspace membership, so we can send a magic link and run the account.
- Plan, Stripe billing identifiers, and invoice status on Pro. We do not store full card numbers. Stripe is not used on Free.
- A session cookie after sign-in when the app is live.
- Server logs (IP, user agent, timestamps) needed to keep the site up.
- What you write to support@costperjob.com or hello@costperjob.com.
Marketing pages and the client-side tools do not require an account. Calculator inputs stay in your browser unless you download a CSV yourself.
What we process as processor
When you use the shop OS we store job records you enter: pricebook items, estimates, materials, hours, and scorecard totals. That pile is yours. We keep it for the life of the workspace. Close the account and we delete it, subject to backups that age out.
Security
Traffic to CostPerJob uses TLS. Access to account and job data is limited to people who run CostPerJob. Backups age out.
UK GDPR and EU GDPR lawful bases
- Contract (Art. 6(1)(b)): email, magic link, workspace, providing the shop OS, paid-plan billing.
- Legitimate interests (Art. 6(1)(f)): security logs, abuse detection.
- Legal obligation (Art. 6(1)(c)): tax and accounting records for paid invoices.
We do not rely on consent for the core product. We do not send marketing mail. We do not make solely automated decisions that produce legal or similarly significant effects (Art. 22).
Cookies (PECR)
We only use cookies that are strictly necessary: a session cookie after the magic link, when the app is live. We do not use advertising, analytics, or remarketing cookies. UK PECR does not require a consent banner for strictly necessary cookies.
Who we share with
Processor data from the shop OS (DPA Annex 3)
| Legal name | Address | Location | What they do |
|---|---|---|---|
| Vercel, Inc. | 440 N Barranca Ave #4133, Covina, CA 91723, United States | United States | Hosts the site and the app |
Account processors (we are controller)
| Legal name | Location | What they do |
|---|---|---|
| Resend, Inc. | United States | Transactional magic-link mail, when sign-in is live |
| Stripe, Inc. | United States | Paid-plan billing. Not used on Free. |
Before a new party begins processing job records we will update this page and email account holders at least 30 days in advance. We do not sell personal data and we do not share it for cross-context advertising.
International transfers
We host in the United States. For UK GDPR restricted transfers we use the UK Addendum to the EU SCCs. For EU GDPR we use the 2021 EU SCCs. Swiss transfers use the SCCs as adapted for Switzerland. The modules and annexes live in the DPA. We are not currently certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.
How long we keep it
Account email: for the life of the workspace. Close the account and we delete the workspace and job records. Invoice and tax records stay as the law requires. Support mail: as long as the thread is open, then a short archive. Backups age out.
Your rights (UK, EEA, Switzerland)
You can ask for access, correction, erasure, restriction, portability, or to object. Erasure is close-account once the app is live. We still answer rights emails within one month. You can complain to the ICO, your EU supervisory authority, or the Swiss FDPIC.
California and other US state laws
We collect identifiers (work email) and commercial information (plan and invoice status). We do not sell or share personal information as those terms are used in the CCPA/CPRA. Virginia, Colorado, Connecticut, Utah, and New Jersey: email hello@costperjob.com from the work email on the account.
Children
CostPerJob is a B2B product. It is not for anyone under 18. We do not knowingly create accounts for children.
What we do not claim
Media Yard LLC is not SOC 2 certified. CostPerJob is not HIPAA certified. The DPA and AI policy are public. For a signed DPA, email hello@costperjob.com.