Privacy Policy
Last updated: 28 August 2026
This policy explains what personal data costdown.org collects, why, how long it is kept, who else sees it, and what you can do about it. It is the information notice required by Article 13 and Article 14 of the EU General Data Protection Regulation (GDPR).
It describes what the service actually does today. Where a statement could not be verified against the running system, it is not in this document.
1. Who is responsible (data controller)
costdown.org is operated by an individual, not a registered company. That individual is the data controller within the meaning of Article 4(7) GDPR.
No general email address is published for the controller. All contact — including every request described in section 10 — goes through the Contact. Messages sent there are stored, and you receive a reference number immediately, so a request cannot quietly disappear.
The one exception is [email protected], a dedicated address for reporting security vulnerabilities, also published at /.well-known/security.txt. It exists so that someone who finds a flaw has an obvious place to send it, and it is not a channel for the requests in section 10 — those go through the contact form, which stores your message and gives you a reference number.
2. Data Protection Officer
No Data Protection Officer has been appointed. Article 37(1) GDPR requires one only where the core activity involves large-scale regular monitoring of individuals, or large-scale processing of special categories of data. costdown.org does neither: it processes business cost-reduction data, and the personal data it holds is limited to what is listed in section 4.
3. You are not asked for your identity
This is the part most privacy policies cannot say, so it comes before the table. Registering for costdown.org asks for four things: an email address, a password, whether you are an expert or an investor, and your country. That is all.
You are never asked for your real name, and there is nowhere to enter a phone number. On the platform you are identified by a short code the system generates for you — such as 2E — and that code, not a name, is what appears next to everything you publish.
Your email address is still personal data: it identifies you, we hold it, and everything in this policy applies to it. It is used to sign you in and to send account email. It is never shown to other users.
4. What data is collected
| Data | Where it comes from | Why |
|---|---|---|
| Email address and password (stored only as a hash) | You, when registering | To create and secure your account |
| Country | You, when registering | Benchmarks only compare figures within one country, so this is required |
| Account code, role, language preference, verification and suspension status | Generated by the service | The account code is your public identity here; the rest runs the account |
| Short bio | You, optionally | Shown on your public profile if you write one; leave it empty and nothing is shown |
| A join code linking you to a group of colleagues - stored as a keyed hash, never as the code itself | Generated by the service when you or a colleague create a group | So that colleagues share internal material codes and are compared together, without naming the employer. See the notes below this table. |
| Group name, industry, country, size | You, optionally, on the Company page | Only if you choose to fill them in. Industry and country place your figures in the right benchmark group; the name is not used for anything the system needs. |
| Case studies, cost figures, engagements, verifications and comments you write | You | This is the content of the service; published items are visible to everyone |
| IP address recorded with case-study views | Your browser | To count views and detect abuse |
| IP address held temporarily while rate-limiting requests | Your browser | To stop automated abuse of registration, password reset and the contact form |
| A change log of edits to savings, investment, verification, status and role — old value, new value, which account, when | Generated by the service | Auditability: a benchmark platform is only worth anything if figures cannot be changed silently |
| Name you type, email, message and IP address from the contact form | You | To answer you and to stop abuse of the form |
How colleagues are grouped. Not by naming your employer. The system generates a random join code — something like 7KQ2M-XB49P — which you pass to your colleagues; whoever enters it lands in the same group as you. That is all the grouping needs, so the company itself is never named.
The join code is not stored. What the database holds is an HMAC-SHA256 of the code, keyed with a secret that lives in a file on the server — not the code itself. A plain hash would not be enough here: a ten-character code is around 10^15 combinations, which a graphics card walks through in minutes. With the server key mixed in, a copy of the database on its own is useless for recovering any code.
Said plainly, because overstating this would be worse than saying nothing: whoever operates the server holds both the database and that key, so we do not claim the code is beyond everyone. What is true is that the code is never stored in readable form, never written to logs, and shown to you exactly once — at the moment you create it. If you lose it, nobody can retrieve it for you, including an administrator; you create a new code instead, and revoke the old one.
Naming the group is still possible, and still optional. There is a field for it, left over from before join codes existed and kept for groups that want a label. Fill it in and the name is stored exactly as typed and is readable by administrators. Leave it empty — the default — and every feature works the same.
Two fields exist in the database but are never filled in by anything: a phone number and a time zone. Nothing in the site writes to them and no account has a value in either. They are listed here only so that this document matches the database exactly rather than quietly omitting something.
There is no tracking of you across other websites, no advertising profiling, and no automated decision-making or profiling that produces legal effects within the meaning of Article 22 GDPR.
5. Cookies and browser storage
While you are logged out, costdown.org sets no cookies at all, and stores nothing in your browser’s local or session storage. This was verified against the live site.
After you log in, one cookie is set — user_id — which holds a signed session token. It is strictly necessary to keep you logged in, so no consent banner is required for it under the ePrivacy Directive. Logging out deletes it.
Traffic measurement uses Cloudflare Web Analytics, which is cookieless: it does not set an identifier in your browser and does not follow you to other sites.
6. Legal basis for processing
| Processing | Legal basis |
|---|---|
| Creating and running your account; publishing the content you submit | Article 6(1)(b) — performance of a contract with you |
| Session cookie, password hashing, login-attempt limits, IP rate limiting | Article 6(1)(f) — legitimate interest in keeping the service and its users secure |
| View counts and aggregate traffic measurement | Article 6(1)(f) — legitimate interest in knowing whether the service is used |
| The immutable change log of financial and verification figures | Article 6(1)(f) — legitimate interest in data that can be trusted, which is the entire purpose of the platform |
| Handling messages you send through the contact form | Article 6(1)(b) where it concerns the service; Article 6(1)(c) — legal obligation — where it is a request under Articles 15–22 |
| Transactional email (verification, password reset, account notices) | Article 6(1)(b) — necessary to provide the account |
You are not obliged to provide any of this. But an account cannot exist without an email address, a password and a country, so declining those means the service cannot be provided. Everything marked optional in section 3 can be left empty with no loss of function.
7. Who else receives the data
| Recipient | What they see | Role |
|---|---|---|
| Hetzner Online GmbH (Nuremberg, Germany) | Everything stored by the service — they host the server and database | Processor |
| Cloudflare, Inc. | Your IP address, user agent and requested URLs, as the network in front of the site; plus cookieless traffic measurement | Processor |
| Resend (running on Amazon Web Services, Ireland) | The recipient address and content of transactional email sent to you - account verification, password resets, account notices | Processor |
| Other users of costdown.org | Anything you publish: case studies, cost figures, comments, and the profile fields you fill in | Not a processor — publication is the purpose |
Personal data is not sold, and is not shared with advertisers or data brokers. It is disclosed to public authorities only where the law requires it.
8. International transfers
The server and the database are located in Germany, inside the EU. Day-to-day operation of the service therefore involves no transfer of your data out of the EEA.
Two exceptions, stated plainly:
- Cloudflare, Inc. is a US company operating a global network. Traffic to costdown.org may be handled at an edge location outside the EEA. Cloudflare relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework.
- Encrypted database backups are copied from the German server to a machine held by the controller in a country outside the EEA, so that a failure of the hosting provider cannot destroy every copy at once. That country has no European Commission adequacy decision. The backups are encrypted with AES-256 before they leave the server, are readable only with a passphrase the hosting provider does not hold, and are kept by nobody but the controller.
9. How long data is kept
| Data | Retention |
|---|---|
| Account and profile data | Until you ask for deletion. Ask through the contact form and it is removed. |
| Case studies and other content you published | Until you delete it, or ask us to. Note that figures already used in a published benchmark comparison may remain in aggregate form, where no individual can be identified. |
| Change log of financial and verification figures | Kept for the life of the record and deliberately cannot be edited or deleted early — this is enforced by the database itself, not by application code. Without that, no figure on this platform could be trusted. It records what changed and by which account, not personal details. |
| IP addresses recorded with case-study views | Kept with the view record; removed when the case study is deleted. |
| IP addresses used for rate limiting | Held in memory only, and expire automatically within the rate-limit window (at most one hour). |
| Join codes (as keyed hashes) | Kept while the code is active. Revoking a code marks it revoked rather than erasing the row, so that a code cannot silently be brought back into use; the row holds a hash, not the code. |
| Contact-form messages | Kept while the matter is open and afterwards as evidence that a legal request was answered in time; deleted on request once it is closed. |
| Encrypted backups | Hourly backups on the server are kept for 72 hours. Daily copies held off-site by the controller are kept for 30 days. Data you asked to delete can survive in backups until those windows pass. |
10. Your rights as a data subject
Under the GDPR you may exercise the following rights at any time and free of charge. Each is named below by its legal term as well as in plain words, because the legal term is what binds:
- Right of access (Article 15) — ask what data is held about you and receive a copy of it.
- Right to rectification (Article 16) — have inaccurate data corrected, or incomplete data completed.
- Right to erasure, also called the right to be forgotten (Article 17) — have your data deleted.
- Right to restriction of processing (Article 18) — have processing frozen while a dispute is resolved.
- Right to data portability (Article 20) — receive your data in a structured, commonly used, machine-readable form, and have it sent to another controller where technically feasible.
- Right to object (Article 21) — object to processing based on legitimate interests, including the view counting described above.
- Right to withdraw consent (Article 7(3)) — where processing rests on consent, withdraw it at any time, without affecting what was lawful beforehand.
- Right not to be subject to automated decision-making (Article 22) — costdown.org makes no automated decisions producing legal or similarly significant effects, so this right is not engaged.
Use the Contact and choose Personal data request. You will get a reference number at once, and an answer within one month, as Article 12(3) requires. If the request is complex, we may extend that by up to two further months and will tell you why before the first month is out.
11. Right to complain to a supervisory authority
If you think your data has been handled unlawfully, you may lodge a complaint with a data protection supervisory authority — you can go to the one in your country of residence, your place of work, or where the alleged infringement happened (Article 77 GDPR). You do not need to contact us first, though it is usually faster if you do.
A list of the EU and EEA authorities is published by the European Data Protection Board at edpb.europa.eu. Because the server is in Germany, the German federal and Bavarian state authorities are also competent.
12. Security
- Passwords are stored only as hashes; they are never stored or logged in readable form.
- The whole site is served over HTTPS with HSTS.
- Repeated failed logins lock the account temporarily, and requests to registration, password reset and the contact form are rate-limited by IP.
- Every read and write of your data is checked against your permissions on the server, not only in the browser.
- Backups are encrypted with AES-256, and restoring from them is tested rather than assumed.
No system is perfectly secure. If you find a vulnerability, please report it to [email protected] before disclosing it publicly. The same address is published in machine-readable form at /.well-known/security.txt, in the format of RFC 9116. The contact form works too, if you prefer it.
13. Children
costdown.org is a tool for people working in manufacturing and is not directed at children. Accounts are not knowingly created for anyone under 16. If you believe a child has registered, tell us through the contact form and the account will be removed.
14. Changes to this policy
The date at the top changes whenever this document does. If a change materially affects your rights, registered users are notified by email rather than left to notice it.