Contact Details
Email: privacy@costnav.com
What Information We Collect, Use, and Why
To provide services and goods, including delivery:
· Names and contact details
· Purchase or account history
· Account information
· Website user information (including user journeys and cookie tracking)
For the operation of customer accounts and guarantees:
· Names and contact details
· Payment details (including card or bank information for transfers and direct debits)
· Purchase history
· Account information, including registration details
· Information used for security purposes
· Marketing preferences
For regional pricing and subscription management:
We use your IP address to estimate your country and display the appropriate regional subscription pricing and currency. The lookup is performed using a locally hosted geolocation database. If your country cannot be determined, we apply our default Rest of World pricing.
When you start or change a paid subscription, we may retain:
· Your detected pricing region and assigned currency
· A cryptographic fingerprint derived from your IP address — not the raw IP address itself
· The country associated with your payment card, as provided by Stripe
· Whether your detected country and payment-card country matched
We use this information to maintain consistent regional pricing, administer your subscription and protect the integrity of our billing system. A mismatch does not automatically prevent subscription activation.
Your detected country and assigned pricing region are shared with Stripe when processing your subscription. Stripe processes this under its own privacy terms.
Regional pricing verification records are retained for up to 90 days and then deleted. Your assigned pricing region may remain associated with your account beyond that period to keep pricing consistent for future subscription changes.
For service updates or marketing purposes:
· Names and contact details
· Marketing preferences
· IP addresses
· Website and app user journey information
· Records of consent, where appropriate
To comply with legal requirements:
· Name
· Contact information
· Financial transaction information
· Any other personal information required to comply with legal obligations
For dealing with queries, complaints or claims:
· Names and contact details
· Account information
· Purchase or service history
· Financial transaction information
· Correspondence
Lawful Bases and Data Protection Rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information.
Your data protection rights:
· Right of access — you can ask us for copies of your personal information
· Right to rectification — you can ask us to correct or delete inaccurate or incomplete information
· Right to erasure — you can ask us to delete your personal information
· Right to restriction of processing — you can ask us to limit how we use your information
· Right to object to processing — you can object to how we process your data
· Right to data portability — you can ask us to transfer your information to another organisation or to you
· Right to withdraw consent — where consent is our lawful basis, you can withdraw it at any time
If you make a request, we must respond without undue delay and within one month. To make a data protection rights request, contact us at privacy@costnav.com.
Our lawful bases for providing services and goods:
· Contract — we collect or use this information to carry out our contract with you
· Legitimate interests — we collect and analyse website usage data, including user journeys and cookie information, to understand how our platform is used and to improve the experience for our users. This benefits users directly by enabling us to identify and fix usability issues, develop features that meet their needs, and ensure the platform performs reliably. The data collected is aggregated and pseudonymised. Users can opt out of analytics cookies at any time through our cookie preferences.
Our lawful bases for customer accounts and guarantees:
· Contract — we collect or use this information to carry out our contract with you
· Legal obligation — we collect or use this information to comply with the law, including financial record-keeping requirements
Our lawful bases for service updates or marketing purposes:
· Contract — service updates (such as trial reminders and account notifications) are necessary to deliver the service you signed up for
· Consent — marketing communications are only sent with your permission, which you can withdraw at any time
Our lawful bases for legal requirements:
· Legal obligation — we collect or use this information to comply with the law
Our lawful bases for dealing with queries, complaints or claims:
· Contract — handling your queries and complaints is part of our contractual relationship with you
· Legitimate interests — we retain records of queries, complaints and claims to resolve disputes fairly, improve our service, and protect our organisation in the event of a legal claim. The information retained is limited to what is necessary and is not used for any other purpose.
Where We Get Personal Information From
· Directly from you
How Long We Keep Information
We retain personal information for the following periods:
| Data Type | Retention Period | Reason |
|---|---|---|
| User account data | Duration of subscription plus 12 months after account closure | To allow account reactivation and resolve queries |
| Recipe, product and order data | Duration of subscription plus 12 months after account closure | To allow users to export or reactivate data |
| Payment & transactions | 7 years | Legal requirement under HMRC record-keeping rules |
| Website analytics data | 26 months for GA4; as set by PostHog's retention | Standard provider retention periods |
| Customer support emails | 3 years | To handle follow-up queries or disputes |
| Marketing consent records | Until consent is withdrawn, plus 12 months | To evidence compliance with requirements |
These retention periods may be updated from time to time. The most current version of this notice will always be available on our website.
Children's Privacy
CostNav is intended for use by food business owners and entrepreneurs aged 18 and over. It is not designed or intended for use by children, and we do not knowingly collect personal data from individuals under the age of 18.
If you believe a child has provided us with personal data, please contact us at privacy@costnav.com and we will take steps to delete it promptly.
How to Complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Email: privacy@costnav.com
If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Last updated: 30 June 2026