This Privacy Policy describes how Adyadi Private Limited (“we”, “us”, or “Costimator”) collects, uses, stores, and protects your personal data when you access costimator.in or use the Costimator application (the “Service”). It is written to comply with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.
By using the Service, you consent to the practices described in this Policy. If you do not agree with these practices, please do not use the Service.
1. Who We Are
Costimator is a cloud-based cost estimation and tender justification platform for engineers working with Indian Schedules of Rates (DSR/DAR/SoR/AoR). It is operated by Adyadi Private Limited, a private limited company incorporated in India in 2026.
Operating Entity: Adyadi Private Limited
Corporate Identification Number (CIN): U79900UP2026PTC250933
GSTIN: 09ABGCA3493F1ZJ
Privacy Contact: Kushal Singh, Founder, available at support@costimator.in
2. What Data We Collect
2.1 Information You Provide at Signup
When you create a Costimator account, we collect the following:
- Full name
- Email address
- Phone number (preferably a WhatsApp number)
- Organization or company name, and organization type (including whether it is a government department, PSU, consultancy or academic institution)
- Job title or designation
- Office or posting state
2.2 Information You Provide for Specific Purposes
Profile photograph: If you upload one, it is stored in our own object storage and shown to you in the application. If you publish to the marketplace (Section 4), it is also shown on your listings.
Marketplace publisher profile: If you choose to publish a listing, we store a publisher display name, company name, short bio and avatar. These are shown to other users alongside your listing. Your email address is never shown.
Affiliate payout details: If you join our affiliate programme, we collect your legal name, PAN, bank account number and bank IFSC. We need these to verify you and to pay commissions, and we use them for nothing else. They are visible only to you and to the staff who process payouts.
2.3 Information We Collect Automatically
When you use the Service, we automatically collect:
- Estimates, projects, non-scheduled items, justifications, reports, and other data you create within the application
- A record of each sign-in, containing the time, your IP address, and your browser’s user-agent string, kept for security and audit purposes
- Data about payments you make, as described in Section 2.4
- Product-usage events in the application (see Section 10), linked to your account’s internal ID when you have not opted out
What we do not collect: the search box inside the application does not send what you type to us. We send the rate data for your publication to your device and the search runs there, so your search terms are never transmitted or stored.
2.4 Payment Information
When you subscribe to a paid plan, payment is processed by Razorpay Software Private Limited through Razorpay Subscriptions (our older Payment Link and Orders flows are retired).
- Individual plans: we create a Razorpay subscription carrying the plan, billing cycle, any coupon applied, and an internal account reference. Razorpay’s checkout window on our billing page is prefilled with your email and phone number to save typing.
- Team plans: we create a subscription carrying the plan, billing cycle, number of seats, any coupon applied, and internal organisation and payer references. We send no email or phone number to Razorpay; you enter your contact and payment details on Razorpay’s own page.
- Both flows: Razorpay collects your card, UPI or bank details and holds the recurring-payment mandate used for renewals. We never see full card or bank details. We retain the transaction reference, the amount paid, and the plan associated with the payment, for tax and accounting records.
If you pay by direct bank transfer or government Purchase Order, we receive the relevant transaction details (bank reference number, PO number) but no card information.
2.5 Referral Links
If you arrive at the Service through an affiliate’s referral link, we record the click — the time, your IP address, your browser’s user-agent string, and the page you came from — and we store a first-party cookie named costimator_ref on your device for 30 days so the referral can be credited if you subscribe later. If you do subscribe, we record which affiliate referred your account, so the commission can be calculated.
The affiliate is shown the number of clicks and sign-ups they generated and the commission owed to them. They are not shown your name, email address or anything you create in the Service.
3. How We Use Your Data
We use the data we collect for the following purposes:
- To provide and operate the Service (creating estimates, generating reports, processing subscriptions)
- To authenticate your identity and secure your account
- To process payments and keep the tax records we are required to keep
- To send transactional email: sign-in and signup codes, organisation invitations, renewal reminders, and notices about the Service
- To operate the marketplace, where you choose to publish (Section 4)
- To run the affiliate programme — attributing referrals and paying commissions
- To respond to support requests and service enquiries
- To detect, prevent, and address fraud, security incidents, or violations of our Terms of Service
- To comply with legal obligations (tax records, lawful requests from authorities)
We do not use your data for automated decision-making or AI/ML-based profiling that produces legal or significant effects on you. Nothing you create in the Service is sent to any artificial-intelligence or machine-learning service. We do not sell your data, rent it, or share it with advertising networks or data brokers.
4. Sharing and the Marketplace
Nothing you create is visible to anyone else unless you choose to share it. By default, your projects, estimates and rate libraries are yours alone.
The Service includes a marketplace. If you are on a paid plan you may publish a project, rate library or Non-SOR item to it, choosing one of three audiences:
| Audience | Who can see it |
|---|---|
| Public | Any signed-in Costimator user |
| Organisation | Members of your organisation only |
| Specific people | Only the people you name by email address, up to 20 |
Listings go live as soon as you publish them.
What a listing shows about you: your publisher display name, company name, short bio and avatar. Your email address is never shown. If you have not set a publisher display name, we create one for you from your profile the first time you publish.
Reviews are public. If you review a listing, your review text and your display name are shown to anyone who can see that listing.
Whatever you put into a listing travels with it. Titles, descriptions and the items themselves are shown to the audience you chose. We do not scan or remove client names, project identifiers or other details you may have typed in. Please do not publish anything you would not want that audience to read.
When you share with specific people, you can see the email addresses of the people you shared with, so you know who has access.
Team plans. Work created in an organisation’s workspace is visible to that organisation’s administrators, and belongs to the organisation. This is described in our Terms of Service, in the sections on Team Plans and on ownership of your content.
Trial accounts cannot publish to the marketplace.
5. Third-Party Service Providers
We use a small number of trusted service providers (“processors”) to operate the Service. Each processes your data only to deliver the function described below. We do not share your data with anyone for marketing, advertising, or any purpose unrelated to operating the Service.
| Provider | Purpose | Data shared |
|---|---|---|
| Hostinger International Ltd. | Server infrastructure hosting our database and application, located in Mumbai, India | All account and product data resides on this infrastructure. Hostinger provides the servers; it does not access application data |
| Razorpay Software Private Limited | Payment processing for paid subscriptions (Razorpay Subscriptions) | Plan, billing cycle, coupons, internal account or organisation references, and — for individual checkout — email and phone prefilled at Razorpay’s window. Razorpay holds the recurring-payment mandate and collects payment details directly from you |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (Tokyo, Japan — AWS ap-northeast-1) | Recipient email address and message content |
| Functional Software, Inc. (Sentry) | Application error monitoring | Error diagnostics and stack traces, including the IP address, browser user agent and page URL where the error occurred. Cookies and authorization headers are stripped before transmission, and no account identity is attached to an error report |
| PostHog, Inc. | Product analytics (PostHog Cloud EU, Frankfurt, Germany) | Website: page views and clicks. Counted anonymously without cookies unless you choose “Accept all” in our cookie notice; then a first-party cookie holds a random visitor ID for 180 days from your last visit. No person profiles, and visits are never linked to your name or email; client IPs are discarded. App: usage events linked to your account’s internal ID (no email or name in the events). No session recording |
| Google LLC | Optional sign-in with Google | Only if you choose Google sign-in: your name and email address as released by Google |
| Google LLC (Google Drive) | Offsite storage of encrypted database backups | A full backup copy. It is encrypted on our server before upload, with a key our server does not hold, so it cannot be read by Google or by us from that copy alone |
We may add additional processors in the future. When we do, this Policy will be updated and the change communicated to active users.
6. Where Your Data is Stored
All account and product data is stored on servers we operate in Mumbai, India. The database is a self-hosted deployment on a Hostinger VPS — not a managed third-party database service — so no database vendor has access to it. Hostinger provides the infrastructure only.
The physical location of your data is in India. Hostinger International Ltd., the infrastructure provider, is foreign-incorporated. That distinction matters: location of the data and incorporation of the vendor are not the same fact.
Transfers outside India
Some of our service providers process a limited amount of personal data outside India in order to deliver their service:
| Provider | What they process | Where |
|---|---|---|
| Resend (Plus Five Five, Inc., United States) | Recipient email address and email content, to deliver transactional email | Tokyo, Japan (AWS ap-northeast-1) |
| Functional Software, Inc. (Sentry, United States) | Error diagnostics, with cookies and authorization headers removed before sending | United States |
| PostHog, Inc. (United States) | Product analytics as described in Section 5 | Germany (PostHog Cloud EU) |
| Google LLC (United States) | Your name and email address, only if you choose to sign in with Google | United States and other locations |
| Google LLC (Google Drive, United States) | Encrypted backup copies, which cannot be read without a key held outside that service | United States and other locations |
Razorpay processes payments in India.
We transfer personal data outside India only as permitted by Section 16 of the Digital Personal Data Protection Act, 2023, and not to any country or territory to which the Central Government has restricted such transfers by notification.
7. How Long We Keep Your Data
We retain different categories of data for different periods:
7.1 Project Data
Estimates, projects, non-scheduled items, justifications, reports, and other content you create through the Service are retained while your account exists. Expiry of a subscription does not currently trigger automatic deletion. Deletion on request is handled manually — email support@costimator.in.
7.2 Account Profile Data
Your account profile information (name, email, phone number, organization, organization type, designation, office or posting state) is retained while your account exists, even after a subscription expires. This allows you to retain your account, view your subscription history, and renew at any time.
Profile data is deleted within 30 days of one of the following events: (a) you submit a verified account deletion request, or (b) we close your account for cause as permitted under our Terms of Service. That 30-day window is a manual commitment — there is no automated purge.
7.3 Statutory Retention
Tax-related records (invoices, GST records, payment transaction logs) are retained for a minimum of 8 years from the date of the relevant transaction, as Indian tax law requires. Nothing currently deletes these records automatically. This applies regardless of whether your account is active, expired, or deleted. These records contain transaction-level data only and are kept in secure, access-restricted archives separate from the active product database.
7.4 Security and Referral Records
Sign-in records (time, IP address, user-agent string) and referral click records are kept for security, fraud prevention, and commission accounting. Nothing currently deletes these automatically. Affiliate payout details are retained for as long as the affiliate relationship lasts and afterwards for the period tax law requires.
8. Your Rights Under the DPDP Act
As a user residing in India, the DPDP Act, 2023 grants you specific rights regarding your personal data. We honor each of these rights as follows:
8.1 Right of Access
You may request a copy of all personal data we hold about you.
- From within the application: you can download your reports as Excel files — the BOQ, analyses of rates, resource takeoffs, sub-head breakups, measurements and rate comparisons. These are per-report downloads. There is no single button that exports your whole account.
- Everything else: for account profile data, billing history, sign-in records, or any other data on file, email support@costimator.in. We will provide a complete export within 30 days of a verified request.
8.2 Right of Correction
In your account settings you can change your name, organisation name and type, designation, office or posting state, and profile photograph. If you are a member of an organisation, your organisation’s details are managed by its administrators rather than by you.
Your phone number and email address cannot currently be changed in the application. Email support@costimator.in and we will verify the request and make the change for you.
8.3 Right of Erasure (Account Deletion)
You may request deletion of your account and personal data by emailing support@costimator.in. There is no in-app deletion flow. We process verified deletion requests by hand within 30 days. Statutory records (tax invoices) are retained for the minimum period required by Indian tax law and are not deletable.
Once deleted, your data cannot be recovered. We will send a confirmation email when deletion is complete.
Listings you published to the marketplace are removed with your account. Copies that other users have already taken into their own projects remain with them, because they have become part of their work.
8.4 Right to Withdraw Consent
We send transactional email only: sign-in and signup codes, organisation invitations, renewal reminders, and notices about the Service. We do not currently send marketing email, so there is no marketing consent to withdraw. If that changes, this section will be updated and an unsubscribe mechanism will be provided.
You may stop publishing to the marketplace at any time by removing your listings.
You can withdraw your consent to analytics cookies on the marketing website at any time, as easily as you gave it, from “Cookie settings” at the bottom of every page.
8.5 Right to Grievance Redressal
If you have concerns about how your data is being handled, please contact our Privacy Contact:
Kushal Singh, Founder
Email: support@costimator.in
We will acknowledge your grievance within 7 business days and provide a substantive response within 30 days. If you are dissatisfied with our response, you may escalate the matter to the Data Protection Board of India once it becomes operational under the DPDP Act.
9. How We Protect Your Data
We use industry-standard security practices to protect your data, including:
- Encryption of data in transit
- Encryption of data at rest within our database infrastructure
- Row Level Security (RLS) enabled on all 64 application tables. Server-side billing and administrative processes use an audited service-role path that bypasses RLS by design
- Nightly logical backups, write-ahead-log shipping every 15 minutes, and a weekly verified base backup. Backups are encrypted before they leave the server, with a key the server does not hold
- Sign-in is by one-time code sent to your email address, or through Google. We do not store passwords for any account
- Access controls limiting employee access to user data on a need-to-know basis
- Audit logging of administrative database access
Despite these measures, no system is completely secure. If we become aware of a personal data breach affecting your data, we will notify you and the Data Protection Board (where required) in accordance with the DPDP Act timelines.
10. Cookies and Tracking
The marketing website uses PostHog analytics (see Section 5). Until you choose, or if you choose “Essential only” in our cookie notice, it sets no cookies and stores nothing in your browser for analytics. If you choose “Accept all”, it sets a first-party analytics cookie, kept for 180 days from your last visit, and uses session storage while your tab is open. You can change your choice at any time from “Cookie settings” at the bottom of every page. Do-Not-Track and Global Privacy Control are honoured.
The application uses PostHog analytics linked to your account’s internal ID so we can understand and improve the product. You can switch this off in Settings. The application does not use advertising or third-party tracking cookies.
Our application also uses these cookies (listed in full in our Cookie Policy):
- A session cookie for authentication and security. This is strictly necessary; the Service cannot work without it.
- A referral cookie (
costimator_ref), set only if you arrive through an affiliate’s referral link, and kept for 30 days so the referral can be credited. It contains a referral code and the time of the click. It is not strictly necessary for the Service to work. costimator_coupon, which remembers a coupon from a promotional link until checkout (7 days).sidebar_collapsed, which remembers whether you collapsed the app sidebar (1 year).
Before we use any advertising or marketing tags, we will add them to our cookie notice and ask for your consent.
For full details on cookie use, please see our Cookie Policy.
11. Children’s Privacy
The Service is intended for use by individuals 18 years of age or older. We do not collect date of birth or any other age information, and we do not knowingly collect personal data from individuals under 18. If we discover that an account has been created by a minor, we will close the account and delete associated data. If you believe a minor has provided personal data to us, please contact support@costimator.in.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this Policy will reflect when changes were made. Material changes (such as new categories of data collection, new processors, or material changes to data sharing) will be communicated to active users via email at least 14 days before the change takes effect.
Your continued use of the Service after a Policy update constitutes acceptance of the updated Policy.
13. How to Contact Us
For privacy-related questions, requests, or concerns, contact us at:
Kushal Singh, Founder
Adyadi Private Limited
CIN: U79900UP2026PTC250933
GSTIN: 09ABGCA3493F1ZJ
Email: support@costimator.in
This Privacy Policy is governed by the laws of India. Any disputes arising from or relating to this Policy will be subject to the exclusive jurisdiction of the courts at Lucknow, Uttar Pradesh.