Privacy

CostPerJob is operated by Media Yard LLC (“we”, “us”), a United States limited liability company. New Jersey is our place of establishment. Postal address: Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. This notice is for people who use costperjob.com and the magic-link sign-in. It covers what Media Yard LLC collects as a controller. Job records you store in the shop OS are handled as a processor under the DPA. The legal hub lists every policy we publish.

We do not sell personal data. We do not train a model on your jobs. Contact: hello@costperjob.com.

Controller

The controller is Media Yard LLC, trading as CostPerJob. We have not appointed a DPO; hello@costperjob.com is the privacy contact. We have not appointed an Article 27 representative in the Union. If we do, this section will name them.

What we collect as controller

• Your email and workspace membership, so we can send a magic link and 6-digit code and run the account. Gmail is fine.
• Paid-plan billing. If you subscribe to Pro or Scale, we process plan billing through Stripe, Inc. We store plan and Stripe billing identifiers needed to run the subscription. We do not store full card numbers — Stripe does.
• Job payment tooling (when enabled). If and when customer job-payment / Stripe Connect features are enabled for your account, we may store payment-request metadata such as amount, optional tip, platform fee, status, and Stripe identifiers needed to show the request in CostPerJob. We do not store full card numbers. When a customer pays, Stripe settles to your connected Stripe account under Stripe’s terms. Media Yard does not hold those job funds as a wallet or escrow.
• While job-payment / Connect features are paused, we do not collect new customer job-payment card data through CostPerJob for that purpose. Historical metadata from past requests (if any) may remain until you delete related records or close the account, subject to legal retention needs.
• A session cookie after sign-in.
• Server logs (IP, user agent, timestamps) needed to keep the site up.
• First-party funnel events (signup completed, first scorecard, history wall, checkout started/completed) so we can count those steps. Rows store an event name, optional account id, and non-email props — not advertising or remarketing cookies.
• What you write to support@costperjob.com or hello@costperjob.com.

Marketing pages and the client-side tools do not require an account. Calculator inputs stay in your browser unless you download a CSV yourself.

What we process as processor

When you use the shop OS we store job records you enter: pricebook items, estimates, materials, hours, and scorecard totals. That pile is yours. We keep it for the life of the workspace. Close the account and we delete it, subject to backups that age out.

Security

Traffic to CostPerJob uses TLS. Access to account and job data is limited to people who run CostPerJob. Backups age out.

UK GDPR and EU GDPR lawful bases

• Contract (Art. 6(1)(b)): email, magic link, workspace, providing the shop OS, paid-plan billing.
• Legitimate interests (Art. 6(1)(f)): security logs, abuse detection, first-party funnel counts.
• Legal obligation (Art. 6(1)(c)): tax and accounting records for paid invoices.

We do not rely on consent for the core product. We do not send marketing mail. We do not make solely automated decisions that produce legal or similarly significant effects (Art. 22).

Cookies (PECR)

We only use cookies that are strictly necessary: a session cookie after the magic link. We do not use advertising, analytics, or remarketing cookies. UK PECR does not require a consent banner for strictly necessary cookies.

Who we share with

Processor data from the shop OS (DPA Annex 3)

Account processors (we are controller)

Before a new party begins processing job records we will update this page and email account holders at least 30 days in advance. We do not sell personal data and we do not share it for cross-context advertising.

International transfers

We host in the United States. For UK GDPR restricted transfers we use the UK Addendum to the EU SCCs. For EU GDPR we use the 2021 EU SCCs. Swiss transfers use the SCCs as adapted for Switzerland. The modules and annexes live in the DPA. We are not currently certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

How long we keep it

Account email: for the life of the workspace. Close the account and we delete the workspace and job records. The same email can start a fresh account afterward. Invoice and tax records stay as the law requires. Support mail: as long as the thread is open, then a short archive. Backups age out.

Your rights (UK, EEA, Switzerland)

You can ask for access, correction, erasure, restriction, portability, or to object. Erasure is close-account. We still answer rights emails within one month. You can complain to the ICO, your EU supervisory authority, or the Swiss FDPIC.

California and other US state laws

We collect identifiers (email) and commercial information (plan and invoice status). We do not sell or share personal information as those terms are used in the CCPA/CPRA. Virginia, Colorado, Connecticut, Utah, and New Jersey: email hello@costperjob.com from the email on the account.

Children

CostPerJob is a B2B product. It is not for anyone under 18. We do not knowingly create accounts for children.

QuickBooks Online

Connecting shares this shop's job cost lines with Intuit. Disconnect removes the tokens. That happens only if you connect on a Pro or Scale account. We do not read your QuickBooks books back into CostPerJob.

What we do not claim

Media Yard LLC is not SOC 2 certified. CostPerJob is not HIPAA certified. The DPA and AI policy are public. For a signed DPA, email hello@costperjob.com.