Shortcuts: for technicians · for hiring companies
Your invoices, certs and client records are your livelihood. This page says, in plain English, where that data lives, how it is protected, who touches it and the rights you keep. It applies to technicians and company accounts alike, under UK GDPR.
Cowstail runs on servers in Germany (EU). Uploaded files (cert scans, receipts, logos) are stored privately with Cloudflare. Your data is never sold, never shared with advertisers, and never used for anything except running Cowstail for you.
Every connection to Cowstail is encrypted in transit (HTTPS/TLS). Files and backups are encrypted at rest by our storage providers. Passwords are stored only as salted hashes, never in a readable form.
Every record in Cowstail is scoped to its owner's account. A technician's data and a company's data live behind separate walls, and that isolation is covered by an automated test suite that runs on every release, over 200 checks, including cross-account access attempts that must fail.
There is no open directory of technicians. A company only sees a tech's details when the tech acts: applying to a job shares a snapshot the tech approves at that moment (tickets, and optionally phone and day rate); wallet passes are shared through revocable links; joining a company's roster requires the tech's own account. Ratings after a job are private to the side that wrote them.
The database is backed up every day, kept on the server and copied off-site to a second provider, with 30-day retention. Restores are tested, a backup that has never been restored is a hope, not a backup.
Sign-in and sign-up are protected by Cloudflare Turnstile (bot detection without tracking) and rate limiting. Sessions use short-lived tokens with rotation.
When you scan a cert, receipt or logbook page, that photo is sent to OpenAI solely to read the text, under API terms that exclude using your data to train models. Every scan can be done manually instead, and nothing is saved without your confirmation.
Under UK GDPR you can access, correct, export and erase your data. Deletion is built into the product: Settings → Delete account removes the account, every record and every uploaded file. Export is available on request at hello@cowstail.app while the in-app download is being finished.
The short list of services that process data on our behalf, each bound by its own data processing terms:
We monitor for incidents and, in the event of a breach affecting personal data, we will notify affected users and the ICO without undue delay, within the 72-hour window UK GDPR sets.
A standard Data Processing Agreement is available on request. Companies only ever see technician data the tech consented to share, and applicant snapshots stay inside your account like everything else.
Security questions or disclosures: hello@cowstail.app with "Security" in the subject. We answer fast.
Cowstail LTD, registered in England & Wales. Registered with the ICO: ZC226147. Last reviewed August 2026.