1.1 Information You Provide Directly

• Account information: name, work email address, password (stored as a salted hash), company name, job title, and department.
• Billing information: billing contact name, email, and payment details, processed by our third-party payment processor (we do not store full payment card numbers).
• Communications: information you provide when contacting support, submitting a form, or reporting an issue.

1.2 Information We Collect Through AWS Integration

To provide cost and performance monitoring, you authorize CloudSpry to access your AWS account in one of two ways, both of which you configure and control: (a) a cross-account IAM role that CloudSpry assumes through AWS Security Token Service (STS) using a unique External ID, which issues short-lived temporary credentials; or (b) access keys for an IAM user that you create and provide to CloudSpry. Through this authorized access, CloudSpry may collect:

• Billing and cost data from AWS Cost Explorer (e.g., service-level spend and usage, cost forecasts, tags, and cost allocation categories).
• Performance and operational metrics from Amazon CloudWatch (e.g., CPU utilization, network and disk activity, and instance status checks).
• Resource inventory and metadata from Amazon EC2 and the AWS Resource Groups Tagging API (e.g., instance IDs, instance types and states, regions, VPCs, subnets, security groups, and tags). This does not include the content of your applications or end-user data stored within your AWS resources.
• Account activity events from AWS CloudTrail (e.g., when resources were launched, modified, or stopped). These events may include the IAM user or role names and source IP addresses that AWS records for each action.
• Security findings from AWS Security Hub, where you enable CloudSpry's security features.
• Account identity information from AWS STS (your AWS account ID and the ARN of the connected identity), used to verify the connection.

1.3 Read and Write Access

Most CloudSpry features only read data from your AWS account. Certain optional features let authorized users in your CloudSpry account manage Amazon EC2 resources from within the Service, including launching, starting, stopping, rebooting, and terminating instances, changing an instance's type or security groups, and adding tags. These features require write permissions in the IAM policy you grant, and CloudSpry performs these actions only when a user in your account initiates them. If you grant read-only permissions, these management features will be unavailable while cost and performance monitoring continues to work. We recommend granting read-only access (for example, the AWS-managed ReadOnlyAccess or ViewOnlyAccess policies plus Cost Explorer access) unless you intend to use the management features.

1.4 Information Collected Automatically

• Usage data: pages viewed, features used, alert configurations, login timestamps, and interactions with the Service.
• Device and log data: IP address, browser type, operating system, and referring URLs.
• Cookies and similar technologies: used for authentication (session cookies), preferences, and analytics. See Section 6.

We use the information described above to:

• Provide, operate, and maintain the Service, including generating cost and performance alerts and analyses;
• Authenticate users and secure accounts;
• Process payments and manage billing;
• Respond to support requests and communicate service updates;
• Monitor, troubleshoot, and improve the Service's performance and reliability;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations.

We do not use AWS data collected on your behalf to train general-purpose AI/ML models, and we do not sell your data or your AWS account data to third parties.

• Access is granted and revocable by you at any time by removing or modifying the IAM role or policy in your AWS account, deactivating or deleting the IAM access keys you provided, or removing the AWS connection from your CloudSpry account settings.
• We follow the principle of least privilege and request only the permissions necessary to deliver cost and performance features.
• Cost and performance data pulled from your AWS account is stored on our infrastructure (see Section 4) to power historical trends, alerting, and reporting within the Service.
• We do not access the content of your workloads (e.g., application data, databases, files) beyond metrics and metadata necessary for cost/performance analysis.

Data is stored on infrastructure we operate and/or through our infrastructure providers [e.g., IONOS], using industry-standard safeguards including encryption in transit (TLS) and encryption at rest, network segmentation, access controls, and regular security review. Application email (e.g., alert notifications, account emails) is sent via Amazon SES.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but take commercially reasonable measures designed to protect your information from unauthorized access, disclosure, alteration, or destruction.

4.1 AWS Credentials

• If you connect using a cross-account IAM role, we store the role ARN and External ID only. CloudSpry does not hold long-term AWS keys for that connection, and the temporary credentials issued by AWS STS expire automatically.
• If you connect using IAM access keys, we store them encrypted at rest using authenticated symmetric encryption (AES-128 with HMAC-SHA256), with an encryption key kept separate from the database. Keys are decrypted only in memory when calling AWS on your behalf and are never displayed back to you or shared with third parties.
• When you remove the AWS connection from CloudSpry, we delete the stored access keys.
• We never store AWS root account credentials.
• We recommend using a cross-account IAM role where possible. If you use access keys, rotate them regularly (AWS recommends at least every 90 days) and update them in CloudSpry. You can rotate, deactivate, or delete keys at any time in the AWS IAM console.

We do not sell personal information. We may share information with:

• Service providers/subprocessors who perform functions on our behalf (e.g., hosting, email delivery via AWS SES, payment processing, analytics), under confidentiality and data-protection obligations;
• AWS, solely as necessary to retrieve the cost/performance data you have authorized us to access and to carry out resource-management actions initiated by your users;
• Professional advisors (e.g., legal, accounting) as needed;
• Law enforcement or regulators when required by law, subpoena, or valid legal process;
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a comparable one.

We use strictly necessary cookies for login/session management and, where enabled, analytics cookies to understand feature usage. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent you from using the Service.

We retain account information for as long as your account is active and AWS-derived cost/performance data for [INSERT RETENTION PERIOD, e.g., 24 months] to support historical trend analysis, unless a longer period is required by law or you request earlier deletion. Upon account termination, we delete or anonymize personal information within [INSERT PERIOD, e.g., 90 days], except where retention is required for legal, tax, or dispute-resolution purposes.

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at the address in Section 12. We will verify your identity before fulfilling a request.

Residents of certain U.S. states (e.g., California, Texas, Colorado, Virginia) and the EEA/UK may have additional statutory rights under applicable privacy laws; we will honor applicable requests as required by law.

The Service is intended for business use by adults managing AWS infrastructure and is not directed to children under 16. We do not knowingly collect personal information from children through the Service. [If any Mykmo-affiliated products serve K-12 students directly, those products are governed by a separate, FERPA/COPPA-specific privacy policy — this Policy covers CloudSpry only.]

If you access the Service from outside the United States, your information will be transferred to and processed in the United States (and any AWS regions your account uses), which may have different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time. We will post the revised policy with an updated "Last Updated" date and, for material changes, provide additional notice (e.g., email or in-app notification).