Privacy Policy

1. Introduction

SpendGuard ("we," "our," or "us") operates the SpendGuard cloud cost optimization service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

Account Information: When you create an account, we collect your email address for authentication and communication purposes.

Cloud Credentials: We collect AWS access keys that you provide to connect your cloud accounts. These credentials are Fernet-encrypted (AES-256) before storage and are only decrypted at scan time within our isolated worker processes.

Scan Data: We collect metadata about your AWS resources during read-only scans, including resource identifiers, types, regions, and usage metrics. We never access the content or data stored within your resources.

Usage Data: We automatically collect information about how you interact with our service, including pages visited, features used, and timestamps.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our cloud cost optimization service
• Scan your AWS accounts for wasted resources using read-only API calls
• Send you scan results, weekly reports, and finding alerts (based on your notification preferences)
• Send magic link sign-in emails
• Process billing and subscription management
• Respond to your requests and support inquiries

4. Data Security

We take the security of your data seriously. AWS credentials are encrypted at rest using Fernet encryption (AES-256). We use read-only IAM permissions exclusively — our service will never create, modify, or delete any of your AWS resources. All data is transmitted over HTTPS.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information with:

• Service Providers: Third-party services that help us operate our platform (e.g., email delivery via SendGrid, payment processing via Stripe)
• Legal Requirements: When required by law, regulation, or legal process

6. Data Retention

We retain your account data and scan history for as long as your account is active. You can delete your cloud account credentials at any time from the Accounts page. When you delete a cloud account, all associated scan runs and findings are permanently removed.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Opt out of non-essential communications via notification preferences

8. Cookies

We use local storage to maintain your authentication session. We do not use third-party tracking cookies. We collect anonymous, cookie-free usage statistics (page visited, referring site, country derived from IP address, browser and device type) to understand how the site is used. IP addresses are not stored.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at support@getspendguard.io.