Costfluent ("we," "us," or "our") operates the Costfluent cloud cost management platform. This privacy policy describes how we collect, use, disclose, and protect personal information when you use our services, website, and applications.
Information we collect
Account information
When you sign up, we collect your email address, your first and last name and a password, which we store only as a hash, and a Cloudflare Turnstile check confirms that a person is signing up. We check a new password against a public list of breached passwords by sending only the first five characters of its SHA-1 hash. If you sign in with an external account instead, we receive the email address, name and account ID that provider confirms. Creating an organization asks for its name. If you confirm that you use Costfluent for business and not as a consumer, which a paid plan requires, it also asks for the country you or your business are established in and, if you have them, the legal name of your company and its VAT ID. An owner accepts the terms of service for it. We record who confirmed and accepted, when, and which versions of the terms and of this notice were shown. Onboarding also asks for the name of your workspace, and an organization may add a billing email address. The billing name, address, VAT ID and payment details are entered on our payment processor's page at checkout; we keep the invoices it issues. Each sign-in session stores the IP address and device it was opened from.
Cloud cost data
For native cloud connections, currently AWS, Azure and Google Cloud, we read billing records, resource metadata and usage metrics. These grants do not allow us to change workloads or read application datasets, logs or payloads.
For Google Cloud, Costfluent reads billing records, resource metadata and usage from the detailed BigQuery billing export you share. Access uses an organization-specific Costfluent service account with BigQuery Data Viewer on that dataset; no customer service-account key is exchanged. Application datasets are outside this access.
When you install the Kubernetes agent, it reads nodes, pods, namespaces and kubelet metrics and sends node, pod and container identities, resource requests and usage, and pod labels (all by default) to Costfluent over HTTPS. Pod annotations and namespace labels are sent only when configured. It does not send images, environment variables, Secrets, ConfigMaps, logs or network traffic. You can limit label and annotation collection and stop reporting by uninstalling the agent and revoking its token.
Usage data and cookies
With your consent, Google Analytics records page views on costfluent.com and on our documentation at docs.costfluent.com, and on costfluent.com also a small set of named actions: sign-up and demo clicks, contact form submissions and lead requests. The page address it receives keeps only campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content); every other query-string value and the fragment are removed, and a referring page on another site is reduced to that site. Events contain no account, tenant, form, or resource values. Google signals and advertising features are switched off. Without consent, Google's script is not loaded and nothing is sent. A first-party cookie stores your choice for both sites.
Purposes and legal bases
We process personal data only for the purposes below, each on the legal basis shown. The retention column summarizes the periods set out under "Data retention". We do not sell personal information.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Your account and the service: signing in, organizations and workspaces, connections, reports, budgets, alerts and savings records | Account data, your role in each organization, your settings and the content you create | Art. 6(1)(b) GDPR, the contract | While the account exists, then as under "Data retention" |
| Signing in with an external account, at your choice | The email address, name and account ID the provider confirms | Art. 6(1)(b) GDPR, the contract | While the account exists |
| Invoices and the tax records we must keep | Subscriptions, invoices with the billing name, address and VAT ID, the usage figures a price was calculated from, payment records | Art. 6(1)(c) GDPR with § 147 AO, a legal obligation | As long as tax and commercial law requires, also after the organization is deleted |
| Keeping the service secure and free of abuse | The Turnstile check at sign-up and on our forms, sign-in sessions with their IP address and device, and application logs that record each request with the user and organization behind it | Art. 6(1)(f) GDPR; our interest is a service that only you can use and that automated abuse cannot reach | Turnstile results are not stored; sessions are deleted when they end, at the latest 30 days after sign-in; application logs at most 30 days |
| The audit log and the record of access to stored cloud credentials | Who did what in an organization and when, with the IP address and browser of the request; each access to stored credentials, with its IP address | Art. 6(1)(f) GDPR; our interest, and your organization's, in showing who changed what and who used its credentials | Audit log 24 months, credential access record 365 days |
| Service email: sign-in and security messages, invitations, report delivery, alerts, and billing and sub-processor notices | Your email address and name, and the content of the message | Art. 6(1)(b) GDPR, the contract | Your address while the account exists |
| Onboarding email after sign-up: the welcome, the reminder and help to connect a first cloud account, and the message when first data arrives | Your email address and name, and how far your organization has got | Art. 6(1)(f) GDPR with § 7(3) UWG; our interest is helping a new account reach its first cost data. You can object at any time through the unsubscribe link in each email, at no cost other than transmission at basic rates | Your choice to unsubscribe is kept while the account exists |
| Product usage: which steps an organization has taken and which features it uses, to improve the product and help new accounts get started | Named product events, such as a report viewed or a budget created, with the organization and user ID, never a name or address | Art. 6(1)(f) GDPR; our interest is a product that serves the people who use it | One year |
| Error tracking in the app and on our servers | The error, the app version and browser, and your user ID; email and IP addresses are masked before an error is recorded | Art. 6(1)(f) GDPR; our interest is finding and fixing faults | 90 days |
| Analytics of costfluent.com and docs.costfluent.com | Page views and named actions, a pseudonymous browser ID in the _ga cookies, and the shortened page address and referrer | Art. 6(1)(a) GDPR with § 25(1) TDDDG, your consent | Event data 14 months; the consent cookie one year; the _ga cookies up to 2 years |
| The contact form | Your name, email address, company if given, and your message | Art. 6(1)(b) GDPR where you ask about a contract; Art. 6(1)(f) GDPR otherwise, our interest in answering you | In our support mailbox until your request is settled, then deleted unless it led to a contract or must be kept as a business letter |
| Support requests you send us from the app | Your name and email address, your organization, what you write and the files you attach, and the error ID and app version if the request includes them | Art. 6(1)(b) GDPR, the contract | Deleted with its files 365 days after the request is resolved; a request waiting on your reply is resolved 14 days after our last message, with a reminder after 7 |
| Support sessions: Costfluent support viewing the app as one member of your organization, read only and for at most an hour each, to answer a support question or find a fault. No owner has to allow a session, and every owner of the organization is emailed about each one | What the app shows that member's role, except exports, share links and support requests, which can include other members' details and, in a session as an owner, billing; the session's record: who at Costfluent opened it, the member, the reason, and when it opened, ended and expires; the audit log entries that name who opened it, the member and the reason. The session's sign-in stores no device or IP address | Art. 6(1)(b) GDPR where the session answers your organization's support request; Art. 6(1)(f) GDPR otherwise, our interest in finding and fixing what goes wrong for you | The session's record until the organization is deleted; its sign-in ends within the hour and is deleted as other sign-in sessions are; its audit log entries as long as the audit log keeps them. If the member deletes their account, their ID stays on the session's record and their name in its audit log entries |
| Business contacts we write to | As described under "Business contacts we write to" | Art. 6(1)(f) GDPR, as that section explains | Twelve months after our last contact |
Data sharing and disclosure
We disclose personal data only where a purpose above needs it: to the providers that host and run the service, deliver its email, protect it at the network edge and check sign-ups for bots, and to the sign-in provider you choose; to our payment processor at checkout; with your consent, to Google Ireland Limited, which provides Google Analytics as our processor under Google's data processing terms; to our mailbox provider for the messages you send us, and for business contacts we write to, to the providers that section names; to professional advisers where necessary; to authorities where legally required; or to a successor in a corporate transaction. Processors receive only the information needed for their role and act under data-processing terms. The providers that process customer data are named, with what they see and where, on our sub-processors page: Sub-processors
Data retention
Account information is retained while the account is active and as needed to provide the service. The amount of cloud cost history available in the product follows the current subscription plan. Sign-in sessions, with the IP address and device they were opened from, end at the latest 30 days after sign-in and are then deleted. Application logs are kept for at most 30 days, product events for one year, and error reports for 90 days. Google Analytics keeps event-level data for 14 months. Contact form messages stay in our support mailbox until the request is settled and are then deleted, unless they led to a contract or must be kept as business letters. An organization's audit log is kept for 24 months, and the record of each access to its stored cloud credentials, which includes the IP address the access came from, for 365 days. When an organization is deleted, its cost data, configuration, uploaded files and audit log are removed from the live service at once; we keep its subscriptions, invoices (including the billing name and address on them), the monthly usage figures its price was calculated from, payment records and data-processing agreement records for as long as tax and accounting law requires. When you delete your user account, your name and contact details are removed and the activity recorded under your account is anonymized. Our backups are encrypted and are kept for at most 365 days; deleted data that remains in them is never restored for your organization and is gone when they expire, so an erasure is complete within 365 days. You may request access, export, or deletion subject to applicable law.
Your rights
Under GDPR and applicable data protection laws, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete personal data.
- Right to erasure: Request deletion of your personal data under certain circumstances. Deletion is completed as described under “Data retention”.
- Right to restriction of processing: Ask us to restrict the processing of your data while its accuracy or our legitimate interest is being checked, when the processing is unlawful but you want the data kept rather than erased, or when you need it kept for a legal claim (Art. 18 GDPR).
- Right to data portability: Receive your data in a structured, commonly used format for transfer to another service: your organization's configuration as JSON and your cost data as a CSV file per workspace.
- Right to object: Object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21(1) GDPR), and without giving reasons to direct marketing, including our onboarding emails, which the unsubscribe link in each one stops at no cost other than transmission at basic rates (Art. 21(2) GDPR).
- Right to withdraw consent: Withdraw a consent you gave at any time, with effect for the future; for analytics through the cookie settings link at the foot of every page, as described under "Cookie policy". Withdrawal does not affect the lawfulness of the processing before it (Art. 7(3) GDPR).
- Right to lodge a complaint: Complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you believe your rights were infringed (Art. 77 GDPR). The authority for our seat in Frankfurt am Main is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), datenschutz.hessen.de.
Whether you must provide data
Your account data is needed to conclude and run the contract; without it we cannot open an account for you. The billing details on invoices are required by tax law. Nothing else is required: analytics consent, support requests and the contact form are your choice, and unsubscribing from onboarding emails does not affect the service.
Automated decisions
We make no decision based solely on automated processing, including profiling, that has legal effects on you or similarly significantly affects you (Art. 22 GDPR). The product does move an organization's subscription to the plan whose spend band covers its tracked cloud spend, as our terms describe; that decision concerns the organization's subscription, not a person.
Business contacts we write to
This section applies if we have emailed you about your company although you have not been in contact with us before. It explains where we found your details and what we do with them.
- Controller: Costfluent, as introduced at the top of this policy. You can reach us by replying to our email or through our contact page: Contact
- Purpose: To contact you about a conversation on cloud costs for your company.
- Legal basis: Our legitimate interest in telling companies about a service that can help them manage their cloud costs (Art. 6(1)(f) GDPR).
- Sources: Your company's own public pages, such as its imprint, team and blog pages, and your public posts and talks. Where those pages do not show your address, we derive it from the format of the addresses your company publishes.
- Categories of data: Your name, role and business email address, your company, the page we found you on, and the dates and content of the messages between us.
- Recipients: Zoho, our mailbox provider, stores these messages in its EU data centre. Anthropic, the AI provider we use, helps us research companies and draft messages.
- Retention: We delete these details twelve months after our last contact with you. If you object, we stop at once and keep only your email address on a suppression list, so that we never write to it again.
- Right to object and opting out: You can object at any time without giving a reason: reply "stop" or write to the address our email came from. Your other rights under "Your rights" apply as well.
Cookie policy
We use essential cookies for authentication and security. A first-party cookie named costfluent_consent stores only whether you granted or denied analytics, for one year. A first-party cookie named cf_language stores only the language you chose for the console, English or German, for one year. With your consent, Google Analytics sets two first-party cookies whose names start with _ga, each for up to 2 years, to recognise a returning browser and keep session state; withdrawing consent removes them. You can change your choice at any time through the cookie settings link at the foot of every page or in your browser settings.
Security measures
We protect your data with encryption in transit, encrypted storage of connection credentials and backups, least-privilege read-only access to your cloud accounts, per-tenant isolation of stored cost data, and logging of access to it. We do not hold SOC 2 or ISO 27001 certification. No method of transmission over the internet is completely secure; we notify affected customers of any data breach as required by law.
International data transfers
We process personal data in the European Union where we can. Where a provider processes it outside the EU or EEA, as our sub-processors page shows for each provider, the transfer rests on an adequacy decision of the European Commission, for the United States the EU-US Data Privacy Framework for certified recipients, or on the standard contractual clauses of the European Commission; contact us for a copy of the safeguard that applies. Google Analytics data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework and its UK Extension. The list of providers that process customer data, with what they see and where they process it, is published on our sub-processors page: Sub-processors
Children's privacy
Our services are designed for business use and are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will take steps to delete such information.
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The "Last updated" date at the top of this policy indicates when it was last revised.
Contact us
If you have questions about this privacy policy, want to exercise your data rights, or have concerns about how we handle data, contact us.