Privacy notice.

Your work email, name, and role on the account. The cloud and vendor credentials you connect, held in Azure Key Vault. We never store unencrypted credentials. The business context you give the agent: your company name, and the mappings from cloud resource groups to the parts of your business they belong to. The cost and usage data we read from your cloud invoices through billing APIs while your subscription is active, read-only wherever the vendor issues a read-only credential. Payment metadata, meaning transaction history and subscription status, while your card details stay with Stripe. If you use the contact form, we receive the name, work email, and message you type; Formspree relays it to us by email and we keep it only as long as the conversation needs.

We also record interaction metadata in the app itself: IP address, browser type, timestamps, and session events captured by LogRocket so we can debug what you experienced. This marketing site does not run analytics or trackers.

This marketing site does not respond to Do Not Track signals, because there is nothing for them to switch off here: hellocloudwatch.com sets no tracking cookies and runs no analytics. The product's in-app session replay is listed in the sub-processor table.

Credentials in Azure Key Vault with strict access policies. Application data in Azure Cosmos DB, partitioned per tenant so your records are not co-located with another customer's. Both run in Microsoft Azure, East US region. Data is encrypted in transit (HTTPS) and at rest. Cloud billing APIs are accessed with read-only permissions wherever a vendor issues them; where a vendor issues only a broader key, we still call nothing but its billing endpoints. We never modify your cloud.

We do not sell your data. We share it only with the sub-processors below, each under a data-processing agreement, to operate the service:

The same list, with the same purposes and regions, is rendered on our security page — from the same source, so the two cannot disagree.

Microsoft may retain inputs to Azure OpenAI for up to 30 days for abuse monitoring under standard Azure OpenAI terms. The deployment is not used to train models.

While your subscription is active, we keep your account data and your agent's observation journal so the product can work. Journal entries are retained for 13 months, which is what lets reports compare a month against the same month last year.

When you disconnect a cloud or delete your account, your stored credentials are removed immediately. Your other data (reports, journal entries, and business-context mappings) enters a 30-day window during which it is hidden from your workspace but can still be restored if the deletion was a mistake. After 30 days it is permanently deleted. We then keep a minimal record for a further 60 days to resolve any billing disputes: your tenant ID, the cancellation date, and the plan you were on, with no customer data.

You can ask us to purge your data earlier than the 30-day window at any time.

You can ask us to show you the personal data we hold, correct it, export it, or delete it. Write to support@hellocloudwatch.com. We reply within 7 working days, usually within 1.

We do not use your billing data, business contexts, or queries to train AI models. Your data is used only to answer questions and write reports for your workspace.

• Encryption of data in transit (HTTPS) and at rest.
• Authentication through Firebase; role-based access controls within each workspace.
• Tenant-partitioned data isolation: each customer's records are scoped to their own tenant.
• Cloud credentials stored exclusively in Azure Key Vault, never in our database.
• Read-only API permissions for billing access wherever a vendor issues them, and the narrowest credential on offer where none is read-only.
• We do not store credit card numbers on our servers.

We may update this notice from time to time. Material changes will be posted on this page and, where the change is substantive, communicated to active customers by email.