Privacy policy

Data controller

[To complete: company name and address], publisher of Cloudheo. For any question about your data: contact@cloudheo.com.

Data we process

Account: organization name, email, password (stored only as an irreversible hash).

AWS connection: read-only role ARN, AWS account ID, chosen region.

AWS data read through the role: costs per service, resource metadata (IDs, types, sizes, regions, tags) and CPU usage. Cloudheo never reads the content of your data (files, databases) and can't change anything.

History: analysis results, the status you give each recommendation, and the fixes later analyses confirmed.

Security log: sensitive actions (sign-in, password change, AWS account connection) and when they happened.

Subscription: customer and subscription IDs at Stripe, subscription status and dates. Cloudheo never sees or stores your payment details.

Cost alerts: the services concerned and when the alert was sent, so the same increase isn't reported twice.

Why, and on what basis

Providing the service and managing the subscription (performance of the contract), securing accounts (legitimate interest), keeping invoices (legal obligation).

Your data is never sold or used for advertising.

Service providers

Hosting: [To complete: host].

Resend: sends emails (email confirmation, password reset, cost alerts).

Stripe: payment of the Pro subscription. Your payment details are entered and kept at Stripe only.

Anthropic: only when you click "Explain", the facts of that recommendation (resource type and ID, costs, technical details) are sent to it to write the explanation.

Resend, Anthropic and Stripe may process data in the United States; these transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses.

Retention

Account and history: for as long as the account exists. An AWS account's analyses, statuses and alerts: deleted as soon as you disconnect it.

Confirmation and reset links: expire after 24 hours and 1 hour.

Invoices: kept by Stripe for the legal retention period of accounting records, including after the account is deleted.

Your rights

You can access, correct, export (CSV export of recommendations) or erase your data. Deleting your account from the settings immediately erases all of your organization's data.

To exercise your other rights (objection, restriction), write to contact@cloudheo.com. You can also lodge a complaint with the CNIL (cnil.fr).

Cookies

Cloudheo uses no advertising or analytics cookies. Your browser only keeps your session, language and display theme, in its local storage.