CostGlass Privacy Policy

1. Who we are

CostGlass is operated by HAMS Technology Ltd, a company registered in England & Wales (company no. 10165409), VAT registered, with its registered office in Romford, United Kingdom. We are the data controller for personal data processed about our website visitors and the authorised users of a customer account. For personal data contained in the cloud billing and resource metadata a customer connects to CostGlass, we act as a data processor on that customer's behalf.

Questions or requests: [email protected].

2. Data we collect

2.1 Account & contact data

• Name, work email address, organisation name and job role.
• Authentication identifiers from AWS Cognito, and — if you sign in with Google — your Google account email and name.
• Team membership and role (owner, admin, member) within your organisation.

2.2 Cloud cost & infrastructure data

When you connect a cloud account (AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, DigitalOcean, Linode or Cloudflare), a Kubernetes cluster, or an LLM/SaaS vendor (such as OpenAI, Anthropic, Snowflake or Datadog), CostGlass ingests cost and usage records, resource inventory and tags, commitment (Reserved Instance / Savings Plan / CUD) data, and utilisation metrics through a read-only cross-account role or federated identity. This data is largely non-personal, but resource names and tags you have set may contain identifiers. CostGlass never stores your cloud credentials in plaintext — they are held encrypted in hardware-backed secret vaults and used only at runtime.

2.3 Billing data

Subscription payments are processed by Stripe. We store your Stripe customer and subscription identifiers, plan tier and subscription status; we do not store full card numbers.

2.4 Usage & technical data

• Product telemetry — pages viewed, features used, actions taken (for example acknowledging an anomaly).
• Log data — IP address, browser type, timestamps and request metadata, retained for security and debugging.

3. Why we process your data (lawful bases)

• Contract — to create and operate your account, deliver the dashboards, anomaly detection, savings recommendations and DevOps portal, and to take payment.
• Legitimate interests — to secure the service, prevent abuse, improve the product, and communicate about material changes. We balance these against your rights.
• Consent — for optional marketing email, which you can withdraw at any time.
• Legal obligation — to keep accounting records and respond to lawful requests.

4. Sub-processors and sharing

We do not sell personal data. We share it only with service providers who process it on our instructions:

• Amazon Web Services — cloud hosting, database, authentication (Cognito) and email (SES) in your selected data residency region.
• Stripe — payment processing and invoicing.
• Google — only if you choose “Sign in with Google”, for federated authentication.

We may also disclose data where required by law, to enforce our agreements, or in connection with a merger or acquisition (with notice to you). A current list of sub-processors is available on request.

5. International transfers

CostGlass is currently hosted in two Amazon Web Services regions: London (eu-west-2) for the United Kingdom and N. Virginia (us-east-1) for the United States. You choose which region holds your organisation's data, and more regions are coming. Where a provider processes data outside the UK or EEA, we rely on adequacy decisions or the UK International Data Transfer Addendum / EU Standard Contractual Clauses.

6. Retention

• Account and team data — for the life of your subscription and up to 90 days after termination.
• Cloud cost history — retained while your account is active to power 13-month baselines; deleted within 90 days of account closure.
• Billing records — retained for 7 years to meet UK accounting requirements.
• Logs — typically 14–30 days.

7. Your rights

Under the UK/EU GDPR you may request access to, correction of, deletion of, or a portable copy of your personal data; object to or restrict certain processing; and withdraw consent. To exercise these rights email [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

If CostGlass processes data as a processor for your organisation, please direct individual rights requests to that organisation.

8. Cookies

The application uses only strictly necessary browser storage — a session token and lightweight UI preferences (such as the last dashboard tab). We do not use third-party advertising or cross-site tracking cookies.

9. Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access to client clouds is read-only by default, with a single opt-in exception (the Instance Scheduler). Secrets are encrypted, database access is network-restricted, and every API request is authenticated and scoped to a single organisation. See the Security page for detail.

10. Changes to this policy

We will post any material change here and update the effective date. Where the change significantly affects you, we will notify account owners by email.

11. Contact

HAMS Technology Ltd, Romford, United Kingdom — [email protected].