Privacy Policy

Personal Information

When you use CloudInSpot, request a demonstration, create an account, purchase or subscribe to the Service, contact us, or otherwise communicate with us, we may collect personal information that you voluntarily provide. This may include:

• Name
• Email address
• Phone number
• Company or organization name
• Job title or professional role
• Account and login information, where applicable
• Contact details
• Billing and payment information, where applicable
• Information contained in customer communications and support requests
• Any other information you choose to provide

Usage and Technical Data

We may automatically collect information about how CloudInSpot is accessed and used. This may include:

• IP address
• Browser and device information
• Operating system
• Login and authentication activity
• Application activity and feature usage
• Error and diagnostic information
• Usage statistics
• Security and access logs
• Date, duration, status, and other technical information relating to an analysis run
• Any other information you choose to provide

We may collect this information through cookies, log files, analytics tools, and similar technologies. Such information may be used for security, reliability, analytics, troubleshooting, and service improvement.

AWS Billing Data

CloudInSpot processes AWS billing information that you voluntarily upload for analysis. Depending on the document, this may include AWS service names, usage quantities and units, rates, account identifiers, billing period information, region information, resource or usage descriptions, charges, invoice or billing references, and other information contained in the uploaded AWS billing document.

The information processed depends on the billing data you choose to upload. CloudInSpot does not require access to your AWS account, AWS credentials, IAM roles, AWS APIs, or infrastructure.

Information Submitted on Behalf of Others

If you use CloudInSpot as an MSP, technology agency, consultant, or other service provider and upload billing data belonging to a client or another organization, you represent that you have the authority to provide that information to CloudInSpot for processing. You remain responsible for ensuring that your use of CloudInSpot complies with your agreements with those clients or organizations.

We use information collected through CloudInSpot for purposes including:

• Providing and operating CloudInSpot and its features
• Creating and administering accounts, where applicable
• Processing uploaded AWS billing documents
• Extracting and structuring billing information required for analysis
• Identifying potential cost-optimization opportunities
• Calculating and estimating potential savings based on available billing data
• Generating evidence-backed assessments, recommendations, and reports
• Checking analytical findings and quoted figures against source billing information
• Providing customer support and responding to inquiries
• Monitoring and improving performance, reliability, security, and usability
• Detecting and preventing security incidents, fraud, abuse, or unauthorized access
• Managing subscriptions, billing, and payments, where applicable
• Communicating service-related information and permitted promotional communications
• Complying with applicable legal and regulatory requirements

CloudInSpot does not use customer billing data to make changes to AWS infrastructure.

CloudInSpot is designed to operate without connecting to a customer’s AWS account. The Service does not require AWS access keys, IAM roles, AWS API access, cross-account permissions, agents installed in your AWS environment, or direct access to AWS infrastructure.

CloudInSpot analyzes the billing information you choose to upload. It does not modify AWS resources, configurations, permissions, infrastructure, account settings, or workloads.

Because CloudInSpot does not require AWS account access for its core functionality, customers retain control over what billing information is submitted for analysis.

For purposes of this Privacy Policy, “Customer Billing Data” means AWS billing information, documents, extracted billing information, and related content that a customer or its authorized users make available to CloudInSpot.

Customers retain ownership of their Customer Billing Data. Scalex does not acquire ownership of Customer Billing Data as a result of providing CloudInSpot.

We process Customer Billing Data only as necessary to provide CloudInSpot, perform requested analyses, generate assessments and recommendations, verify analytical findings, maintain security and reliability, provide support, comply with applicable law, or otherwise as authorized by the customer.

Customers are responsible for ensuring that information uploaded to CloudInSpot is appropriate for processing and that they have all necessary rights and permissions to provide such information.

CloudInSpot uses artificial intelligence and machine-learning technologies to assist with billing data extraction, analysis, identification of potential optimization opportunities, savings estimation, verification, and report generation.

Minimization of Information Provided to AI Systems

We are designed to minimize the amount of identifying customer information provided to AI systems. AI processing is intended to use only the information necessary for the requested analysis.

Redaction Before AI Processing

Where applicable, identifying information contained in uploaded billing data is detected and replaced with placeholders before the billing data is submitted for AI analysis. This may include account identifiers, invoice identifiers, or other identifying references detected during processing.

Third-Party AI Providers

Where third-party AI or machine-learning providers are used to provide CloudInSpot functionality, such providers may process limited information on our behalf. We seek to use providers subject to appropriate contractual, confidentiality, security, and data-processing requirements.

No Training of General-Purpose AI Models

Unless expressly agreed with a customer in writing, Scalex does not use Customer Billing Data to train general-purpose artificial intelligence models.

Customer Billing Data is processed to provide CloudInSpot functionality, including billing analysis, opportunity identification, savings estimation, verification, and report generation.

CloudInSpot may identify potentially inefficient or unnecessary spend, cost trends, unusual spending patterns, potential savings or commitment opportunities, areas requiring further investigation, estimated savings ranges, confidence indicators, effort considerations, risks, and recommended next steps.

CloudInSpot is designed to validate quoted figures against the source billing data before they appear in a report. Where the system cannot sufficiently substantiate a figure from the available source data, the finding may be excluded or the report may identify the limitation.

Savings estimates are analytical estimates based on the rates, usage, and other information available in the uploaded billing data. They are not a guarantee of actual savings.

Actual AWS costs and savings may depend on factors not represented in the billing data, including infrastructure configuration, workload behaviour, contractual arrangements, usage commitments, technical dependencies, operational requirements, pricing changes, and actions taken after the analysis.

Customers remain responsible for reviewing, validating, and deciding whether to implement any recommendation before taking action.

CloudInSpot is designed around a billing-data-only model. Its core analysis does not require direct access to a customer’s AWS environment.

We seek to minimize information processed by:

• Processing information required for the requested analysis
• Removing or replacing identifying information before AI analysis where applicable
• Avoiding unnecessary AWS account or infrastructure access
• Restricting access to authorized personnel and systems
• Using information only for stated business, service, security, legal, or customer-authorized purposes
• Deleting uploaded billing data in accordance with applicable retention and deletion procedures

These measures are designed to reduce unnecessary exposure of customer information but do not constitute a guarantee that information can never be disclosed or accessed contrary to this Policy.

We may use personal information to respond to inquiries, provide customer support, provide information about CloudInSpot, communicate about an account or subscription, send service-related notifications, communicate regarding billing or payments, and send promotional communications where permitted by applicable law.

You may opt out of promotional communications by following the instructions provided in those communications. We may continue to send non-promotional communications necessary to provide the Service, administer an account, address security matters, or comply with legal obligations.

We may use aggregated, anonymized, or de-identified information to understand how CloudInSpot is used, monitor system performance, identify trends, improve our products and services, develop features, conduct internal research, and identify reliability or security issues.

We do not use Customer Billing Data to publicly identify customers or disclose confidential customer information.

Where aggregated or de-identified information is used, we take reasonable steps designed to prevent the information from being used to identify a particular customer or individual.

We do not sell Customer Billing Data or personal information.

Service Providers

We may share limited information with trusted third-party service providers who assist us in operating, maintaining, securing, and improving CloudInSpot. These may include providers of:

• Cloud hosting and infrastructure
• Authentication and account management
• Monitoring and logging
• Analytics
• Customer support and communications
• Payment processing
• Document or file processing
• AI or machine-learning processing
• Security and fraud prevention

Such providers are expected to process information only for the purposes for which we engage them and to maintain appropriate confidentiality and security measures.

Business Transfers

In the event of a merger, acquisition, restructuring, financing, sale of assets, or similar business transaction, information may be transferred as part of that transaction. Where required by applicable law, we will provide appropriate notice regarding such transfer.

Legal Requirements

We may disclose information where required by applicable law, regulation, court order, legal process, or valid request from a government or public authority. We may also disclose information where reasonably necessary to protect our rights, property, security, users, customers, or others, or to investigate fraud, security issues, or misuse of the Service.

We implement reasonable technical and organizational measures designed to safeguard personal information and Customer Billing Data against unauthorized access, disclosure, alteration, loss, or destruction.

Depending on the CloudInSpot environment and configuration, these measures may include:

• Access controls
• Authentication and authorization controls
• Encryption in transit
• Encryption at rest where applicable
• Least-privilege access
• Credential protection
• Logging and monitoring
• Backup and recovery controls
• Security incident procedures
• Secure software development practices
• Data minimization and redaction controls

Access to Customer Billing Data is limited to authorized personnel and systems based on business and operational requirements.

However, no method of transmission, processing, or electronic storage can guarantee absolute security. Customers are responsible for protecting their account credentials and for ensuring that information submitted to CloudInSpot is appropriate for the Service.

Depending on applicable law, you may have rights relating to your personal information, including the right to:

• Access personal information we hold about you
• Request correction of inaccurate information
• Request deletion of personal information where applicable
• Withdraw consent where consent is the applicable basis for processing
• Request information regarding our processing of personal information
• Object to certain processing
• Request restriction of processing where applicable
• Request data portability where applicable
• Raise a privacy-related complaint or grievance

You may exercise applicable rights by contacting us using the information provided below. We may need to verify your identity before completing a request.

Where CloudInSpot processes personal information on behalf of a customer or organization, the relevant customer or organization may be responsible for determining the purposes and means of processing and for responding to applicable data-subject requests.

If you are a California resident and the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), or other applicable California privacy law applies to our processing of your personal information, you may have specific rights regarding that information.

Categories of Personal Information

Depending on how you interact with CloudInSpot, the categories of personal information we may collect or process include:

• Identifiers: name, email address, telephone number, IP address, account identifiers, and similar identifiers.
• Personal information described in California Civil Code §1798.80: contact information and other information associated with an individual, where applicable.
• Commercial information: subscription information, purchase history, transaction information, billing information, or details of products or services purchased.
• Internet or electronic network activity: login activity, browser and device information, interactions with CloudInSpot, pages or features accessed, and similar usage information.
• Professional or employment-related information: company name, job title, business email address, and other professional information provided by users.
• Geolocation information: where collected, approximate location that may be derived from an IP address or similar technical information. CloudInSpot does not require precise geolocation for normal use.
• Inferences: limited inferences that may be generated from account, usage, or Service information for purposes such as understanding Service usage, improving functionality, or providing relevant Service features.
• Sensitive personal information: CloudInSpot does not intentionally request sensitive personal information for ordinary use of the Service. Such information could nevertheless be contained in information voluntarily submitted by a customer or user.

Sources of Personal Information

We may collect personal information from:

• You directly
• Your organization or employer
• Your use of CloudInSpot
• Service providers supporting our website or application
• Third-party service providers
• Publicly available sources, where applicable

Business or Commercial Purposes

We may collect and use personal information for purposes including:

• Providing and operating CloudInSpot
• Account administration and authentication
• Processing billing documents and providing cost analysis
• Customer support
• Service improvement and analytics
• Security, fraud prevention, and abuse detection
• Billing and payment processing
• Communications
• Legal and regulatory compliance

Categories of Personal Information Disclosed

We may disclose applicable categories of personal information to service providers and contractors supporting our business and CloudInSpot, including providers of cloud infrastructure, hosting, authentication, analytics, customer support, communications, payment processing, security and monitoring, document processing, and AI or machine-learning services.

We do not sell personal information for monetary consideration.

California Privacy Rights

Subject to applicable law and applicable exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected
• Know the categories of sources from which personal information is collected
• Know the business or commercial purposes for collecting or disclosing personal information
• Know the categories of third parties to whom personal information is disclosed
• Request deletion of personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of personal information, where applicable
• Limit certain uses and disclosures of sensitive personal information, where applicable
• Not receive discriminatory treatment for exercising applicable privacy rights

We do not sell personal information for monetary consideration. If our practices change in a manner that constitutes “sale” or “sharing” under applicable California law, we will provide the notices and opt-out mechanisms required by law.

How to Exercise California Privacy Rights

California residents may submit applicable privacy requests by contacting us using the contact information at the end of this Policy. We may need to verify your identity before completing a request.

Where CloudInSpot processes personal information on behalf of a customer or organization, the relevant customer may be responsible for responding to the request. We will respond to verified requests within the time periods required by applicable law.

If you are located in the European Economic Area (“EEA”) or another jurisdiction where the General Data Protection Regulation (“GDPR”) applies, personal information processed through CloudInSpot may constitute “Personal Data” under the GDPR.

Controller and Processor Roles

Depending on the circumstances, Scalex may process personal data as a controller or as a processor on behalf of a customer.

Where Scalex processes personal data on behalf of a customer, the customer may determine the purposes and means of processing. The applicable data-processing terms may be governed by a separate agreement or Data Processing Agreement (“DPA”), where required.

Lawful Bases for Processing

Depending on the circumstances and applicable law, we may process personal data on the basis of one or more lawful grounds, including performance of a contract, compliance with a legal obligation, legitimate interests, or consent where consent is required or relied upon.

Where we rely on legitimate interests, those interests may include providing and securing CloudInSpot, preventing fraud or abuse, improving Service reliability, responding to inquiries, and managing our business, provided that such interests are not overridden by applicable individual rights.

Data Subject Rights

Depending on applicable law, individuals may have rights including:

• The right to be informed about processing
• The right to access personal data
• The right to request correction
• The right to request deletion
• The right to restrict processing
• The right to object to certain processing
• The right to data portability
• The right to withdraw consent where consent is the applicable legal basis
• The right to lodge a complaint with an applicable supervisory authority

These rights are subject to applicable legal conditions and exceptions.

International Transfers

Where personal information is transferred outside the EEA or another protected jurisdiction, we will use appropriate safeguards as required by applicable law. Depending on the circumstances, these may include adequacy decisions, standard contractual clauses, contractual safeguards, or other legally recognized transfer mechanisms.

Data Processing Requests

Where Scalex processes personal data on behalf of a customer, requests relating to that processing may need to be directed to the relevant customer as the data controller. We will provide reasonable assistance where required under applicable law and contractual arrangements.

CloudInSpot may store and process information using cloud infrastructure and service providers located in India or other jurisdictions, depending on the Service configuration and infrastructure used.

Where information is transferred across jurisdictions, we will take reasonable steps to comply with applicable data-protection requirements.

Specific data-residency commitments, where applicable, may be provided under a customer’s commercial agreement or Data Processing Agreement.

We retain information for as long as reasonably necessary to provide CloudInSpot and fulfill the purposes described in this Privacy Policy.

For uploaded AWS billing data, CloudInSpot is designed to retain the data only for the period necessary to perform the requested analysis and provide the associated Service.

Uploaded billing data is intended to be deleted when the analysis run is completed, subject to technical processing requirements, applicable law, and legitimate security or operational requirements.

The retention period may depend on the type of information, customer configuration, contractual requirements, security requirements, legal obligations, and the technical architecture used for the Service.

We may retain limited information where necessary to comply with legal obligations, resolve disputes, enforce agreements, prevent fraud or abuse, maintain security, or maintain legitimate business records.

We maintain procedures for removing Customer Billing Data and personal information when the applicable retention period expires or when deletion is otherwise required.

Where technically and legally appropriate, information may be removed from active systems and subsequently from backups in accordance with our backup and data-removal procedures.

Certain information may be retained where required by law or reasonably necessary for legitimate security, legal, fraud-prevention, or business purposes.

We use appropriate technical and organizational safeguards for information stored or processed by CloudInSpot.

Customer Billing Data and personal information may, depending on the Service configuration, be processed or stored in databases, application infrastructure, logs, backups, and other systems necessary to operate, secure, and support the Service.

Where applicable, information is encrypted in transit and at rest using industry-standard security practices.

Access to Customer Billing Data is restricted to authorized personnel and systems based on business and operational requirements.

If you wish to request deletion of personal information or other information associated with your CloudInSpot account or use of the Service, you may contact us using the contact information below.

We will review and verify the request and process it in accordance with applicable law, contractual obligations, and our retention and deletion procedures.

Where CloudInSpot processes Customer Billing Data or personal information on behalf of an organization, the organization may be responsible for submitting or managing the deletion request.

Deletion may be subject to legal, security, dispute-resolution, or other legitimate retention requirements.

CloudInSpot or the Scalex website may contain links to third-party websites, applications, or services that are not operated or controlled by us.

This Privacy Policy does not apply to third-party websites or services. Third-party services may collect, use, or disclose information under their own terms and privacy policies.

We encourage you to review the privacy policies of third parties before providing personal information or using their services.

CloudInSpot is intended for business and professional use and is not directed toward, or intended for use by, children.

We do not knowingly collect, maintain, or process personal information from individuals under the applicable legal age of consent or age of majority in their jurisdiction.

If you become aware that an individual under the applicable legal age has provided us with personal information without appropriate parental or legal guardian consent, please contact us immediately. We will take reasonable steps to verify, restrict, and delete such information where required by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, technology, or applicable laws and regulations.

We will post the updated Privacy Policy on the applicable CloudInSpot website and update the “Effective Date” shown at the beginning of this Policy.

Where required by applicable law, we will provide additional notice of material changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Thank you for taking the time to read our Privacy Policy.