1. What We Collect
We collect:
- Account data - email address, hashed password, and account creation time.
- AWS cost and resource data - spend totals, resource inventories, CloudTrail event summaries, and Cost Explorer breakdowns retrieved from your AWS account on your behalf.
- Usage data - which features you use, scan run times, and AI copilot query counts. No prompt content is retained beyond the current session.
- Connection metadata - IAM role ARN, AWS account ID, and enabled regions.
2. How We Use Your Data
We use your data to:
- Provide, operate, and improve the paredown service
- Detect waste, generate findings, and forecast cost impact
- Send you alerts you have configured (email, Slack, webhook)
- Enforce subscription limits and prevent abuse
- Respond to support requests
We do not sell your data. We do not use your AWS data to train AI models accessible to other customers.
3. Data Retention
Account data is retained until you delete your account. AWS cost and resource data is kept for up to 12 months to power trend analysis. Live event records older than 30 days are automatically purged. You can delete your account at any time from Settings - this permanently removes all associated data within 30 days.
4. Data Sharing
We share data only with:
- Infrastructure providers - Neon (database), Vercel (compute), AWS SES (transactional email). Each is subject to their own DPA.
- Stripe - for payment processing. We share only what is necessary for billing.
- Law enforcement - only when required by valid legal process.
5. Security
All data is encrypted in transit (TLS 1.2+) and at rest. AWS credentials are stored encrypted with AES-256. API tokens are stored as bcrypt hashes - we cannot recover a token once issued. We conduct regular dependency audits and use Sentry for error monitoring (stack traces only, no PII).
6. Your Rights
You may request a copy of your data, correction of inaccurate records, or deletion of your account at any time. Email [email protected] and we will respond within 30 days. EU and UK residents have additional rights under GDPR and UK GDPR including data portability and the right to object to processing.
7. Cookies
We set one first-party session cookie (cce_session) for authentication. We do not use third-party analytics cookies or advertising trackers.
8. Children
paredown is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it promptly.
9. Changes to This Policy
We will notify you by email of material changes at least 14 days in advance. The effective date at the top of this page reflects the current version.
10. Contact
Privacy questions: [email protected]