Privacy Policy

01Information We Collect

When you use FinOpsAI, we collect the following categories of information:

• Account Information: Email address, name, and authentication credentials via Google Firebase Authentication
• Cloud Access Grants: FinOpsAI stores no cloud account keys or secrets. You grant read-only access — an IAM grant to our reader service account on your Google Cloud billing-export dataset, a cross-account IAM role for your AWS export bucket, or a federated credential for your Azure export storage. We store the identifiers of those grants (project, dataset, role ARN, storage account), not credentials
• Billing Data: Google Cloud billing exports are queried in place in your BigQuery dataset. AWS and Azure cost exports are read from your export storage and loaded into FinOpsAI's own BigQuery tables in asia-south1 so they can be analysed; those rows are deleted with your workspace
• Usage Data: Agent analysis requests, action cards created, and Fix Now approvals — stored for audit trail
• Technical Data: IP address, browser type, and access logs for security monitoring

02How We Use Your Information

We use the information we collect exclusively to provide and improve the FinOpsAI service:

• Detecting cloud cost anomalies in your billing data using statistical analysis
• Running AI analysis via Google Vertex AI (Gemini 2.5 Flash, asia-south1) on anonymised cost summaries
• Generating remediation recommendations and action cards
• Keeping an audit log of the actions taken in your workspace (approvals, report issuance, downloads)
• Sending email notifications for anomaly alerts and Fix Now confirmations
• Improving our detection rules from aggregate service-quality measures, never by pooling customers' billing data

We never: sell your data, use your billing data to train AI models shared with other customers or with Google, share your data with third parties for marketing, or move your billing or workspace data outside India.

Sign-in (Firebase Authentication with Google or Microsoft) and email delivery are global Google and Microsoft services; they may process your name and email address outside India.

03Where Your Data Is Stored

• Firestore database: asia-south1 (Mumbai)
• Cloud Run API: asia-south1 (Mumbai)
• BigQuery queries: executed in your project's region
• AI inference: Google Vertex AI (Gemini 2.5 Flash) in asia-south1 (Mumbai) — prompts processed in-region, not stored
• Firebase Hosting: Global CDN for static assets only (no personal data)
• Firebase Authentication and Google / Microsoft sign-in: global services (your name and email address)

04AI and Machine Learning

FinOpsAI uses the following AI services to provide cost intelligence:

• Gemini 2.5 Flash — Brain (Google Vertex AI): Analyses compressed, anonymised cost summaries in asia-south1 (Mumbai). Prompts are processed in-region and not stored. No training on your data.
• Gemini 2.5 Flash — Scout (Google Vertex AI): Filters anomaly noise before deeper analysis by the Brain. Stateless processing — no data retained.
• Anomaly forecasting (ARIMA): A statistical forecasting model (BigQuery ML ARIMA_PLUS) is fitted only to your own daily cost totals per cloud account and service — no names, labels or resource details. It is kept in asia-south1 (Mumbai) in a dataset that belongs to your workspace alone, is used only for your anomaly alerts, and is deleted with your workspace.
• Human-in-the-Loop: No AI system executes remediation actions automatically. All Fix Now actions require explicit human approval.

05Data Security

We implement enterprise-grade security controls to protect your data:

• No customer cloud credentials are stored; access is by IAM grant and federated identity only
• All API secrets stored in GCP Secret Manager — never hardcoded
• Zero-Trust IAM — service accounts with minimal required permissions
• Firebase JWT authentication for all API endpoints
• HTTPS/TLS encryption for all data in transit
• GitHub Actions CI/CD with encrypted secrets
• Complete audit trail of all agent actions and human approvals

06Data Retention

• Billing history: 30, 90 or 365 days, depending on your plan, then deleted
• Action cards: Attested cards are kept 12 months; a card awaiting approval is kept until decided
• Audit log and issued reports: The audit log is kept for the life of your subscription. The stored PDF of an issued report is kept 12 months, or longer where your plan or contract sets a different period; the record that it was issued, with its SHA-256, is kept with the audit log
• After a subscription ends: All workspace data is kept for 30 days so you can reactivate or request an export, then permanently deleted
• Account data: Retained until account deletion request
• Cloud access grant identifiers: Deleted with your workspace at the end of the grace period; you remove the grants themselves from your cloud environment

07Your Rights under the DPDP Act 2023

Under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to Access: Request a summary of the personal data we process about you and how we process it
• Right to Correction: Request correction, completion or updating of your personal data
• Right to Erasure: Request deletion of your personal data
• Right to Grievance: Raise a complaint with our Grievance Officer; if it is not resolved, you may approach the Data Protection Board of India
• Right to Nominate: Nominate a person to exercise rights on your behalf

To exercise any of these rights, email us at privacy@samsofttechnologies.com. We acknowledge within 72 hours and resolve within 30 days.

Personal data breach: if a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires, with what happened, its likely impact and the steps we are taking.

08Third-Party Services

FinOpsAI integrates with the following third-party services:

• Google Firebase: Authentication and Firestore database — Google Privacy Policy applies
• Google Cloud: Cloud Run, BigQuery, Secret Manager — Google Cloud DPA applies
• Google Cloud (Vertex AI): Gemini 2.5 Flash in asia-south1 — Google Cloud Data Processing Addendum applies
• Google Analytics: On our public pages only (home, pricing, contact, sign-in) — page views and general device information, without query strings; never inside the signed-in app. Google may process this data outside India
• Razorpay: Payment processing — card and bank details are entered on Razorpay and never reach FinOpsAI; Razorpay Privacy Policy applies

Google and Microsoft sign-in used to grant access ("Connect everything")

When you choose Connect everything with Google, you sign in with Google and FinOpsAI requests the https://www.googleapis.com/auth/cloud-platform scope. That access is used only in your browser, only after you review the changes, and only to read your current IAM settings and locate your billing-export dataset, then add read-only IAM roles (Compute Viewer, Monitoring Viewer, Kubernetes Engine Cluster Viewer, Recommender Viewer, Storage Bucket Viewer, Cloud Memorystore Redis Viewer, and BigQuery Data Viewer on your billing-export dataset, creating that dataset if it does not exist) for the FinOpsAI service account dedicated to your workspace, and, if you tick it, to switch on an API you choose. It is never sent to or stored on FinOpsAI servers, never used to read your billing data or the contents of your resources, and it is revoked when the step ends. FinOpsAI receives only the result of each change, for your audit log.

When you choose Connect everything with Microsoft, you sign in with Microsoft and FinOpsAI requests the Azure Service Management user_impersonation permission. FinOpsAI uses that sign-in once, server-side, only to add read-only role assignments (Reader, Cost Management Reader and, if you tick it, Reservations Reader) for the FinOpsAI application in your directory, then discards it. It is never stored.

FinOpsAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. No data obtained through these sign-ins is used for advertising, sold, or used to train AI models.

09Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email at least 30 days before the changes take effect. Where a change needs your consent, we will ask for it again.

10Contact Us