Privacy Policy

1. Data we collect

• Account data: email, display name, Argon2id password hash (never plain-text passwords).
• Organization and role membership for tenant isolation.
• BYOC credential metadata: KMS key reference, encrypted blobs, token fingerprints, granted scopes. Raw provider tokens are sealed at submission and never logged.
• Operational telemetry: request logs with IP-derived HMAC hashes (not raw IPs) for affiliate click attribution and abuse prevention.

2. How we use data

We use data to operate the comparison service, attribute affiliate conversions, execute only your explicitly approved cloud operations, enforce budgets and safety gates, and prevent fraud. We do not sell personal data and we do not use your infrastructure data for advertising.

3. Data sharing

Data is shared only with infrastructure subprocessors required to run the service (hosting, database, email delivery) and with affiliate networks in the form of pseudonymous click identifiers (SubID/ClickID) when you click an outbound deal link. No account credentials are ever shared.

4. Security

Passwords use Argon2id; sessions are short-lived signed tokens; BYOC secrets use KMS envelope encryption with per-connection authentication context; tenant data is isolated per organization and enforced at the database layer. Security incidents follow the published incident runbook.

5. Retention and deletion

Account data is retained while your account is active. Disconnecting a cloud account immediately revokes and wipes its stored credential blobs. You may request full account and data deletion at privacy@cloudscanr.com; audit logs required for financial compliance are retained in anonymized form where the law requires.

6. Your rights

Depending on your jurisdiction (including GDPR and Korean PIPA rights), you may request access, correction, export, or deletion of your personal data. Contact privacy@cloudscanr.com and we will respond within 30 days.