Legal
Privacy Policy
How SpendPilot collects, uses, and protects information for customers worldwide.
Last updated: 31 July 2026
Who we are
SpendPilot (“we”, “us”) provides AWS, Azure, and GCP FinOps tooling that helps organisations detect cloud waste, assign owners, approve fixes, and verify savings. This policy explains what personal and account data we process when you use our website, free audit form, or product—wherever you are located.
Information we collect
Account details you provide (name, email, company, role, country, preferred currency). Team invites and membership within your organisation. Free-audit and lead form submissions (including spend range and related notes). Billing profile details for paid plans (legal company name, tax IDs such as GSTIN or VAT where applicable, billing address). Product usage data such as AWS/Azure/GCP account metadata you connect, Cost Explorer / Cost Management / BigQuery billing summaries, waste findings, action status, and verified savings figures. Technical logs needed to operate the service (for example authentication events and error diagnostics).
Cloud credentials and cloud data
If you connect AWS, you may supply IAM access keys, temporary session credentials, or a cross-account role. If you connect Azure, you supply a service principal (tenant ID, application/client ID, and client secret) scoped to a subscription. If you connect GCP, you supply a service account JSON key scoped to a project (and optionally BigQuery billing export access). Secrets are stored encrypted at rest and used only for cost sync, inventory scans, and opt-in approve-then-delete remediations you explicitly enable. See our Security page for access design and least-privilege guidance.
How we use information
To create and secure your account, operate scans and workflows, show savings and billing in your organisation’s currency, issue tax invoices when applicable, improve reliability, respond to support or audit requests, and communicate service-related notices. We do not sell personal information.
Legal bases (where GDPR applies)
Where the EU/UK GDPR applies, we process personal data as needed to perform our contract with you, to pursue legitimate interests in operating and securing the service (balanced against your rights), and where you consent (for example optional marketing). You may object to processing based on legitimate interests where applicable.
India DPDP
Where India’s Digital Personal Data Protection Act applies, we process personal data for the purposes described above as a data fiduciary in connection with providing the service, and honour applicable rights to access, correction, and erasure subject to legal retention needs.
International transfers
We may process and store data in countries other than where you are located, using cloud hosting and subprocessors. Where required, we use appropriate safeguards for cross-border transfers.
Sharing
We share data with subprocessors only as needed to host and run the product (for example database and application hosting). Platform staff may access organisation data when you request support or when required for billing and abuse prevention. We may disclose information if required by applicable law.
Retention
We keep account, scan, action, and billing records while your organisation uses SpendPilot and for a reasonable period afterward for audits, dispute handling, and legal obligations. You may ask your organisation admin to remove team members; organisation admins can request account closure by contacting us.
Security
We use encryption in transit, encrypted storage for AWS secrets, session-based authentication, and organisation-scoped access controls. No method of transmission or storage is perfectly secure; please use strong passwords and prefer IAM roles over long-lived access keys.
Your choices and rights
You can update profile details in the product, manage team access as an org admin, disconnect AWS accounts, and change or cancel plans under Billing. Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, and to lodge a complaint with a supervisory authority. Contact us using the details below to exercise these rights.
Cookies and similar tech
We use cookies and similar technologies necessary for sign-in sessions and basic site operation. We do not use advertising trackers on marketing pages today.
Children
SpendPilot is a business service and is not directed at children.
Changes
We may update this policy as the product evolves. The “Last updated” date at the top of this page will change when we do. Continued use after an update means you accept the revised policy where permitted by law.
Contact
Privacy questions or data requests: use the free audit form with “Privacy request” in the notes, or message your SpendPilot contact. See also our Terms of Service and Security.
This page is informational and does not constitute legal advice.