CloudBudgie Privacy Policy

Last updated: October 10, 2026

YellowCrest Technologies LLC ("YellowCrest," "we," "us," or "our") operates CloudBudgie, a cloud cost optimization service (the "Services"). This Privacy Policy explains how we collect, use, disclose, and retain personal information when you visit cloudbudgie.com, use CloudBudgie, contact us, or otherwise interact with the Services.

CloudBudgie is intended primarily for businesses. Customer-connected cloud environments can contain personal information, including information about people other than the person who created a CloudBudgie account. Depending on the context and applicable law, a customer may determine the purposes for which that information is processed, while YellowCrest processes it to provide the Services under the customer's instructions. This Privacy Policy describes our practices; any applicable customer data processing agreement may provide additional terms.

For privacy questions or requests, contact support@cloudbudgie.com.

1. Information We Collect

Information you provide

Depending on how you use CloudBudgie, we may collect:

• Account and contact information: names, usernames, email addresses, authentication identifiers, and information you provide in support requests or communications.
• Subscription and billing information: selected plans, subscription status, billing addresses, transaction identifiers, invoices, and related payment metadata. Payments are processed using Stripe. We do not intend to receive or store complete payment-card numbers or card security codes in CloudBudgie's application systems when customers use Stripe-hosted payment collection.
• Customer security settings: IP addresses and network ranges that administrators provide to configure access restrictions.
• Connected-account identifiers and settings: cloud provider account identifiers, connected repositories, integration configuration, and authorizations needed to provide the Services.

Authentication may be provided through Amazon Cognito and supported identity providers, including Google Sign-In. Where passkeys or device biometrics are used to unlock an authentication credential, CloudBudgie does not receive fingerprint or facial-recognition templates solely because a passkey is used.

Information from authorized integrations

When a customer authorizes integrations, we may receive information from services such as Amazon Web Services (AWS), Google identity services, GitHub, and Stripe. The information received depends on the integration and permissions granted. We do not purchase personal information from data brokers or collect personal profiles from marketing partners for targeted advertising.

Connected cloud infrastructure information

To identify and facilitate cloud cost optimizations, we may access and process cloud account identifiers, resource IDs and names, configurations, tags, utilization measurements, operational status, and related technical metadata. Some of this information can contain personal information—for example, a person's name or email address in a resource tag, repository metadata, or configuration. Customers should avoid placing unnecessary sensitive personal information or secrets in fields that they make available to the Services.

Information collected automatically

When you use the website or application, we or our service providers may process IP addresses, approximate IP-derived geographic location, browser and device characteristics, operating-system information, referring pages, timestamps, pages visited, feature usage, authentication events, application diagnostics, and request or security metadata.

We may use an IP address to infer the country or other approximate region from which a request originates, including for AWS WAF geographic access controls. CloudBudgie does not require GPS location or device location-services permission for this security filtering.

We use essential cookies or similar mechanisms to maintain sessions, authentication, security, and site functionality. We also use Google Analytics to understand website usage, subject to applicable cookie-consent requirements. See Section 4.

2. How We Use Information

We process information as reasonably necessary to:

• Create and administer accounts, authenticate users, and manage access.
• Connect customer-authorized cloud accounts and other integrations.
• Evaluate infrastructure configurations and utilization; identify optimization opportunities; estimate potential savings; and deliver recommendations.
• Perform customer-authorized optimization operations, scheduling, and associated workflows.
• Generate and validate proposed Infrastructure-as-Code (IaC) changes and create pull requests as described in Section 5.
• Manage subscriptions, billing, support requests, and service communications.
• Detect fraud, enforce account security and geographic or IP-based access restrictions, troubleshoot errors, and maintain service reliability.
• Measure website and product usage and improve the Services.
• Comply with legal obligations, resolve disputes, and protect our rights and users.

Our legal basis for processing, where a legal basis is required, depends on the circumstances and may include performance of a contract, legitimate interests, compliance with legal obligations, or consent. Where we rely on consent, you may withdraw it as permitted by applicable law.

3. When and With Whom We Disclose Information

We may disclose relevant information to providers assisting with the Services, subject to applicable contractual and legal protections. Categories and examples include:

• Cloud hosting and security: AWS infrastructure, authentication, operational monitoring, and security services.
• Payments: Stripe for payment and subscription processing.
• Identity and integrations: Google for supported sign-in functionality, GitHub for authorized repository access and pull-request workflows, and cloud providers for authorized cloud-account operations.
• AI-assisted IaC generation: OpenAI and Anthropic, as further described in Section 5.
• Analytics and consent: Google Analytics for website measurement, and Termly for cookie-consent management, where implemented.

The particular information disclosed varies by functionality. We may also disclose information where required by law or valid legal process, to protect rights and security, or in connection with a merger, acquisition, financing, or transfer of business assets, subject to applicable protections.

We do not sell customer cloud infrastructure data or use it for third-party targeted advertising. Based on our currently described practices, CloudBudgie does not operate targeted-advertising or remarketing programs. Disclosure to a service provider to deliver the Services is not the same as selling information or sharing it for cross-context behavioral advertising, although applicable privacy laws may define and regulate those activities differently.

4. Cookies, Analytics, and Consent

CloudBudgie uses cookies and similar technologies for authentication, session continuity, security, and other necessary functions. We use Google Analytics to measure website traffic and interactions; analytics technology may use cookies or similar identifiers. We do not currently use Google Analytics remarketing, Google advertising features, or advertising pixels for interest-based advertising, based on our current configuration.

We use Termly's cookie consent banner to present choices and manage cookies where required. Visitors can review or change choices using the available cookie settings interface. Our Cookie Notice provides additional information about categories and available controls.

Where applicable, we honor legally required opt-out preference signals, including Global Privacy Control (GPC), through our consent-management implementation. Our handling of these signals is subject to the actual configuration and behavior of the deployed consent tools. We do not treat an ordinary browser "Do Not Track" signal as a separate standardized opt-out request unless required by applicable law.

5. Artificial Intelligence and IaC Generation

CloudBudgie uses third-party artificial intelligence providers, including OpenAI and Anthropic, to assist with generating proposed Infrastructure-as-Code modifications, such as Terraform or CloudFormation diffs and related explanations.

When a customer initiates an IaC-based optimization, CloudBudgie may submit the relevant resource identifiers, configuration context, optimization parameters, and portions of IaC source material needed for that task. Depending on the customer-provided contents, this technical material may incidentally contain personal information. We do not use these AI services to independently discover cloud savings opportunities or choose which customer resources should be optimized.

Generated changes pass through CloudBudgie's validation workflow and are presented as pull requests for customer review. CloudBudgie does not automatically apply AI-generated IaC changes. Processing by AI providers is governed by their applicable service and data-processing terms and the configurations CloudBudgie uses with those providers. Customers should avoid embedding secrets or unnecessary personal information in material made available for IaC-generation workflows.

6. Connected Accounts and Customer Control

Customers choose which supported cloud accounts, source-code repositories, and other integrations they authorize. CloudBudgie uses those permissions to deliver requested functionality and may periodically check access status or synchronize relevant technical information. Customers can revoke permissions through supported CloudBudgie controls or through the relevant provider. Disconnecting an integration may limit the Services and does not necessarily remove information already retained for permitted operational or legal purposes.

Customers may also configure IP-address or network-range restrictions for their accounts. We use this information to enforce customer-selected security rules.

7. Retention and Deletion

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, subject to applicable law and operational needs. In general:

• Active account and infrastructure data: retained as needed to provide the Services while the account or relevant integration remains active.
• Account termination: some data is removed automatically as part of subscription-cancellation or termination workflows. Additional account and connected-infrastructure information can be deleted through support-assisted procedures. Our intended ordinary-data deletion window is within three months after account termination, subject to the exceptions below and actual system lifecycles.
• Security logs and approximate IP-derived location information: identifiable request or geographic security logs, when enabled, are generally intended to be retained for up to 30 days, unless a security investigation, legal obligation, or preservation requirement justifies longer retention. AWS WAF's aggregate metrics are distinct from persistent request logs.
• Billing and legal records: payment, tax, accounting, dispute, and other legally required records may be kept longer than ordinary application data.
• Backups and security preservation: residual copies may remain for a limited period in backups or secured archives until their normal expiration, and information needed for an investigation or legal hold may be retained longer.

If data cannot be immediately deleted, we seek to restrict its processing until deletion is feasible. A customer may request account or personal-data deletion by contacting support@cloudbudgie.com, subject to applicable law and rights of other affected persons.

8. Information Security

We use administrative, technical, and organizational measures designed to protect information, including access controls and cloud security measures appropriate to the Services. No network or storage system is completely secure, and we cannot guarantee that unauthorized access will never occur. Customers are responsible for safeguarding their login credentials, reviewing integration permissions, and configuring available security controls appropriately.

9. Children's Privacy

CloudBudgie is a business service not directed to children under 18. We do not knowingly solicit personal information from children under 18. If we learn that we collected a child's personal information in circumstances that require deletion, we will take appropriate steps consistent with applicable law. Contact support@cloudbudgie.com with concerns.

10. Your Privacy Choices and Rights

Depending on your location and applicable law, you may have rights to request access to personal information, obtain a copy, correct inaccuracies, request deletion, withdraw consent, or object to or restrict certain processing. Some rights are subject to statutory exceptions and verification requirements.

You can update certain account details using CloudBudgie's account settings, where available, or contact support@cloudbudgie.com. A subscription cancellation is not necessarily the same as a complete deletion request. You may also adjust cookie choices using our consent-management controls and disconnect authorized third-party services through CloudBudgie or the provider.

We may request enough information to verify your identity and authority before fulfilling a privacy request. We will respond within applicable legal deadlines.

11. United States State Privacy Disclosures

Residents of states with applicable consumer privacy laws—including, as relevant, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia—may have additional rights. These laws have different applicability thresholds, definitions, and exceptions; not every right applies in every circumstance.

Categories of personal information

The following table summarizes categories that CloudBudgie may collect depending on actual use and integrations. The categories are not a statement that CloudBudgie collects every example listed in a statutory definition.

For active accounts, relevant identifiers, commercial records, and network activity data may be retained as described in Section 7. Approximate location-bearing security request logs, if enabled, generally have an intended 30-day retention period, subject to stated exceptions.

Sources and purposes

Sources include the individual, the individual's organization or account administrator, website interactions, and customer-authorized providers and integrations. The purposes and disclosures are described in Sections 2–6. We do not currently use personal information for third-party targeted advertising, and we do not sell personal information as those terms are commonly used in state privacy laws.

We may disclose relevant information to service providers or contractors for operational and business purposes as described in Section 3. This may include the disclosure of identifiers, commercial information, internet activity, and customer-provided technical data, depending on the particular service. These disclosures are distinct from a sale of information or sharing for targeted advertising.

State-specific rights

Subject to applicable state law, you may have rights to:

• Confirm whether we process your personal information and access that information.
• Correct inaccuracies or request deletion.
• Obtain a portable copy of information you provided, where legally required.
• Opt out of sales, targeted advertising, or certain profiling that produces legal or similarly significant effects, where relevant.
• Learn the categories or, in some states, specific identities of third parties to whom information has been disclosed.
• Limit certain uses of sensitive personal information, where applicable.
• Appeal a decision regarding a privacy-rights request, where an appeal right applies.
• Exercise applicable rights without unlawful discrimination or retaliation.

To submit a request or appeal, email support@cloudbudgie.com and describe the request. An authorized agent may submit a request where permitted by law; we may request evidence of authorization and appropriate identity verification. If an appeal is denied, you may have the right to contact your state attorney general or other regulator.

California "Shine the Light" requests: California residents may request information about disclosures of personal information to third parties for those third parties' direct-marketing purposes, where the statute applies. Send requests to support@cloudbudgie.com.

Global Privacy Control: Where applicable, eligible GPC signals are treated as opt-out preferences for activities covered by relevant laws. Our current practices do not include targeted advertising or sale of personal information; the cookie banner and related configuration control applicable choices.

12. International Visitors

CloudBudgie operates from the United States and uses third-party service providers that may process information in the United States or other countries. Where an applicable law requires safeguards for transfers across borders, we will use an appropriate transfer mechanism. If your organization needs contractual data-processing terms or details regarding international transfers, contact support@cloudbudgie.com.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, data practices, vendors, or applicable law. We will update the "Last updated" date and provide additional notice for material changes where required by law.

14. Contact Us

YellowCrest Technologies LLC
221 Main St, STE R
Nashua, NH 03060
United States
Email: support@cloudbudgie.com

To ask about your personal information or to request access, correction, or deletion, contact the email address above.