Skip to main content

Privacy Policy

Effective Date: April 2026 Last Updated: August 2026

DragonFractal ("Company", "we", "us", "our") operates Cloud Cost Analyzer ("CCA", "Service"). This Privacy Policy describes how we collect, use, store, and protect your information.

1. Information We Collect​

1.1 Account Information​

When you register, we collect:

  • Email address
  • Name (optional)
  • Organization name
  • Hashed password (Argon2 — we never store plaintext passwords)

If you sign in with Google or GitHub instead of a password, we receive a minimal profile from that provider (your email, including your verified email from GitHub; your name and avatar; and a stable account identifier), used only to create or match your account. We request only the sign-in scopes (Google openid email profile, GitHub read:user user:email) and never request access to your repositories, organizations, or other provider data. Social sign-in is optional.

1.2 Billing Information​

Payment processing is handled entirely by Stripe. We do not store credit card numbers, expiration dates, or CVCs. We receive from Stripe:

  • Stripe customer ID and subscription ID
  • Plan tier and billing cycle
  • Payment status and invoice history

1.3 Scan Data (Transient)​

When you run a scan, the CLI transmits cloud resource metadata to our backend for analysis. This data includes:

  • Resource identifiers (instance IDs, volume IDs, etc.)
  • Resource configuration (instance types, storage sizes, etc.)
  • Utilization metrics (CPU, memory, network, connections)
  • Cost records (monthly spend per service)

This data is processed in memory and immediately discarded. It is never written to disk or stored in our database. Only the resulting optimization findings and aggregate statistics are persisted.

1.4 Usage Data​

We collect basic usage metrics through structured application logs:

  • Scan counts and timestamps
  • Subscription tier at time of scan
  • Login events
  • API key creation events
  • Feature usage (which commands are run)

We do not use third-party analytics, tracking pixels, or cookies beyond what is necessary for authentication.

1.5 Technical Data​

Our infrastructure automatically collects:

  • IP addresses (in ALB access logs, retained 30 days)
  • User agent strings
  • Request timestamps and response codes

2. How We Use Your Information​

We use collected information to:

  • Provide the Service — Analyze your cloud resources and generate optimization findings
  • Manage your account — Authentication, authorization, subscription management
  • Process payments — Via Stripe for paid subscriptions
  • Improve the Service — Aggregate, anonymized usage metrics help us prioritize features
  • Communicate with you — Account notifications, service announcements, security alerts
  • Ensure security — Detect and prevent abuse, unauthorized access, or fraud

We do not:

  • Sell your personal information to third parties
  • Use your scan data for advertising
  • Share your data with other customers
  • Use your data to train machine learning models
  • Profile individual user behavior for marketing purposes

3. Data Storage and Security​

3.1 Infrastructure​

Your data is stored on AWS infrastructure in the US East (N. Virginia) region:

  • Database: PostgreSQL 16 on RDS (encrypted at rest with AES-256, encrypted in transit with TLS)
  • Secrets: API keys stored as SHA-256 hashes; database credentials, JWT secrets, and Stripe keys in AWS Secrets Manager
  • Network: Database in private subnets, not accessible from the public internet
  • TLS: All data in transit encrypted via TLS 1.2+ (CloudFront → ALB → ECS)

3.2 Access Controls​

  • Production database access is restricted to the ECS service via security groups
  • No employee has direct access to the production database in normal operations
  • API keys are hashed before storage — we cannot retrieve your original key
  • Passwords are hashed with Argon2 (industry-standard, resistant to brute force)

3.3 Data Retention​

See our Data Retention Policy for complete retention schedules. Key points:

  • Raw cloud data: never stored
  • Scan findings: 90 days (Community), 1 year (Professional), 2 years (Enterprise)
  • Account data: life of account, deleted within 30 days of account deletion
  • Billing records: 7 years (legal requirement)

4. Data Sharing​

We share your information only in these limited circumstances:

RecipientWhatWhy
StripeEmail, subscription dataPayment processing
AWSInfrastructure logs (IPs, request metadata)Hosting and infrastructure
Law enforcementAccount data, if legally compelledLegal obligation

We do not sell, rent, or trade your personal information.

5. Your Rights​

5.1 Access and Portability​

You can access your data at any time through:

  • Dashboard: View scans, findings, account settings
  • API: Export scan data via /api/v1/scans/:id/export/json
  • Request: Email privacy@dragonfractal.com for a full data export

5.2 Deletion​

You can delete your account through the dashboard settings. Upon deletion:

  • Account data is purged within 30 days
  • API keys are invalidated immediately
  • Scan history is deleted within 30 days
  • Billing records are retained for 7 years (legal requirement)

5.3 Correction​

You can update your name, email, and organization through the dashboard settings.

5.4 GDPR Rights (EU Residents)​

If you are an EU resident, you have additional rights under GDPR:

  • Right to erasure — Request deletion of your personal data (30-day processing)
  • Right to restriction — Request we stop processing your data
  • Right to object — Object to processing based on legitimate interests
  • Right to data portability — Receive your data in a structured, machine-readable format

To exercise these rights, contact privacy@dragonfractal.com.

5.5 CCPA Rights (California Residents)​

If you are a California resident, you have rights under CCPA:

  • Right to know — What personal information we collect and how we use it
  • Right to delete — Request deletion of your personal information (45-day processing)
  • Right to opt-out — We do not sell personal information, so this right does not apply
  • Right to non-discrimination — We will not discriminate against you for exercising your rights

6. Cookies​

We use minimal cookies:

CookiePurposeDuration
auth_tokenJWT access token (localStorage)15 minutes
refresh_tokenJWT refresh token (localStorage)7 days

We do not use tracking cookies, third-party analytics cookies, or advertising cookies.

7. Children's Privacy​

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

8. International Data Transfers​

Your data is processed and stored in the United States. If you are accessing the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer.

9. Changes to This Policy​

We may update this Privacy Policy from time to time. Material changes will be communicated via:

  • Email notification to the address on your account
  • A notice on the dashboard
  • An updated "Last Updated" date on this page

10. Contact​

For privacy-related questions or requests:

For data protection inquiries from EU residents, contact our data protection representative at privacy@dragonfractal.com.