Privacy Policy & Data Governance
Last updated: October 2026 • Strict data minimization, zero AI model training, self-hosted font privacy, and least-privilege telemetry processing.
1. Data Classification Tiers & Read-Only Boundaries
KloudSense enforces a rigid three-tier data classification system to guarantee that sensitive corporate secrets and application payloads never enter our scanning pipeline:
Passwords, IAM secret keys, database connection strings, S3 object contents, database tables, or private customer records. Blocked entirely by our read-only IAM policy boundaries.
12-digit AWS Account IDs, internal VPC CIDRs, and specific server resource IDs. Redacted, encrypted at rest using AES-256, and never shared with third parties.
Generic instance family types (e.g. m6i.2xlarge), aggregate CPU utilization percentiles, volume detachment durations, and pre-computed pricing differentials.
2. Zero AI Model Training Commitment
Enterprise API agreements with our model providers guarantee that zero customer infrastructure telemetry or analysis data is used to train, retrain, or fine-tune public or private machine learning models. Any automated analysis occurs in stateless, private memory with zero data retention by external AI providers.
3. Principle of Data Minimization
KloudSense strictly limits data collection to the minimum technical telemetry necessary to identify cost waste and system rightsizing. We only inspect AWS configuration metadata (via read-only APIs like ec2:DescribeInstances) and CloudWatch metric summaries. We never query databases, download objects, or read application logs.
4. Self-Hosted Fonts & Zero Third-Party IP Leakage (GDPR Compliance)
In strict compliance with European data protection regulations (GDPR Art. 4(1) and Art. 6(1)(f)) and the Munich Regional Court ruling (Landgericht München Case 3 O 17493/20), KloudSense serves 100% of website typography, stylesheets, and font files locally from our own secured servers.
When you browse our landing pages, portals, or documentation, your browser does not establish dynamic connections to Google Fonts, external CDN networks, or third-party servers. Your IP address and User-Agent are never leaked or transmitted to foreign asset networks.
4. Telemetry Transparency: No Session Replay & No Keystroke Logging
KloudSense strictly respects visitor privacy and complies with wiretapping statutes, including the California Invasion of Privacy Act (CIPA - Cal. Penal Code § 631):
- No Keystroke Recording: We do not log, capture, or intercept user keystrokes, form text entries, or clipboard contents.
- No Session Replay Software: We do not deploy third-party session recording or DOM reconstruction tools (such as Hotjar, FullStory, LogRocket, or Microsoft Clarity) that capture user interaction sessions.
- Anonymized Telemetry Only: Website telemetry is strictly limited to high-level, aggregated page visit metrics and button click events to optimize navigation efficiency.
5. Cookies, Local Storage & Analytics Governance
We use a minimal set of cookies and local storage tokens:
- Strictly Necessary Cookies: Cryptographic session tokens and CSRF protection cookies required to maintain authenticated client and partner portal sessions.
- Preference Storage: Local storage flags to remember your dark/light mode and cookie banner choices without profiling your identity across third-party websites.
- Google Analytics 4: Deployed with IP anonymization enabled (
anonymize_ip: true) to measure aggregated, non-personalized traffic trends.
6. Children's Online Privacy Protection Act (COPPA) & Minor Policy
KloudSense is designed and operated exclusively for business organizations, IT departments, and technology professionals. We do not market to, solicit, or knowingly collect personal information from individuals under 18 years of age (or under 13 under COPPA - 15 U.S.C. § 6501). If we learn that personal data of a minor has been submitted, we will immediately delete that information from our active databases.
7. User-Uploaded Documents & Payment Proof Security
When clients or partners upload files (such as bank wire transaction receipts, payment screenshots, agency white-label logos, or architecture notes):
- Files are stored in private, non-public encrypted storage buckets inaccessible to search engine crawlers or public internet traffic.
- Uploaded payment proofs are reviewed solely by authorized administrative billing personnel to verify account activation.
- Uploaded files are retained only as long as necessary to maintain accounting records and audit integrity, and are permanently erased upon verified account termination.
8. Transactional Communications & Email Delivery
When you request an estimate, create an account, or execute an audit, we collect your business contact email address to deliver operational communications:
- Purpose of Emails: Account activation, password resets, scan progress updates, finalized PDF report download notifications, and billing invoices.
- No Unsolicited Marketing: We do not sell, rent, or distribute your email address to commercial marketing lists or third-party advertisers.
- Notification Preferences: You can review or adjust your notification contact information anytime through your portal account settings.
9. Data Subject Rights (GDPR & CCPA/CPRA)
Depending on your location, you hold statutory rights regarding your personal data, including the right to access, rectify, restrict processing of, or permanently delete your stored contact information.
To exercise your rights or request complete account and telemetry deletion, please contact our Data Protection Officer at [email protected].