Privacy Policy
For website visitors, platform users, customer administrators, prospects, and support contacts
1. Purpose and Scope
This Privacy Policy explains how CLOUD TRUCOST (OPC) PRIVATE LIMITED, operating as TruCost.Cloud, collects, uses, shares, protects, and retains personal data in connection with its website, FinOps platform, customer onboarding, support, marketing, and consulting services.
This policy applies to website visitors and prospects browsing trucost.cloud, platform users using the TruCost.Cloud SaaS platform, customer contacts and enterprise account administrators, support contacts, trial users, and event or webinar participants.
Where TruCost.Cloud processes personal data on behalf of an enterprise customer, the applicable Data Processing Addendum governs and takes precedence over this Privacy Policy for that processing activity.
2. Personal Data We Collect
Account and identity data: name, email, phone, company, role, and login identifiers used for account creation, authentication, support, and administration.
Business contact data: prospect details, meeting notes, and communication preferences used for sales, demos, customer success, and relationship management.
Usage and device data: IP address, browser, device, login activity, audit logs, and feature usage used for security, troubleshooting, product improvement, and fraud prevention.
Customer cloud metadata: AWS account IDs, account names, CUR/billing data, resource IDs, tags, budget data, and recommendations used for FinOps analysis, dashboards, optimization, reporting, and governance.
Support and communication data: emails, tickets, attachments, meeting notes, and feedback used for support, issue resolution, and service improvement.
Marketing and events data: event registrations, webinar attendance, newsletter subscriptions, and marketing preferences used for marketing, communications, and product updates with consent where required.
Job applicant data: when you apply through the careers page we collect your name, email, phone number, LinkedIn profile URL, current location, availability, the note you write and the resume you upload. This data is used only to assess your application and to contact you about it; it is stored in encrypted AWS storage in the Mumbai region, emailed to the hiring team, and is never sold or used for marketing. It is retained as described in section 8 and deleted earlier on request to privacy@trucost.cloud.
3. Important Note on AWS Billing and Tag Data
AWS billing and CUR data is primarily business and confidential customer data. It may contain or become personal data if customer-provided account names, tags, resource names, owner mappings, email addresses, usernames, or metadata identify or are reasonably linkable to individuals.
Customers should avoid embedding unnecessary personal data in resource names, tags, or account descriptions.
4. How We Use Data
TruCost.Cloud uses personal data to provide and operate the platform and FinOps services; generate cost dashboards, optimization recommendations, anomaly reports, budgets, showback, and chargeback outputs; authenticate users, manage roles, enforce access controls, and maintain security audit logs.
TruCost.Cloud also uses data to communicate with customers about support, onboarding, service updates, invoices, and security matters; send marketing communications where consent or legitimate interest applies; improve product reliability, performance, and usability through aggregated and anonymized usage analytics; comply with legal, tax, accounting, security, and contractual obligations; and detect, investigate, and prevent fraudulent activity, unauthorized access, and security incidents.
5. Legal Basis and Consent
Where required, TruCost.Cloud processes personal data based on consent, contractual necessity, legitimate business interest, or compliance with applicable law.
For customer-controlled data processed on behalf of an enterprise customer, the customer is typically the Data Fiduciary or controller and TruCost.Cloud acts as a Data Processor under the DPA.
Where TruCost.Cloud relies on legitimate interests for marketing, the customer has the right to opt out at any time by contacting privacy@trucost.cloud or using the unsubscribe link in any communication.
6. Sharing and Sub-processors
TruCost.Cloud does not sell personal data. TruCost.Cloud may share data with service providers and sub-processors that help deliver the services, including cloud infrastructure providers, email and communication providers, authentication and security providers, analytics services, customer support tools, and professional services providers.
All sub-processors are subject to contractual confidentiality and security obligations materially consistent with this Privacy Policy and the DPA.
A current sub-processor list will be maintained and shared with enterprise customers on reasonable written request or as required by the DPA.
7. Security Measures
TruCost.Cloud implements technical and organizational measures to protect personal data, including encryption in transit using TLS and encryption at rest for databases, object storage, backups, and logs where technically supported.
Safeguards include least-privilege access controls, role-based access, MFA for administrative access to production systems, secrets management, centralized logging, monitoring, alerting, periodic access reviews, secure development practices, code review for security-sensitive changes, dependency management, periodic VAPT, tenant isolation controls, logical data separation in multi-tenant environments, and business continuity and disaster recovery planning with validated backup and restore procedures.
8. Data Retention
User account data is retained for the contract term plus up to 90 days after account closure unless required longer by law or contract.
Customer AWS billing and CUR data is retained for the contract term and agreed reporting period, then deleted or anonymized after offboarding as agreed in the DPA.
Security and access logs are retained for at least 180 days for CERT-In readiness and security investigations, or longer if required by law.
Marketing and contact data is retained until withdrawal of consent or opt-out, or as required by law. Invoices and tax records are retained as required by applicable Indian tax, accounting, and Companies Act obligations, typically eight years.
Support and communication records may be retained up to three years after case closure or as required by contract. Backups are deleted through normal backup rotation unless a legal hold applies.
Job applications: uploaded resumes are deleted automatically 180 days after upload and application records 365 days after submission, unless you are hired (your data then moves to employee records) or ask us to delete them sooner. Website contact and demo requests are kept for 90 days.
9. Individual Rights and Requests
Individuals whose personal data TruCost.Cloud processes as Data Fiduciary may request access, correction of inaccurate or incomplete personal data, erasure where no longer necessary or where consent is withdrawn, consent withdrawal, and grievance redressal with TruCost.Cloud's designated Grievance Officer.
Where TruCost.Cloud processes personal data on behalf of an enterprise customer as Data Processor, requests may be redirected to that customer as the Data Fiduciary. TruCost.Cloud will assist the customer in responding to such requests as required by the DPA.
10. Cookies and Website Analytics
The TruCost.Cloud website may use cookies or similar technologies for security, functionality, analytics, and marketing. Essential cookies required for website operation do not require consent.
Where non-essential cookies such as analytics or marketing cookies are used, TruCost.Cloud will implement a cookie banner or consent mechanism appropriate to the jurisdictions in which the website is accessed.
Users may opt out of non-essential cookies at any time through the cookie preference centre or by configuring their browser settings. Disabling cookies may affect website functionality.
11. International Data Transfers
Personal data may be processed in India or in other countries where TruCost.Cloud or its sub-processors operate. TruCost.Cloud will ensure that international transfers of personal data are subject to contractual, security, and legal safeguards appropriate to the jurisdiction involved.
Customer-specific data residency requirements, such as India-only storage, should be documented in the applicable order form or DPA. Where such requirements are agreed, TruCost.Cloud will use reasonable technical measures to honour them, subject to the capabilities of its hosting infrastructure.
12. Breach and Incident Notification
TruCost.Cloud will investigate suspected personal data breaches and security incidents promptly. Affected enterprise customers will be notified as required by applicable law, contract, and the DPA.
Enterprise agreements may specify notification timelines, cooperation duties, and allocation of regulatory reporting responsibilities.
TruCost.Cloud will report qualifying security incidents to CERT-In and other applicable authorities within the timelines prescribed by applicable law, currently six hours for qualifying incidents under CERT-In rules.
13. Children's Privacy
The TruCost.Cloud platform and services are not directed to individuals under the age of 18. TruCost.Cloud does not knowingly collect personal data from minors.
If TruCost.Cloud becomes aware that a minor has provided personal data without appropriate consent, TruCost.Cloud will delete such data promptly.
14. Changes to This Policy
TruCost.Cloud may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or service features.
Material changes will be communicated by email to the primary account contact or by a prominent notice on the website at least fourteen days before they take effect, where reasonably practicable.
15. Grievance and Contact
Privacy and data protection contact: privacy@trucost.cloud
Grievance Officer: grievance@trucost.cloud
Security contact: security@trucost.cloud
Website: https://trucost.cloud
Individuals may also lodge a complaint with the Data Protection Board of India once constituted under the Digital Personal Data Protection Act, 2023.