Privacy policy

Effective 20 October 2026. Version 2026-10-20.2.

This policy explains what SpendShrink collects, why, who receives it, how long it is kept, and the rights and controls you have. It is written to be read, not skimmed; if anything here is unclear, write to privacy@spendshrink.com.

1. Who we are

SpendShrink is an AWS cost-optimisation service operated by Spend Shrink LLC, a West Virginia limited liability company based in Bunker Hill, West Virginia, United States ("SpendShrink", "we", "us"). "You" means the business using the service and the people who use it on that business's behalf.

SpendShrink is built for businesses. It is not directed at consumers or at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@spendshrink.com and we will delete it.

2. Our two roles

• Controller for account data. We decide how account, usage, support and billing data about you and your users is handled, and this policy describes it.
• Processor for your AWS data. We process the billing and resource data in your AWS accounts on your behalf and on your instructions, which are our terms of service and how you use the service. Your business remains the controller of that data. A data processing agreement is available on request at privacy@spendshrink.com.

3. What we collect, and why

Account data

Your name, email address, company name, a password hash (never the password itself), and, if you sign in with Google, the identifier and email Google returns. We use these to run your account, sign you in, keep it secure, and send transactional email such as verification, alerts, reports and security notices.

AWS billing and resource metadata

When you connect an AWS account, you deploy a CloudFormation stack in your own account. It creates a read-only IAM role that trusts SpendShrink with an External ID, and an AWS Data Export (FOCUS format) that lands in an S3 bucket you own. SpendShrink reads that export and a limited set of resource metadata (for example EC2, RDS, EKS, ECR and S3 inventory and utilisation metrics) to explain your bill and find savings. The role cannot create, change or delete resources in your account. The full list of permissions is published at spendshrink.com/trust.

If you enable the one-time history import, SpendShrink calls AWS Cost Explorer once to load up to twelve months of past cost data so your first analysis has context.

This data is mostly about infrastructure and cost. It can contain personal data where your resource names, tags or account names include it, so we treat it with the same care.

Usage, device and support data

Standard server logs (IP address, user agent, request path, timing), audit records of who did what in your workspace, product events needed to operate the service, and any messages you send to support.

Analytics in the app

The app at app.spendshrink.com loads Google Analytics, which records pages viewed and device and browser details, and, on the sign-up page only, sends a Google Ads conversion event when an account is created. If your browser sends a Global Privacy Control signal, the app does not load Google's tag at all, so neither runs. The public website at spendshrink.com uses no analytics or advertising tags.

Billing

Payments are processed by Stripe. SpendShrink stores your Stripe customer and subscription identifiers and invoice history; card numbers go to Stripe directly and never touch our systems.

4. How we use AI

SpendShrink uses large language models to write explanations and recommendations ("missions") from your billing and resource data. Missions are generated by DeepSeek V4 models served through DeepInfra's API. Only the data needed for a given mission is sent, and it is not used to train models. Recommendations are proposals: nothing changes in your account unless someone on your team approves it. We do not use AI to make decisions that have legal or similarly significant effects on any person.

5. Legal bases

Where the GDPR or a similar law applies, we rely on these legal bases:

• Contract: to provide the service you signed up for, including your account, analysis, missions, billing and support.
• Legitimate interests: to secure the service, prevent abuse, keep audit records, understand how the app is used and improve it, and measure sign-ups. You can object at any time (see Section 9).
• Legal obligation: to keep tax and accounting records and to respond to lawful requests.
• Consent: where the law requires it, for example for optional cookies in some countries. You can withdraw consent at any time.

6. Who receives data

We do not sell personal data. We do not share your AWS data with other customers. We share data only with the providers we need to run the service, each under its own data-processing terms:

• Amazon Web Services (United States, region us-east-1): hosting, database, storage, queues, and transactional email through Amazon SES. Receives all data the service holds.
• Stripe (United States): payments and invoicing. Receives your business name, billing email, subscription and invoice details, and the payment details you give Stripe directly.
• Google (United States): optional Google sign-in, which returns your Google identifier and email to us; and Google Analytics and Google Ads measurement in the app, which receive usage, device and browser data unless your browser sends Global Privacy Control.
• DeepInfra (United States): AI model inference for missions. Receives the excerpts of billing and resource data needed for each mission, never your password or AWS credentials.

We may also disclose data if the law requires it, to protect the rights, safety or property of SpendShrink, our customers or others, or to a successor in a merger, acquisition or sale of assets, which would remain bound by this policy.

7. International transfers

SpendShrink is hosted in the United States. If you use it from elsewhere, your data is transferred to and processed in the United States, where data protection law may differ from yours. Where the law requires a transfer mechanism, we use Standard Contractual Clauses, which our data processing agreement includes.

8. How long we keep it

A scheduled sweep deletes data once its retention period runs out. The same schedule is published at spendshrink.com/trust.

• AI prompts, conversations and tool-call records: 90 days.
• Alert history and alert notification delivery history: 365 days.
• Business, governance and AWS-access audit events: 400 days.
• Product funnel events: 400 days.
• Billing data derived from your FOCUS exports: kept while the AWS account is connected, with no automatic sweep, and deleted when you purge that account or erase your business.
• Account data: kept while your account is active, and deleted when you erase your business.
• Sign-in session: the session cookie expires after 7 days.
• Billing records: invoice history we hold is deleted when you erase your business. Stripe keeps its own transaction records for as long as the law requires it to.

When you purge an AWS account connection, SpendShrink stops reading from it, wipes its stored credentials and deletes the data we hold about it. When you erase your business, we delete your Stripe customer record and every record tied to your business, and delete user accounts that do not belong to another business. Each deletion leaves a receipt that records only that it happened, the number of rows removed, and a one-way hash of the identifier. The export in your own S3 bucket stays under your control.

9. Your rights and controls

Controls in the service

• Export: you can request a copy of the data SpendShrink holds about your business from the app or by email.
• Delete: an administrator can purge an AWS account connection, or erase your whole business, from the app. Deletion runs as a tracked job and cannot be undone.
• Disconnect: deleting the CloudFormation stack in your AWS account revokes our access instantly, whatever the state of your SpendShrink account.
• Analytics: enable Global Privacy Control in your browser and the app will not load Google's tag.

Your rights

Depending on where you live, you may have the right to know what personal data we hold about you and to get a copy; to correct it; to delete it; to restrict or object to how we use it; to data portability; to withdraw consent; and to opt out of the sale or sharing of your personal information. To use any of these rights, write to privacy@spendshrink.com from the email address on your account, or have an authorised agent write for you with proof of authority. We verify requests by confirming control of the account email, and we respond within 30 days, or 45 days where California law applies, telling you if we need longer. We will not treat you differently for using your rights. If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your local data protection authority.

Where we process your AWS data as a processor, we pass requests about it to your business, which decides how to answer them, and we help them do so.

10. California privacy disclosures

In the last 12 months we have collected these categories of personal information, from you, your users, your connected AWS accounts and your devices:

• Identifiers: name, email address, account identifiers, IP address.
• Commercial information: subscription and invoice history.
• Internet or other electronic network activity: server logs, audit records, product events, and app analytics.
• Professional information: company name and your role in your workspace.
• Sensitive personal information: account login credentials (your email and password hash), used only to sign you in.

We use these categories for the purposes in Section 3 and disclose them for business purposes to the providers in Section 6. We do not sell personal information. Our use of Google Analytics and the Google Ads sign-up conversion may count as "sharing" identifiers and internet activity for cross-context behavioural advertising under California law. You can opt out by enabling Global Privacy Control, which the app honours automatically, or by writing to privacy@spendshrink.com. We do not use sensitive personal information to infer characteristics about you, and we do not knowingly sell or share the personal information of anyone under 16.

11. Cookies and similar storage

• Session cookie (app): "spendshrink_refresh", or "spendshrink_msp_refresh" for managed service provider accounts, keeps you signed in. It is HttpOnly, limited to the app host, sent only on same-site requests, and expires after 7 days.
• Local storage (app): the time of your last activity, used to sign you out after a period of inactivity, and, for managed service providers, which customer is selected.
• Google Analytics (app): Google's tag sets its own cookies, such as "_ga", to tell visits apart. It is not loaded when your browser sends Global Privacy Control.
• Public website: spendshrink.com sets no cookies.

12. Security

Credentials and External IDs are encrypted at rest with keys that rotate. Access to production is limited to the people who run the service, and every access is logged. No system is perfectly secure, but if we learn of a breach affecting your personal data, we will tell you without undue delay, and in any case within 72 hours of confirming it, with what we know and what we are doing about it.

13. Changes

When this policy changes, the version and effective date at the top change with it, and material changes are announced in the app or by email before they take effect.

14. Contact

Spend Shrink LLC, Bunker Hill, West Virginia, United States. Privacy questions and requests go to privacy@spendshrink.com; everything else to support@spendshrink.com.