Legal

Privacy Policy

Effective October 13, 2026

Who we are

CostPulse LLC is a Delaware limited liability company. We operate costpulse.io, an AWS cost anomaly alerting service that monitors your AWS spend and delivers alerts to Slack and Microsoft Teams. Questions about this policy: [email protected].

What we collect

We collect the minimum necessary to run the service:

  • Account information — your email address and, where applicable, company name, when you sign up.
  • AWS billing data — cost and usage records from your AWS Cost and Usage Report (CUR) export, plus up to about 90 days of daily spend from Cost Explorer when you first connect. We access these via a read-only cross-account IAM role you provision. The CUR files we read include resource IDs and your cost allocation tags. From them we store daily spend per account, service and region, a breakdown by usage type, and spend by tag value for the tag keys that explain most of a service's cost. Tag values are whatever you put in them, so if your tags contain names or email addresses, those values can appear in what we store and in your alerts. We never read your data objects, databases, secrets, or source code.
  • Amazon Bedrock usage metrics — per-model invocation and token counts from the AWS/Bedrock CloudWatch namespace, used to explain Bedrock spend by model. Counts only, never prompts or responses.
  • AWS account identifiers — account IDs and the services generating spend, used to compute baselines and detect anomalies.
  • Notification channel configuration — Slack workspace/channel IDs or Teams webhook details you connect, used solely to deliver your alerts.
  • Billing information — payment processing is handled by Stripe. We store only a Stripe customer ID; your card details never touch our servers.
  • Signup source — when you create an account, we store with it where your visit came from, if known: the campaign tags on the link you arrived through (such as src or utm_source), the website that linked to us, the first page you saw, and the tag on the signup link you clicked. This lets us tell which pages lead to signups. It is kept in your browser tab's session storage until then, and is gone when the tab closes.
  • Page view counts — our own cookieless counter adds one to a daily total for the page you viewed and, if known, the site or campaign tag that sent you, and counts a few steps such as starting a signup. It sets no cookie, assigns you no identifier, and does not store your IP address; your browser's user agent is checked to filter out bots and then discarded. The only thing kept is the daily totals, which cannot be traced back to you.
  • AWS price change alerts — if you sign up for the free price change emails on our AWS price change tracker, without a CostPulse account: your email address, the AWS services you chose, and when you subscribed and confirmed. Nothing is sent until you confirm by email.
  • Usage data — standard web server logs (IP address, browser, pages visited) retained for up to 90 days for security and debugging.

What we do not collect

We do not access the contents of your S3 objects (other than the CUR export files described above), RDS databases, application logs, secrets, parameters, or any other payload data in your AWS environment. The IAM role is read-only. Every permission it grants, each one used by CostPulse, is listed on the IAM permissions page.

How we use your information

  • Computing 7-day rolling spend baselines per service and region.
  • Detecting anomalies above your configured thresholds and routing alerts to Slack or Teams.
  • Sending weekly digest emails and in-app notifications about your cost trends.
  • Sending AWS price change alerts to people who subscribed and confirmed, only for the services they chose. Every alert has a one-click unsubscribe link.
  • Processing your subscription and communicating about billing.
  • Responding to support requests.
  • Improving and securing the service.

We do not sell your data. We do not use your AWS billing data to train machine learning models for any purpose other than your own anomaly detection.

Data sharing

We share data only with the vendors necessary to operate the service:

  • Amazon Web Services — our infrastructure runs on AWS in us-west-2, where your spend baselines and alert history are stored in DynamoDB. Your Cost and Usage Report files stay in your own AWS account, in us-east-1 — the region AWS requires for CUR 2.0 exports. All processing and storage is within the United States.
  • Stripe — payment processing. Subject to Stripe's privacy policy.
  • Slack / Microsoft — only the alert message content you've configured is sent to your connected workspace. We do not share account or billing data with these platforms.
  • Cloudflare — DNS and content delivery for costpulse.io, so it handles every request to the website, including your IP address. We also use Cloudflare Web Analytics to count page views.
  • Google Fonts — the website loads its fonts from Google, which receives your IP address and browser details when a page loads.
  • Buttondown — if you join a waitlist or mailing list on our site, the email address you enter is sent to Buttondown, which manages that list.

Sign-in is handled by Amazon Cognito and email alerts are sent through Amazon SES, both part of our AWS infrastructure above.

We may disclose information when required by law or to protect the rights, safety, and property of CostPulse, our users, or the public.

Data retention

Alert history is deleted automatically 90 days after each alert is created. Daily spend data, account data and configuration are kept for as long as your account is active, because baselines, digests and alert explanations compare against past weeks. When your plan ends (you cancel, or a trial ends without a subscription), we stop reading your AWS billing data. Cancelling your subscription does not delete them, so if you come back your history is still there; nothing is deleted on a timer. To have your spend data, account data and configuration deleted, use "Delete my data" on your Account page or email [email protected]; we confirm the request with you and then delete it within 30 days (database backups that may still hold it expire within 35 days). We keep a record that the deletion happened, with dates and row counts but none of your data, and payment records as required for bookkeeping. For AWS price change alerts, an unconfirmed sign-up is deleted after 48 hours, and your address is deleted as soon as you unsubscribe, or if mail to it hard-bounces or is reported as spam (database backups that may still hold it expire within 35 days). To stop abuse of the sign-up form we count sign-ups per network using a keyed hash of the IP address, never the address itself; those counters expire after 2 hours and are then deleted automatically.

Security

All data is encrypted in transit (TLS 1.2+) and at rest with AES-256 (AWS-managed KMS keys for DynamoDB, SSE-S3 for object storage). Access to production systems is restricted by IAM roles with least-privilege policies and requires multi-factor authentication. We do not store AWS credentials — only the ARN of the read-only role you provision.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing [email protected]. We will respond within 30 days. You can revoke our AWS access at any time by deleting the cross-account IAM role from your account — this immediately terminates our ability to read your billing data.

Cookies

CostPulse does not set cookies of its own. To keep you signed in, the app stores sign-in tokens in your browser's local and session storage. Cloudflare, our content delivery network, may set strictly necessary security cookies. We do not use tracking pixels, advertising cookies, or cookie-based analytics; Cloudflare Web Analytics counts page views without cookies, and so does our own counter described above.

Changes to this policy

We will post any material changes here and update the effective date. If changes materially affect how we handle your data, we will notify you by email at least 14 days in advance.

Contact

CostPulse LLC · [email protected] · costpulse.io