Cloud Cost ScannerPrivacy Policy
Effective October 28, 2026
This policy explains what personal information iOddy LLC ("we", "us") collects through Cloud Cost Scanner (the "Service"), how we use and share it, and the choices and rights you have. iOddy LLC is responsible for your personal information (the "controller"). Our affiliate Increscent Software Private Limited processes it on our behalf to operate and support the Service.
- We collect what we need to run scans, bill you and talk to you. Nothing else.
- We only ever read your Azure data, using the permissions you already have.
- We don't sell your personal information or use it for targeted advertising.
- We use no advertising or analytics cookies.
- You can delete everything yourself, at any time, from the Reports page.
1. Information we collect
When you sign in with Microsoft
Your name, email address, Microsoft account object ID and directory (tenant) ID. We also receive a Microsoft sign-in token so scans can run and be re-run. We store it encrypted and use it only to read your Azure data for you.
Information you give us
Company name, job title, phone number, company size, country, approximate monthly Azure spend, how you heard about us, notes you send with a plan request, and anything you write to us by email.
Azure data, read with your permission
Subscription names and IDs; resource names, IDs, resource groups, locations and configuration (for example disk state or VM size); cost totals by day, service and subscription; and Azure Advisor recommendations. This is mostly business information, not personal information. We don't read the contents of your resources: no files, databases, VM disks or application data.
Payments
Card payments are handled by Stripe. We never see or store your full card number. Stripe tells us your customer ID, plan, subscription status and payment dates; if tax applies, Stripe collects your billing address and, if you give it, a tax ID. Stripe's use of your information is covered by the Stripe privacy policy.
Collected automatically
- Where you came from. If you arrive from an ad or another website, your browser keeps the campaign tags (such as utm_source) or the referring website in local storage, and we save them with your account when you sign up. This tells us which marketing works; it isn't used to track you across other sites.
- Server logs. Our hosting provider records technical data such as IP address, browser type and the pages requested, used for security and troubleshooting and kept for a short time.
2. Cookies
We use only cookies that are strictly necessary for the Service to work:
| Cookie | Purpose | Lasts |
|---|---|---|
| ccs_session | Keeps you signed in | 7 days |
| ccs_flow | Protects the Microsoft sign-in from forgery | 15 minutes |
We don't use advertising, analytics or social media tracking cookies or pixels. If we ever add them, we'll update this policy first and ask for your consent where the law requires it. Stripe sets its own cookies on its checkout pages to prevent fraud.
3. How we use information
- To provide the Service: sign you in, run scans, produce and store reports, and show the plan that fits your spend.
- To bill you and manage your subscription, including receipts, renewals, failed payments and taxes.
- To communicate with you: service and billing emails, replies to your requests and, if you asked about a plan, follow-up from our team.
- To send occasional product news to business customers. Every such email has an unsubscribe link, and you can also ask us to stop at any time.
- To keep the Service secure, prevent fraud and abuse, and fix problems.
- To improve the Service, using aggregated, de-identified statistics where possible.
- To meet legal, tax and accounting obligations, and to establish or defend legal claims.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Legal bases (EEA, UK and Switzerland)
We process personal information to perform our contract with you (providing the Service and billing); for our legitimate interests (security, improving the Service, understanding which marketing works and business communications, balanced against your rights); to comply with legal obligations (tax and accounting); and with your consent where we ask for it, which you can withdraw at any time.
5. How we share information
We don't sell personal information, and we don't share it for cross-context behavioral (targeted) advertising. We share it only:
- With service providers who process it for us under contract and only on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Microsoft | Sign-in (Entra ID), reading Azure data with your permission, and sending our emails (Microsoft 365) | United States and worldwide |
| Vercel | Hosting the website and application | United States |
| Neon | Database hosting | United States |
| Stripe | Payments, invoices and tax calculation | United States |
| Increscent Software Private Limited | Our affiliate: development, operations and customer support | India |
- When you share a report. Anyone with the link sees that report's summary, without resource IDs or commands, until you turn the link off.
- For legal reasons, when required by law or valid legal process, or to protect the rights, safety and property of you, us or others.
- In a business transfer, such as a merger or sale of assets, subject to this policy.
- With your consent or at your direction.
6. International transfers
We're based in the United States and our affiliate is in India, so your information is processed in those countries, which may have different data protection laws from yours. Where the law requires, we protect transfers out of the EEA, UK and Switzerland with safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum.
7. How long we keep it
- Account, profile, scans and reports: while your account is open. We may delete accounts that have been inactive for 24 months, after emailing you first.
- When you delete your account: removed from our live systems immediately and from backups within 30 days. Your Microsoft token is deleted at the same time.
- Billing records: kept for as long as tax and accounting law requires, usually up to 7 years.
- Emails with us: kept as long as needed to handle your request and our business relationship.
8. Security
The Service has read-only access to Azure, all traffic uses HTTPS, Microsoft tokens are encrypted at rest, and access to production data is restricted to staff who need it. No system is perfectly secure; if a breach affects your personal information, we'll notify you and regulators as the law requires. More detail is on our security page.
9. Your choices and rights
- Delete your data yourself from the Reports page ("Delete all my data"). This also cancels any subscription.
- Revoke Azure access at myapps.microsoft.com, or as an admin in Entra ID under Enterprise applications.
- Update your details on your profile page in the app.
- Unsubscribe from product news with the link in any such email.
Depending on where you live, you may also have the right to access, correct, delete or receive a copy of your personal information; to object to or restrict our processing; to withdraw consent; and to opt out of sale, sharing for targeted advertising or profiling (we don't do these). To make a request, email info@increscentsoftware.com from your account email. We'll confirm your identity before acting and reply within the time the law allows (usually 30 to 45 days). You may use an authorized agent; we may ask for proof of their authority. We won't treat you differently for using your rights.
Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject line. If you're not satisfied with the outcome, you can contact your state attorney general or, in the EEA or UK, your data protection authority.
10. Notice for California and other US states
This section supplements the policy for residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon). In the last 12 months we have collected these categories of personal information, from you, from Microsoft when you sign in, from your Azure environment and from Stripe:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, phone, Microsoft account ID, IP address | Service providers listed above |
| Customer records | Company, billing address, payment status | Stripe, hosting and database providers |
| Commercial information | Plan, subscription and payment history | Stripe, hosting and database providers |
| Internet activity | Referring website or campaign, server logs | Hosting provider |
| Professional information | Job title, company size | Hosting and database providers |
| Sensitive information | Account sign-in token, used only to provide the Service | Microsoft, hosting and database providers |
We use these for the purposes in section 3 and keep them as described in section 7. We don't sell or share personal information, haven't done so in the last 12 months, and have no actual knowledge of selling or sharing information of anyone under 16. We use sensitive personal information only to provide the Service. We treat Global Privacy Control signals as a valid opt-out request. We don't disclose personal information to third parties for their own direct marketing (California "Shine the Light").
11. Children
The Service is for businesses and isn't directed to children under 16. We don't knowingly collect their personal information; if you believe we have, contact us and we'll delete it.
12. Changes to this policy
We'll post any changes here with a new effective date. If they're material, we'll email account holders before they take effect.
13. Contact
Questions or requests about privacy: info@increscentsoftware.com.
iOddy LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States
Grievance contact in India: Increscent Software Private Limited, #22, 7th Cross, Kanaka Nagar, Bengaluru, Karnataka 560032, India, info@increscentsoftware.com.