Privacy Policy

FinOps Beacon is operated by Bryan Wrinkle, an individual based in Fentress County, Tennessee, United States ("FinOps Beacon," "we," "us," or "our"). This policy explains how we handle personal information when you visit or use the Azure cost-analysis service. If your employer or another organization provides your account, that organization also controls your use of its workspace and Azure data.

Information we collect

We collect information you or your organization provide, including names, email addresses, organization names, team roles, alert destinations, support messages, account activity, and subscription and billing status. To connect Azure, we process tenant, application, and subscription identifiers and either an encrypted application secret or an encrypted Microsoft refresh credential. When you purchase a paid plan, Stripe collects and processes payment-card and billing details on its hosted pages; FinOps Beacon receives identifiers, plan, payment status, renewal dates, and limited billing contact details, but not full card numbers.

At your direction, we retrieve Azure resource inventory, tags, usage metrics, cost records, budgets, recommendations, and subscription details. We also create scan history, recommendation decisions, notifications, and audit records. Cloudflare and the application receive routine technical information such as IP address, browser and device information, request time, request identifiers, security events, and errors.

If you create an account from a tagged campaign link, we save its source, medium, campaign, and content labels with your Supabase account metadata. We also save an Azure or AWS funnel label when you arrive through an explicitly identified product path. These labels become associated with your account; they are not anonymous. We may compare them with organization creation, completed scans, and verified subscription payments to understand which campaigns and product paths bring customers to the service. The funnel label records your selected path, not which clouds your organization can access. These labels use no additional cookies or browser storage.

If you email us about AWS early access, we receive the email and any details you choose to include so we can respond to your request. Opening the email link does not submit an inquiry, create an account, or subscribe you to marketing email.

Optional AWS pilot connections

AWS connections are available only to organizations for which we have enabled pilot access. If your organization chooses to connect AWS, we process account and role identifiers, the connection's external ID, selected regions, the role's trust policy, and account-discovery details you authorize. At your direction, AWS provides resource inventory, tags, usage metrics, cost records, recommendations, and any cost export you explicitly configure. We use this information for the same reporting, support, security, and retention purposes described in this policy; we do not use customer AWS data for advertising.

AWS provides the APIs and temporary role credentials used for these connections. Customer role credentials are held in memory and refreshed as needed; they are not stored in the application database. We do not require your AWS root credentials or permanent AWS access keys. Organization administrators can disconnect AWS in Settings and revoke access by removing the role's trust or deleting the role in AWS. Disconnecting preserves previously collected records until the organization is deleted or another applicable retention rule applies.

Sources of information

Information comes directly from users and organization administrators, from Microsoft when an authorized user connects Azure, and automatically from browsers, servers, and security systems as the service is used. We do not purchase personal information from data brokers.

How we use information

We use information to create and secure accounts, provide tenant-scoped reports, perform requested read-only Azure analysis, maintain cost history, send account and alert messages, provide support, prevent misuse, diagnose failures, maintain backups, meet legal obligations, and improve service reliability. We do not sell personal information, share it for cross-context behavioral advertising, or use customer Azure data for advertising.

Service providers and disclosures

Cloudflare provides application hosting, traffic protection, email relay, and operational logging. Supabase provides PostgreSQL database, backups, and authentication. Microsoft provides identity and Azure APIs at your direction. Stripe provides payment processing, subscription management, invoices, and its hosted customer portal. These providers process information to operate the service. We may also disclose information when required by law, to protect the service or users, or in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate protections.

Browser storage and tracking

The application stores the signed-in Supabase session in the browser and stores a local flag indicating that the onboarding guide has been completed. Cloudflare may use essential cookies or similar technologies for security and traffic management. Our campaign measurement carries labels in links and saves them when you submit signup; it creates no separate marketing cookies or browser storage entries and does not collect Google click identifiers, full referring URLs, or search terms. Account metadata may also appear in your existing signed-in session. We do not send customer identifiers or conversion events to Google for this measurement, and do not currently use third-party advertising trackers or cross-site profiling. Browser “Do Not Track” signals do not change these practices.

Security

Connections use HTTPS. Azure application secrets and delegated refresh credentials are encrypted before database storage, while encryption keys are held separately as Cloudflare secrets. Access is tenant-scoped, browser-facing database access is protected by row-level security, and administrative operations require an administrator role. No internet service can promise absolute security.

Retention and deletion

Service data is retained while the organization account is active so the requested historical analysis remains available. Administrators can export an organization summary or permanently delete the organization from Settings. Deleted records can remain in encrypted daily backups for the provider backup window before expiring. Security, fraud-prevention, billing, dispute, or legal records may be retained when reasonably necessary. More detail is in the Data Retention Policy.

Campaign labels are retained with your account metadata and removed from active Supabase storage when the associated identity is deleted. You may also request access to or removal of these labels through our support address.

Your choices and rights

You may request access, correction, export, or deletion of personal information by emailing support@finopsbeacon.com. Organization administrators control team membership and connected Azure configuration. You may disconnect Microsoft access in the product or revoke it through Microsoft. Depending on where you live, you may also have rights to object, restrict processing, withdraw consent, appeal a request decision, or complain to a privacy regulator. We do not discriminate against users for exercising applicable privacy rights.

International processing

Cloud services may process information in the United States and other countries where their infrastructure or personnel operate. Those locations may have different data-protection laws. Where required, we use contractual and provider safeguards intended to protect transferred information.

Children

FinOps Beacon is a business service and is not directed to children. We do not knowingly collect personal information from children under 13.

Contact and changes

Privacy and security questions can be sent to Bryan Wrinkle, FinOps Beacon, Fentress County, Tennessee, United States, at support@finopsbeacon.com. We may update this policy as the service changes. The effective date identifies the current version, and material changes will be communicated through the service or by email when practical.