← Back

Privacy Policy

Last updated: 26 March 2026

Who we are

Scamallteoir is operated by Latent Search Limited, a company registered in Ireland. When this policy refers to "we", "us", or "our", it means Latent Search Limited.

What we collect

We collect only what is necessary to provide the service:

Account information

  • Email address — used for authentication (magic link or Microsoft sign-in), daily reports, and account communications.
  • Display name — if provided via Microsoft Entra sign-in.
  • Microsoft Entra tenant ID and user object ID — if you sign in with Microsoft. Used to link your identity to your workspace.

Cloud cost data

  • AWS Cost Explorer data — daily cost figures, service-level breakdowns, and cost anomalies. Accessed via read-only IAM credentials you provide.
  • Azure Cost Management data — daily cost figures, resource group breakdowns, and cost anomalies. Accessed via read-only role assignments you grant.
  • Azure Resource Graph data — resource metadata, tags, and inventory. Used for waste detection and cost attribution. Accessed only when you grant the Reader role.

Usage data

  • Google Analytics — we use Google Analytics to understand how people use the website and application. This collects standard analytics data (pages visited, time on site, browser type). You can opt out using any standard GA blocker.

What we do not collect

  • We do not access the contents of your cloud resources (files, databases, application data, secrets, keys).
  • We do not collect payment card details directly — billing is handled by Stripe.
  • We do not sell, rent, or share your data with third parties for marketing purposes.

How we use your data

  • Cost monitoring — to generate daily reports, detect anomalies, identify waste, and attribute costs to projects and owners.
  • Email delivery — to send daily digest reports, anomaly alerts, onboarding guidance, and account communications. Email is sent via Postmark.
  • Slack delivery — to send cost reports to your configured Slack channel, if enabled.
  • Product improvement — aggregated, anonymised usage patterns help us improve the product. We do not use your cost data for benchmarking or share it externally.

Read-only access

Scamallteoir operates on a strict read-only basis. The credentials and roles you provide allow us to read billing data and describe resources. We cannot create, modify, or delete any resources in your cloud accounts. This is enforced at the IAM/role level by AWS and Azure — it is not merely a policy on our side.

Data storage and security

  • Application data is stored in Cloudflare D1 (SQLite) and Cloudflare KV, hosted in Cloudflare's global network.
  • Cloud credentials (AWS access keys, Azure client secrets) are encrypted at rest in the database.
  • Sessions are stored in Cloudflare KV with automatic expiry (7 days).
  • All connections use HTTPS. There is no unencrypted access to the application.

Data retention

  • Cost snapshots — retained for as long as your account is active. Historical data helps with trend analysis and anomaly detection.
  • Account data — retained until you delete your account or ask us to remove it.
  • Session data — automatically expires after 7 days.
  • Magic link tokens — automatically expire after 15 minutes.

If you cancel your subscription or delete your account, we will delete your data within 30 days. You can request immediate deletion by contacting us.

Third-party services

We use the following third-party services to operate Scamallteoir:

  • Cloudflare — hosting, CDN, database, and edge compute.
  • Postmark — transactional email delivery.
  • Stripe — payment processing and subscription management.
  • Google Analytics — website and application analytics.
  • Microsoft Entra — identity provider for Microsoft sign-in.

Each of these services has their own privacy policy. We select providers who maintain appropriate data protection standards.

Your rights

Under GDPR and applicable data protection law, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data.
  • Portability — request your data in a machine-readable format.
  • Object — object to processing of your data for certain purposes.

To exercise any of these rights, contact us at privacy@scamallteoir.app.

Cookies

We use a single session cookie (scamallteoir_session) to keep you signed in. This is a functional cookie required for the application to work. We do not use advertising cookies or cross-site tracking cookies. Google Analytics uses its own cookies for analytics purposes.

Children

Scamallteoir is a business tool. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify you by email. The "last updated" date at the top of this page always reflects the current version.

Contact

For privacy-related questions or requests:

Need help? Contact support or email support@scamallteoir.app