Privacy Policy

Last updated: 1 May 2026 · Terms · DPA · Cookies · Subprocessors

1. Who we are

Cloud Maturity Enterprise, Inc. ("CME", "we") provides an agentic audit platform for AWS environments. This policy describes how we collect and use personal data on our marketing site, our product, and through customer communications. Our registered address is on the contact page.

2. The roles

For data we collect about your individual use of our marketing site or product (e.g. your account email), CME is the controller. For audit data we process inside your tenant — AWS resource metadata, your customer-doc content, findings — CME is the processor and your organization is the controller. The roles + obligations under GDPR are spelled out in our DPA.

3. What we collect

From you

• Account info: name, work email, organization, role.
• Authentication metadata: SSO IdP, login timestamps, IP.
• Billing info (Enterprise direct-invoice only): name, billing address, VAT number.
• Marketing-form input: when you fill /contact or download a resource.

From your AWS environment (with your permission)

• Resource metadata via STS:AssumeRole into the role you provision (read-only).
• CloudTrail summaries, Cost Explorer aggregates, Config snapshots.
• Customer-document text you upload (Trust pages, security FAQs, DPAs, vuln-mgmt policies).
• We do NOT pull object contents (S3 file bodies, RDS row-level data) — only the configuration that surrounds them.

Automatically

• Cookies for authentication + analytics — see Cookie Policy.
• Browser + device info, page-view events, agent-trace events for the in-product features you use.

4. How we use it

• Run audits, deliver findings, enable codegen + integrations.
• Authenticate + authorize access; detect abuse.
• Bill, invoice, and process subscription payments.
• Communicate product updates + trial follow-ups (you can unsubscribe at any time).
• Improve the corpus + agent performance — only with explicit tenant opt-in. Without opt-in, your audit data is never used to train or improve generic models.

5. Sharing

We do not sell personal data. We share data only with the subprocessors listed at /subprocessors, and only as needed to deliver the service (hosting, authentication, payment processing, error tracking, transactional email). We notify customers 30 days before adding a new subprocessor.

We disclose data when legally required (subpoena, court order) and notify the affected customer unless legally prohibited.

6. International transfers

CME is US-based. EU/UK customer data is transferred under Standard Contractual Clauses (the EU Commission's 2021 SCCs) plus our Transfer Impact Assessment. Enterprise customers may require EU-only data residency; we honor that via region pinning (eu-west-1 + eu-central-1).

7. Retention

Audit data + findings retention follows your plan: 30 days (Starter), 90 days (Pro), 1 year (Enterprise). Account info is retained for the lifetime of the tenant + 90 days post-deletion for compliance and dispute-resolution purposes. Aggregated, de-identified usage metrics may be retained longer.

8. Your rights

You have the right to access, correct, delete, port, or restrict the processing of your personal data. You also have the right to object to processing and to withdraw consent (without affecting prior lawful processing). Exercise these by emailing privacy@cmeexample.com or via the in-product "Privacy preferences" page in settings. We respond within 30 days.

California residents may request a Notice at Collection and the right to opt out of any future "sale" or "sharing" — even though we don't sell or share data for cross-context behavioral advertising. EU/UK residents may lodge a complaint with their supervisory authority; the lead authority for CME is the Irish DPC.

9. Security

See the Security & Trust page for the controls we maintain. In the event of a personal data breach affecting you, we notify customers within 72 hours of confirmation as required under GDPR Article 33.

10. Children

CME is a B2B product for enterprise + cloud-engineering teams. We do not knowingly collect data from anyone under 16.

11. Changes

We post material changes to this policy 30 days before they take effect, via in-product banner + email to tenant admins. Non-material changes (typo fixes, link updates) ship with the updated last-updated date.

12. Contact

Privacy: privacy@cmeexample.com. DPO inquiries / EU representative: dpo@cmeexample.com. General security: security@cmeexample.com.