Get started free
Legal/Data handling

Data handling

Last updated 19 June 2026 Metadata only

billingAI processes cost metadata only — never the contents of your workloads — and runs no third-party tracking scripts. This page is the plain-language companion to our Privacy Policy: exactly what we store, where, and for how long.

The whole data path

You upload a FOCUS-conformant billing export, we read the file. That's it. There is no agent, no standing connection to your cloud, and no background job reaching into your accounts. We never ask for IAM roles, service principals, or service-account keys.

You upload
FOCUS file
We parse metadata
cost columns only
You see a dashboard
your spend
What we store

From your upload we keep the cost and usage metadata needed to render your dashboard:

  • service, region, and account identifiers;
  • resource tags;
  • the FOCUS cost and usage columns (amounts, currency, periods).
What we never touch
  • the contents of your workloads, databases, or storage;
  • your cloud credentials — we never request or hold them;
  • anything beyond the FOCUS billing file you choose to upload.

How long we keep it

7 daysRaw uploaded files — deleted from their landing storage.
90 daysParsed metadata & aggregates — retained from your last activity.
ActiveAccount details — kept while your account is active; removed when you delete it.

No background ingestion

Nothing syncs on a schedule. If you don't open a tab and drop a file, no new data enters our system. Your upload is the only data path.

No machine-learning training

We do not train machine-learning models on your data — not now, not later, and not for "improving service quality." We may compute aggregate, non-identifying platform statistics for capacity planning, but never your per-account content.

Who processes your data

ProviderPurpose
CloudflareHosting and delivery, bot protection (Turnstile), and privacy-friendly web analytics.
Selcomm Authentication APIAccount creation, password hashing, and email verification.

We do not sell or share your data, and there are no advertising or data-enrichment partners. Your data is processed and stored in hosting region / data-residency — to confirm.

Analytics & tracking

Our product analytics is first-party and metadata-only — it is off by default and, when enabled, records only page paths and event names (never form contents or cost data) and honours your browser's "Do Not Track" setting. We self-host our fonts, so visiting a page doesn't leak your visit to a font provider.

Security

Everything is served over HTTPS/TLS. Passwords are hashed server-side. We apply a strict Content-Security-Policy, HSTS, and anti-framing and anti-sniffing headers, and bot protection on sign-up.

Questions

For the full picture, see our Privacy Policy or contact us at privacy contact email — to confirm.

This is a plain-language description provided for transparency and is not legal advice.