Effective date: 27 July 2026
1. Who we are
SpendTensor, Inc. ("SpendTensor", "we", "us") provides an AI cost management and FinOps platform. This page explains what personal data we process, why, and the choices you have. It is maintained by SpendTensor and is not an independent certification.
Questions or requests: cyberprosoftware@gmail.com.
2. Data we collect
Account data: name, work email, organization name, and authentication identifiers. Passwords are never stored in plaintext — authentication is handled by our managed auth provider.
Product data: provider connection labels, usage and cost aggregates pulled from your AI providers, budgets, reports, and recommendations generated for your organization.
Marketing data: information you voluntarily submit through the demo request or newsletter forms, plus the user agent string of the submitting browser.
We do not sell personal data, and we do not use your prompt or completion content for model training.
3. Provider credentials
API keys you connect are encrypted with AES-256-GCM before they are written to the database and are decrypted only inside server-side sync workers. They are never returned to the browser and never appear in logs. Only a masked hint (last four characters) is displayed in the interface.
4. Legal bases and purposes
We process account and product data to perform our contract with you, marketing data with your consent, and a limited set of security and diagnostic data under our legitimate interest in keeping the service safe and reliable.
5. Sharing and subprocessors
We share data only with subprocessors required to run the service: our cloud hosting and managed database provider, our transactional email provider, and Stripe for payment processing. Stripe handles card data directly; SpendTensor never receives or stores full card numbers.
6. Retention
Usage aggregates are retained for the life of your account plus 30 days. Marketing submissions are retained until you ask us to remove them. Deleting your organization removes provider connections and their encrypted keys immediately.
7. Your rights (GDPR / CCPA)
Depending on where you live you may request access, correction, deletion, portability, or restriction of your personal data, and you may object to processing or withdraw consent at any time. California residents may request disclosure of categories collected and opt out of sale — we do not sell personal data.
Email cyberprosoftware@gmail.com and we will respond within 30 days.
8. Security
Data is encrypted in transit over HTTPS and at rest by our database provider. Row-level security scopes every record to the owning organization, provider credentials are encrypted at the application layer, and administrative database functions are restricted to backend service roles only.
9. Cookies and browser storage
We use strictly necessary cookies and local storage for authentication sessions, security, and to remember your consent choices. Analytics and marketing storage is optional, off by default, and only set if you opt in through the consent banner. We do not run third-party advertising trackers and we do not sell or share personal information for cross-context behavioural advertising. Full detail, including how to change your choices, is in our Cookie Policy.
10. Email and messaging
Service emails (security, billing, alerts, and account notices) are part of the service and are sent to account owners and members. Marketing and newsletter emails are sent only with your consent, always identify SpendTensor as the sender, include our postal address, and carry a one-click unsubscribe that we honour within 10 business days. We do not send marketing SMS messages or automated/prerecorded calls; if we ever introduce them, we will obtain separate prior express written consent first.
11. International transfers
SpendTensor is operated from the United States and our hosting and email subprocessors may process data in the United States and the EU. Where personal data is transferred out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with those subprocessors.
12. Children
SpendTensor is a business product and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data, email us and we will delete it.
13. Changes
We will post material changes on this page and update the effective date below.