This Privacy Policy explains how OptiCloud Inc., a Delaware corporation ("OptiCloud", "Company", "we", "our", or "us"), collects, uses, stores, shares, and protects personal data and other information in connection with the OptiCloud platform and related services (the "Services"). It applies to visitors to our website, to individuals who create an account or sign in, and to the Authorized Users of our business customers.

OptiCloud is an AI-powered cloud intelligence platform. With your authorization, we connect to the cloud platforms you use (for example, Google Cloud, Microsoft Azure, and Amazon Web Services), read your cloud resource, configuration, usage, billing, and sustainability data, and generate cost, performance, and sustainability Recommendations. Where you authorize it, we can also execute optimization changes and automated actions, including suspending or disabling workloads, in your cloud account on your behalf, acting under your delegated authority. You may authorize such an action at the time it is executed or in advance as a standing authorization for a future or automated action, and you control the scope of any automation and can disable it.

Capitalized terms used but not defined in this Privacy Policy have the meanings given in the OptiCloud Terms of Use (the "Terms").

OptiCloud Inc., a Delaware corporation, is the controller of the personal data described in this Privacy Policy that we process for our own purposes (for example, account administration, authentication, billing, and website analytics). Where we process personal data contained in your connected cloud accounts on your behalf and under your instructions, we act as a processor for our business customer, and that processing is governed by the customer agreement and any applicable Data Processing Addendum (the "DPA").

You can reach us about this Privacy Policy or your privacy rights at privacy@opticloud.com, and for general support at support@opticloud.com.

OptiCloud uses two clearly separated permission tiers so that reading your data and changing your data are never the same privilege. You control both, and you can revoke either at any time through your cloud provider or by disconnecting the account in OptiCloud.

For ongoing analysis, OptiCloud reads your cloud data using an application level or service account credential that is limited to reading resource, configuration, usage, and billing data. This credential cannot modify your resources. It is implemented using a least privilege, read only credential appropriate to each cloud platform you connect. This tier is used only to observe and analyze your environment.

When you authorize an optimization action, OptiCloud executes that change under a delegated permission that you, the signed in user, grant at the time of connection. Execution runs under your delegated authority, not under the read only credential described in Section 2.1 (Read Access), and performs only the actions you have authorized, within the scope you configure. You may authorize an action at the time it is executed (point-in-time authorization) or in advance as a standing authorization for a future or automated action, such as an automated Smart Suspend policy or schedule. You control whether automation is enabled and can disable it, and OptiCloud does not act beyond what you have authorized.

We collect the following categories of data. Some of it constitutes personal data (information relating to an identified or identifiable natural person). Much of the cloud technical data does not. Providing this data is not always mandatory, but without it some or all of the Services may not function.

We do not intentionally collect special categories of personal data. Resource names, tags, and similar labels are technical configuration content that you apply and control within your own cloud environment, and you are responsible for the identifiers you place in them. Consistent with Section 4 (Customer Obligations and Warranties) of the Terms, you must not place special categories of personal data or other regulated personal data into free-text fields such as tags and resource names, or into other fields not designed for such data.

Where the GDPR or similar laws apply, we rely on the following legal bases under Article 6.

We process personal data only for the purposes described here or for a compatible purpose, and not in a manner incompatible with those purposes.

OptiCloud's access to and use of information received from Google APIs, including the Google Cloud Platform APIs accessed under the https://www.googleapis.com/auth/cloud-platform scope, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained from Google APIs is used only to provide and improve the user facing features of the OptiCloud platform that are prominent in the OptiCloud user interface, and:

• We do not sell this data, and we do not transfer it to data brokers, resellers, or information resellers.
• We do not use this data for advertising, including retargeting, personalized, or interest based advertising.
• We do not use this data to determine credit worthiness or for lending purposes.
• We do not allow humans to read this data except (a) with your affirmative consent for specific data, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations.
• We do not use Google user data to develop, train, or improve generalized machine learning or artificial intelligence models. Any machine learning models trained on your data are isolated to your own tenant and serve only you, consistent with the Google API Services User Data Policy's allowance for a user's personalized model for the appropriate use case, and we do not permit our AI model providers to use your data to train their models.

OptiCloud uses artificial intelligence to analyze your cloud environment and generate Recommendations. To do this, your cloud resource and usage data may be sent to AI model providers acting as our Sub-processors (see Section 7 (How We Share Your Data)) solely to generate results for you (a process known as inference). OptiCloud may use Customer Data to train its own models, including machine learning models and small language models (SLMs), that serve you. OptiCloud maintains strict tenant isolation, separating tenant data at all levels and boundaries, including separate databases, separate catalogs, separate machine learning models, and separate small language models (SLMs), and serving tenant-distinct models. As a result, Customer Data is used to train models solely for your own benefit and is never used to train a model that benefits any other customer or tenant, or any generally available OptiCloud model. Separately, the third-party AI model providers that perform inference do not use your data to train their models. Separately from this analysis, where you authorize it, OptiCloud can also execute optimization changes and automated actions in your cloud environment, within the scope you configure, as described in Section 6.1 (Customer-Authorized Actions).

The Recommendations OptiCloud generates are presented to you for your review. OptiCloud makes changes in your cloud environment only with your authorization, and never on the AI's own initiative beyond what you have authorized. You may authorize an action either at the time it is executed (point-in-time authorization) or in advance as a standing authorization for a future or automated action, such as an automated Smart Suspend policy or schedule that suspends or disables workloads on the terms you configure. You configure and control the scope of any automation, choose whether to enable it, and can disable it at any time, and OptiCloud does not act beyond what you have authorized. You remain responsible for the Recommendations you act on and for the actions and automations you authorize.

Our automated analysis produces Recommendations and scoring about your cloud environment to support your decision making. Where you enable automated actions, such as an automated Smart Suspend policy or schedule, those actions operate only within the parameters you configure and authorize in advance. You determine and control the scope of the automation, choose whether to enable it, and can disable it at any time, and OptiCloud provides these automation features at your direction. These features are directed at operational optimization of your cloud environment, such as suspending or disabling workloads on a schedule you set, and are not used to make decisions that produce legal or similarly significant effects on individuals. Where you would like more information about the logic involved at a general level, or wish to contest a result, you may contact us at privacy@opticloud.com.

When we use AI model providers to generate your Recommendations, we apply strong data-handling controls designed to meet the expectations of security-conscious customers. We apply data minimization to the information sent for inference, sending only the technical cloud data needed to produce your results, and we apply the following controls:

• Tenant-isolated training and no third-party training: any machine learning models and small language models (SLMs) that OptiCloud trains on your data are isolated to your own tenant and serve only you, and are never used to train a model that benefits any other customer or tenant or any generally available OptiCloud model. And, separately, our AI model providers are engaged as Sub-processors under terms that prohibit them from using your data to train their models, consistent with Section 5 (Google API Services Limited Use Disclosure).
• Contractually bound Sub-processors: AI model providers act as our Sub-processors under written confidentiality and data protection terms (see Section 7.1 (Sub-processor Categories and Providers)).
• Encryption: the information sent for inference is encrypted in transit and at rest, consistent with Section 9 (How We Protect Your Data (Security Measures)).
• Per-tenant isolation: each customer's data is logically isolated from other customers.
• Customer-authorized actions: the AI produces analysis and Recommendations, and OptiCloud executes changes in your cloud environment only as actions you authorize, whether at the time of execution or in advance as a standing authorization, and within the scope you configure, as described in Section 6.1 (Customer-Authorized Actions).

We send only the technical cloud data needed to produce your results. We do not send your authentication and security data (for example, one time passcodes, IP address and approximate location, and device and browser information) to AI providers, and we do not send end-customer application content or payment data to them. Resource names, resource tags, and similar labels are technical configuration content that the customer applies and controls within its own cloud environment, not personal data that OptiCloud collects about individuals. Any identifiers present in that content are those the customer itself has placed into fields it controls, and the customer can minimize what is processed by keeping identifiers out of resource names, tags, and other free-text fields. Consistent with Section 3 (Categories of Personal Data We Collect and Their Sources) above and Section 4 (Customer Obligations and Warranties) of the Terms, the customer is responsible for the content it places in those fields and agrees not to place special categories of personal data or other regulated personal data into fields not designed for such data. OptiCloud processes this content only as part of Customer Data, at the customer's direction and on the customer's documented instructions, solely to provide the Services, and not for advertising or any incompatible purpose.

We do not sell your personal data. We share data only as follows:

• With Sub-processors that help us operate the Services, under contractual confidentiality and data protection obligations (see Section 7.1 (Sub-processor Categories and Providers)).
• With your consent or at your direction, including when you authorize an action that we execute in your cloud account.
• As required by law, legal process, or to protect the rights, safety, and security of OptiCloud, our users, or the public.
• In connection with a merger, acquisition, or sale of assets, subject to the protections described in this Privacy Policy and, for data received from Google APIs, with your prior consent as required by the Google API Services User Data Policy.

We engage the following categories of Sub-processors, and the named providers within each, to process data on our behalf:

• Cloud infrastructure and platform services (Microsoft Azure), for hosting and related platform services.
• Data analytics and processing (Databricks).
• AI model providers for inference, used to generate Recommendations and analysis. Your data is sent to these third-party providers only to generate results for you, and these providers do not use your data to train their models.
• Transactional email delivery, used to send sign-in codes and service messages.

The specific providers within each category are identified in our Sub-processor list, which we make available on request.

We maintain contractual data protection commitments with our Sub-processors and will make an up to date list of Sub-processors available on request.

OptiCloud may process and store data in countries other than your country of residence, which may have different data protection laws. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on an appropriate transfer mechanism, which may include the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where applicable), reliance on an adequacy decision, or the EU-US Data Privacy Framework and its UK and Swiss extensions where a recipient is certified.

OptiCloud is designed to host and process personal data within regions that apply strict data-governance rules, in order to meet customers' data-residency requirements, for example within the European Union, Canada, and similar jurisdictions.

For customers on sovereign or region isolated deployments, data is processed and stored within the agreed deployment boundary, and additional residency commitments may apply under the customer agreement. In addition, OptiCloud offers a deployment option under which OptiCloud deploys its stack within the Customer's own cloud environment subject to OptiCloud's security lockout, so that Customer Data and its processing remain within the Customer's own cloud environment. This deployment option is described further in Section 8.5 (Protection of OptiCloud Intellectual Property and Security Lockout) of the Terms.

We implement technical, organizational, and administrative measures designed to protect your data from unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption of cloud credentials and secrets using industry standard encryption (AES-256).
• Encryption of data in transit and at rest.
• Logical isolation of each customer's data from other customers (per-tenant isolation).
• Authentication of users before access is granted, and access controls limiting internal access.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your data using measures appropriate to its sensitivity.

We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Services, and thereafter as required for our legitimate business needs or legal obligations. In general:

• Cloud resource, configuration, usage, billing, and sustainability data is retained for the duration of your connection and use of the Services, and is deleted or de-identified after termination within the window described in your customer agreement.
• Account and contact data is retained for the life of your account and for a limited period afterward.
• Login and security data is retained for a limited period appropriate to fraud prevention and security.

We delete or de-identify data when it is no longer necessary, upon valid request, or upon termination of the Services, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access your personal data, to correct inaccurate data, to erase data, to restrict or object to certain processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Where OptiCloud processes personal data on behalf of a business customer (data in your connected cloud accounts), we will refer your request to that customer and assist them in responding, as the customer directs the processing.

If you are a California resident, you have the right to know what personal information we collect, use, and disclose, to access and delete your personal information, to correct inaccurate personal information, and to opt out of the sale or sharing of personal information. You also have the right not to receive discriminatory treatment for exercising these rights.

11.2.1 Categories of personal information collected and disclosed. In the preceding twelve months, we have collected the following statutory categories of personal information: identifiers (such as name, email address, phone number, IP address, and account identifiers), internet or other electronic network activity information (such as login and device information), geolocation data (approximate location derived from IP address), commercial information (such as billing and subscription records), and professional or employment related information (to the extent an Authorized User's business role is provided). We collect this information from you, from your device, and from the cloud platforms you authorize us to connect. We disclose these categories to the Sub-processor categories listed in Section 7.1 (Sub-processor Categories and Providers) for the business purposes described in this Privacy Policy.

11.2.2 No sale or sharing. We do not sell your personal information, and we do not share it for cross context behavioral advertising, as those terms are defined under the CCPA and CPRA.

11.2.3 Do Not Sell or Share My Personal Information / Your Privacy Choices. Because we do not sell or share personal information, no opt out is necessary to stop such activity. We nonetheless honor opt out preference signals, including the Global Privacy Control (GPC), transmitted by your browser or device, and treat a valid signal as a request to opt out of any sale or sharing for the browser or device from which it is sent. To exercise any California right, contact us at privacy@opticloud.com.

To exercise any of these rights, contact us at privacy@opticloud.com. We will verify your request as required by applicable law and respond within the timeframes the law provides. You may use an authorized agent where the law permits. We will not discriminate against you for exercising your rights.

Our website uses cookies and similar technologies that are strictly necessary to operate the site and to keep you signed in, and a limited set of analytics technologies to understand and improve site performance. We do not use cookies for advertising or cross context behavioral advertising. Where required, we obtain consent for non-essential cookies and honor browser based opt out signals, including the Global Privacy Control. You can control cookies through your browser settings, though disabling some cookies may affect site functionality.

The Services are intended for businesses and their Authorized Users and are not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us personal data, contact us at privacy@opticloud.com and we will delete it.

We maintain procedures to detect, investigate, and respond to security incidents. In the event of a personal data breach affecting your data, we will notify affected customers and, where required, the relevant supervisory authorities and data subjects, without undue delay and consistent with our legal obligations and our customer agreements.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Significant changes will be communicated by email or through a notice on the Services. The "Last Updated" date at the top of this policy indicates when it was last revised. Your continued use of the Services after an update takes effect constitutes acceptance of the revised policy, to the extent permitted by law.

For questions about this Privacy Policy or our data practices, or to exercise your rights, contact us at:

• Privacy and data subject rights: privacy@opticloud.com
• Support: support@opticloud.com

For disputes relating to the Services, the governing law and dispute-resolution provisions of the Terms apply. This Privacy Policy addresses your privacy rights, including your right to lodge a complaint with a supervisory authority under Section 11.1 (Rights under the GDPR and UK GDPR) and your rights under the CCPA and CPRA under Section 11.2 (Rights under the CCPA and CPRA), and does not itself create a separate general dispute-resolution mechanism.

OptiCloud Inc., a Delaware corporation.