Privacy Policy

Whizzy Geeks Internet Services Private Limited ("WhizzyGeeks", "we", "us", "our") operates Kostrix and the website at https://www.kostrix.com. This policy covers personal data we process through the website, the Kostrix application, our e-mail and our billing.

For the account, contact, billing and security data described in clause 2, we decide why and how it is processed: we are its controller under the General Data Protection Regulation and the United Kingdom General Data Protection Regulation, its Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and a business under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

For personal data that happens to be contained in the data the service reads from your AWS accounts ("Customer Data", as the Terms of Service define it), your organisation is the controller or Data Fiduciary and we process it on your behalf, as your processor or service provider, only to provide the service. Clause 25 of the Terms of Service and the Data Processing Addendum govern that processing, and a request about it is best sent to your organisation first; we will help it respond.

This policy forms part of, and is read with, the Terms of Service and the Disclaimer. Where this policy gives you more protection over your personal data than the Terms, this policy applies.

Account data, which you give us when you sign up or are invited:

• your name and work e-mail address, and the role an administrator gives you;
• your telephone number and its country code, if you give one - it is optional on every form, is never used to sign you in, and is used only to contact you about your account, your billing or a support request;
• your password and the answer to your secret question, which we store only as slow, salted one-way hashes - we cannot read either back - and which secret question you chose;
• your multi-factor authentication settings, and the one-time codes we send you by e-mail;
• the plan you chose, and your settings and preferences in the application.

Acceptance, security and activity records, which the service creates as you use it:

• which version of the Terms of Service, the Disclaimer and this policy you accepted, when, and from which network (IP) address;
• sign-in attempts, lockouts, password and security changes, and an audit log of actions taken in your account, each with the time and the network address;
• technical data our servers and our hosting provider log with every request, such as IP address, browser user agent, the page requested and the time.

Billing data:

• your billing country, and where you give them, your billing name, address and GST or tax registration number;
• invoices, the amounts charged and their status, and the customer, subscription, mandate and payment identifiers our payment processor returns to us;
• we never receive, store or see your card number, CVV or bank credentials: they are entered on, and held by, our payment processor.

Data read from the AWS accounts you connect (Customer Data). The service reads configuration, inventory, tags, metrics, cost and usage, and commitment data through the IAM policy published on our security page. Most of it is not personal data, but some of it can be, for example:

• the AWS account id and alias, and names or tags on resources that identify a person;
• IAM user and role names, and, where a credential report already exists, each IAM user's key age, multi-factor status and last sign-in;
• CloudTrail management-event history, which records which IAM principal called which AWS API, when, and from which IP address;
• S3 object keys (names) and sizes - never object contents;
• the role ARN and external id you give us to connect, or, if you choose the access-key method, a read-only access key, which we encrypt before storing it.

Communications: what you write to us through the chat box or the support form on the website or in the application, through the contact form or by e-mail, with the name and e-mail address you give, and our replies.

Website data: the website asks our server which country your request came from, as our content delivery network (Amazon CloudFront) reports it, to quote prices in your currency and to decide whether to ask for your consent before using Google Analytics; that country is not stored against you. The website remembers your light or dark theme and your cookie choice, and, where Google Analytics runs, Google collects the usage data that clause 12 describes.

We do not ask for, and you should not give us, special-category or sensitive personal data (such as health, biometric, financial-account, religious or political data, or data about children).

We use personal data for the following purposes, each on the lawful basis stated. Where the DPDP Act applies, we process your personal data on the consent you give by ticking the box at sign-up, which names the processing it covers, or for a legitimate use recognised by section 7 of that Act (such as a purpose for which you voluntarily provided the data, or compliance with law); where the GDPR or UK GDPR applies, the basis is as follows:

• to create and run your account, authenticate you, provide the service, read your connected AWS accounts and produce findings, estimates and reports - necessary to perform our contract with you (GDPR art. 6(1)(b));
• to bill you, issue invoices and keep accounting and tax records - necessary to perform the contract and to comply with legal obligations (art. 6(1)(b) and (c));
• to keep the service and your account secure, detect and prevent fraud, abuse and unauthorised access, lock an account after repeated failed attempts, and keep audit logs - our legitimate interest in a secure service and yours in a secure account (art. 6(1)(f)), and where the law requires it, a legal obligation;
• to send you service e-mail - verification and sign-in codes, security alerts, billing notices, notice of a change to our terms, and replies to you - necessary to perform the contract (art. 6(1)(b));
• to understand and improve the service using aggregated and de-identified statistics that do not identify you, your organisation or any AWS resource - our legitimate interest (art. 6(1)(f));
• to understand how visitors find and use the website, using Google Analytics as clause 12 describes - in the European Economic Area, the United Kingdom and Switzerland only on your consent (art. 6(1)(a)), and elsewhere on our legitimate interest in understanding how our website is used (art. 6(1)(f)), to which you may object at any time by turning it off;
• to comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims - legal obligation and legitimate interest (art. 6(1)(c) and (f)).

Where we rely on consent, you may withdraw it at any time, as easily as you gave it: consent to analytics from Cookie settings at the foot of every page of the website, and any other consent by writing to us; withdrawal does not affect processing before it, and if the consent was needed for the service to run, the service may stop for your account. Where we rely on legitimate interests, you may object, as clause 8 explains.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not use it to make decisions based solely on automated processing that produce legal or similarly significant effects on you. An automatic lock after repeated failed sign-ins, or a plan limit, is a security or contractual measure that you can ask a person to review by writing to us.

We share personal data only with the service providers (sub-processors) we use to run the service, under written contracts that require them to protect it and use it only on our instructions, and as set out below. Our sub-processors at the date of this policy are:

• Amazon Web Services, Inc. and its affiliates - hosting, compute, storage, databases, content delivery and logging for the website and the application;
• Amazon Simple Email Service (part of Amazon Web Services) - delivery of the e-mail we send you;
• Razorpay Software Private Limited (India) - payment processing, card and mandate handling, and subscription billing;
• AWS Marketplace (Amazon Web Services) - only if you subscribe to the service through it, for ordering, metering and billing;
• Google LLC (United States) and its affiliates - Google Analytics on the website, as clause 12 describes; it is never loaded in the application;
• Slack Technologies, LLC (United States) - the workspace our team uses to read and answer support conversations: a message you send through the chat box, the support form or to our support address is copied there with the name and e-mail address you give;
• Zoho Corporation and its affiliates (Zoho's United States data centre) - e-mail hosting for our team's mailbox, which receives copies of support e-mail and the notices the service sends us when an account is created, verified, connected to AWS or closed.

We will list a change of sub-processor on this page before it takes effect. We may also disclose personal data to our professional advisers under a duty of confidence; to a court, regulator, law-enforcement or other public authority where the law requires it or where it is necessary to protect our rights, our users or the public; and to a successor or acquirer if all or part of the business of Whizzy Geeks Internet Services Private Limited is reorganised, merged or sold, subject to this policy.

The service is operated from India. It is hosted by Amazon Web Services, currently in its US East (N. Virginia) region in the United States, and our personnel in India access it to provide and support the service. Our sub-processors may process data in other countries in which they operate. Your personal data is therefore transferred to, stored in and accessed from countries other than your own, which may not have the same data-protection laws.

Where the GDPR or UK GDPR applies to a transfer out of the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on an adequacy decision that covers the recipient (such as the EU-US Data Privacy Framework for a participating United States company) or, where there is none, on the European Commission's standard contractual clauses, with the United Kingdom addendum where relevant, together with the safeguards described in clause 7. A copy of the relevant safeguards is available on request.

Where the DPDP Act applies, we transfer personal data outside India only to countries to which the Government of India has not restricted transfer under section 16 of that Act.

We keep personal data only for as long as we need it for the purposes in clause 3, and then delete or anonymise it:

• a registration whose e-mail address is not verified is deleted automatically after twenty-four hours;
• account data, settings and the data read from your AWS accounts are kept for as long as your account is open, and deleted within ninety days after the account is closed or after you ask us to delete it, except as set out below;
• the role ARN, external id or encrypted access key for an AWS account are deleted when you remove that account from the service or close your account - revoke the role or key in AWS as well, which takes effect at once;
• activity and audit logs, including sign-in and security records, are kept for thirteen months and then deleted automatically;
• invoices, payment records and the accounting records they support are kept for as long as tax and company law requires - in India, at least eight years under section 128 of the Companies Act, 2013, and the period required under the Goods and Services Tax laws;
• the record of which version of the Terms, the Disclaimer and this policy you accepted is kept for as long as your account is open and afterwards for the period in which a claim about the agreement could be brought;
• Google Analytics keeps the usage data that clause 12 describes for no longer than fourteen months;
• messages you send us are kept for up to twenty-four months after the conversation ends, unless they form part of a record listed above.

We may keep data for longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim, and only for that purpose. Deleted data may persist in backups until those expire on their normal cycle, and is not used in the meantime.

We use reasonable security safeguards, including encryption in transit and at rest, one-way hashing of passwords and secret answers, encryption of any stored AWS access key under a separately held key, multi-factor authentication, rate limiting and lockout on sign-in, least-privilege read-only access to your AWS accounts, network isolation and audit logging. Clause 11 of the Terms of Service describes these safeguards and their limits: no system is perfectly secure.

If a personal data breach occurs, we will notify you, the Data Protection Board of India and any other competent supervisory authority as and within the time the applicable law requires - for example, under the GDPR, the supervisory authority without undue delay and where feasible within seventy-two hours - and will tell you what happened, what data was affected, what we are doing about it and what you can do.

Depending on where you are, you have some or all of the following rights. We honour them wherever you are, to the extent the law of your place allows and subject to the exceptions it provides.

In India, under the DPDP Act, you may:

• obtain a summary of the personal data we process about you and the processing activities, and the identities of the persons with whom it has been shared;
• have inaccurate or misleading data corrected, incomplete data completed and data updated;
• have data erased once it is no longer necessary for the purpose for which it was collected, unless the law requires us to keep it;
• withdraw consent;
• have a grievance redressed by us, as clause 10 describes, before approaching the Data Protection Board of India;
• nominate another individual to exercise your rights in the event of your death or incapacity.

In the European Economic Area and the United Kingdom, under the GDPR and UK GDPR, you may request access to your personal data, its rectification or erasure, the restriction of its processing, and its portability; object to processing based on legitimate interests; withdraw consent at any time; and lodge a complaint with the supervisory authority where you live or work or where an infringement occurred (in the United Kingdom, the Information Commissioner's Office).

In California, under the CCPA as amended by the CPRA, you may request to know the categories and specific pieces of personal information we have collected about you, its sources, the purposes and the categories of third parties to whom it was disclosed; request its deletion and correction; and opt out of its sale or sharing and limit the use of sensitive personal information - though we do not sell or share personal information and do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising any of these rights. You may use an authorised agent, whose authority we may verify. In the preceding twelve months we collected the categories described in clause 2, from you, from your use of the service and from the AWS accounts you connected, for the purposes in clause 3, and disclosed them for a business purpose only to the recipients in clause 4.

Elsewhere - for example under Brazil's Lei Geral de Proteção de Dados, Canada's Personal Information Protection and Electronic Documents Act, Australia's Privacy Act 1988, Singapore's Personal Data Protection Act 2012, Japan's Act on the Protection of Personal Information, South Africa's Protection of Personal Information Act or the laws of other US states - you may have similar rights, and you may exercise them in the same way.

Write to support@kostrix.com, or to contactus@whizzygeeks.com, saying which right you wish to exercise. Much of your account data can also be seen and changed directly in the application's settings.

We will verify your identity before acting on a request, usually by asking you to confirm it from the e-mail address on your account, and will not ask for more information than we need to do that. We respond within the time the applicable law sets - for example, within one month under the GDPR and within forty-five days under the CCPA, each extendable where that law allows - and without charge unless a request is manifestly unfounded or excessive.

If a request concerns Customer Data that we process for your organisation, we will pass it to your organisation and help it respond.

Questions, requests and complaints about personal data may be sent to contactus@whizzygeeks.com. Our Grievance Officer under the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act is Vibhor Agarwal, who can be written to at Whizzy Geeks Internet Services Private Limited, GH-4/32, Meera Bagh Apartment, Block GH-4, SFS Flats, Paschim Vihar, West Delhi, Delhi 110063, India, by e-mail at contactus@whizzygeeks.com, or by telephone on +91-120-4579550; data-protection questions go to the Data Protection Contact at contactus@whizzygeeks.com.

We will acknowledge a grievance within forty-eight hours and will endeavour to resolve it within one month, or sooner where the law requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to the supervisory authority or regulator for data protection where you live.

The service is offered to businesses and is not directed at children. You must be at least eighteen years of age to use it. We do not knowingly collect personal data of anyone under eighteen, or of a person with a disability who has a lawful guardian, and we do not track, monitor behaviour or target advertising at children. If we learn that we have collected such data without the verifiable consent of a parent or lawful guardian that the law requires, we will delete it. If you believe a child has given us personal data, write to us.

The application (every page under /aws-cost-optimizer) sets only cookies it needs to work or that remember a choice you made: kostrix_session, which keeps you signed in; kostrix_account, which remembers which of your linked AWS accounts you are looking at; short-lived cookies that carry a one-time message after a form, or the state of a sign-in with Google or a subscription through AWS Marketplace; and kostrix_theme, described below. Forms are protected against cross-site request forgery by a token tied to your session. None of these is used to track you, and the application loads no analytics, advertising or other third-party scripts.

The website remembers your light or dark theme in a cookie named kostrix_theme, kept for one year, and in your browser's local storage, and remembers your cookie choice in local storage (kostrix-consent) for twelve months, after which it asks again. These remember choices you made and need no consent.

The website uses Google Analytics, a service of Google LLC, to count visits and to see how visitors find and use its pages, so that we can improve them. When it runs, it sets the cookies _ga and _ga_BD3QPKQVZB, which hold a random identifier and expire after two years, and sends Google the address of the page, the page you came from, your browser, device and screen type, an approximate location that Google derives from your IP address, and the time. It runs with Google signals and advertising personalisation turned off, and we do not use it for advertising or to identify you.

Whether Google Analytics runs depends on where you are:

• in the European Economic Area, the United Kingdom, Switzerland, Gibraltar, Guernsey, Jersey and the Isle of Man, it does not load and sets no cookie until you choose Accept in the cookie banner;
• in India, it loads when you visit, as it does elsewhere, until the provisions of the DPDP Act on notice and consent take effect, and from then only after you choose Accept;
• elsewhere, it loads when you visit, on our legitimate interest in understanding how our website is used, and you may turn it off at any time.

To decide which applies, the website asks our server which country your request came from, as Amazon CloudFront reports it, and remembers the answer in your browser until you close the tab; if no answer arrives, the website asks for your consent. You can change your choice at any time from Cookie settings at the foot of every page: choosing Reject stops Google Analytics and deletes its cookies from your browser. You can also block cookies in your browser's settings, or install Google's browser add-on that opts out of Google Analytics.

We may change this policy. Each version has a version number and an effective date. Where a change is material we will give notice by e-mail or in the application at least fifteen days before it takes effect, as clause 17 of the Terms of Service provides, and will ask for your consent again where the law requires it. The current version is at https://www.kostrix.com/privacy, and each earlier version remains available at https://www.kostrix.com/privacy/<version> and is listed there.