Privacy & Cookie Policy

Effective Date: February 15, 2026
Last Updated: February 15, 2026

1. Introduction

Nublou ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website (nublou.io) and use our Cloud P&L platform (the "Services").

This policy applies to:

  • Website visitors to nublou.io
  • Product users who deploy and use Nublou via Azure Marketplace

By accessing our website or using our Services, you acknowledge that you have read and understood this Privacy Policy.

If you have questions or concerns, please contact us at privacy@nublou.com.

2. Information We Collect

2.1 Website Visitors

When you visit our website, we collect limited information to understand how people use our site and to improve your experience.

Analytics

We use two privacy-friendly analytics services, neither of which uses cookies or collects personally identifiable information (PII):

  • Plausible Analytics: Collects anonymous, aggregated traffic data including pages visited, referral sources, general location (country/region), device type, browser, and session duration. Plausible does not use cookies, does not collect PII, and all data is aggregated. All data is processed on servers in the European Union. Plausible data policy

  • Microsoft Clarity: Collects behavioral interaction data including click patterns, scroll depth, and mouse movements to generate heatmaps and per-page session recordings. Clarity is configured in cookieless mode on our site — it does not set any cookies on your device, does not collect PII, and does not track you across pages or visits. Microsoft Clarity privacy

Because neither service uses cookies or collects personal data, no cookie consent banner is required on our website.

Contact forms and demo requests

If you submit a contact form or request a demo, we collect:

  • Name
  • Email address
  • Company name
  • Role/title
  • Cloud platforms in use (optional)
  • Message or additional details you provide

This information is used solely to respond to your inquiry and is not shared with third parties except as necessary to process your request (e.g., scheduling tools).

2.2 Product Users (Nublou Application)

Nublou is deployed as an Azure Marketplace managed application into your Azure subscription. This means the vast majority of your data — including all cloud billing, usage, and business configuration data — remains in your Azure tenant and is not collected or stored by Nublou's vendor systems.

We collect minimal operational data necessary to provide and support the Services:

a. Deployment and provisioning metadata

  • Azure subscription ID where the application is deployed
  • User UUID (unique identifier) of the user who initiated deployment
  • We do not collect or store email addresses, names, or other personal identifiers of deploying users.

This data is used for:

  • Initial application setup and administrator functionality
  • Operational support and troubleshooting

b. Support contact information

  • After you log in to the application, we may ask you to provide optional support contact details (name, email, phone) so we can reach you regarding service issues, updates, and alerts.
  • Providing this information is voluntary; you control whether and when to share it.

c. Billing and usage telemetry

  • We collect aggregated, non-specific billing metrics through the Azure Marketplace for licensing and billing purposes. For example:
    • We track usage in "buckets" (e.g., customer falls within the "0–5 million" or "5–10 million" spend range) rather than exact cost amounts.
    • This data is anonymized and does not contain identifiable customer business information or detailed cost figures.

d. SKU classification data

  • Nublou may collect SKU identifiers (service and resource type names) that we have not previously encountered to improve our classification model (e.g., to categorize whether a SKU is compute, database, storage, etc.).
  • We do not collect usage volumes, cost amounts, or customer-specific context for these SKUs — only the SKU identifier itself for classification purposes.

e. Licensing and operational heartbeat

  • The Nublou processing engine periodically sends a lightweight "heartbeat" signal back to our licensing system to:
    • Verify the application license is active
    • Report high-level operational status
  • No personally identifiable information or confidential business data is transmitted as part of this signal.

f. Support and administrative access

  • As a managed application provider, Nublou has the technical ability to access the Azure resource group where the application is deployed for support, maintenance, and updates.
  • We do not access customer data or log into the system without explicit customer permission or request. Any access is logged and conducted only for authorized support purposes.

2.3 User Authentication and Identity

  • User authentication is handled entirely by Microsoft Entra ID (Azure AD), not by Nublou.
  • Nublou does not store user passwords, session tokens, or persistent identity information.
  • We receive only the minimal identity claims necessary for authorization (e.g., user roles assigned by your Entra ID administrators).

3. Cookies and Tracking Technologies

3.1 Our approach

Nublou's website is designed to respect your privacy by default. We do not use cookies on nublou.io.

| Service | Purpose | Cookies? | PII Collected? | |---------|---------|----------|----------------| | Plausible Analytics | Anonymous traffic analytics (page views, referrers, device/browser) | None | No | | Microsoft Clarity | Per-page heatmaps and session recordings (cookieless mode) | None | No |

3.2 No cookie banner required

Because we do not set any cookies — first-party or third-party — and do not collect personally identifiable information through our analytics tools, our website does not require a cookie consent banner under GDPR, ePrivacy Directive, or CCPA/CPRA.

3.3 Third-party cookies

We do not use advertising, social media, retargeting, or marketing cookies or trackers on nublou.io.

3.4 Browser controls

Since we do not use cookies, no browser-level cookie management is needed for our site. Standard browser privacy settings will not affect your experience on nublou.io.

4. How We Use Your Information

4.1 Website visitors

  • To understand how visitors find and use our website (aggregated, anonymous analytics)
  • To respond to inquiries, demo requests, and support questions
  • To send you information you have requested (e.g., security documents, product updates)

4.2 Product users

  • To provision, deploy, and maintain the Nublou application in your Azure environment
  • To provide customer support and troubleshooting
  • To improve the Services and develop new features (using anonymized, aggregated data)
  • To fulfill billing and licensing requirements via Azure Marketplace
  • To send important operational communications (service updates, security notices, billing information)

We do not use your information for:

  • Selling or sharing your personal data with third parties for their marketing purposes
  • Behavioral advertising or profiling
  • Cross-selling unrelated products

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

5.1 Service providers

We may share information with trusted third-party service providers who assist us in operating our website and Services:

  • Microsoft Azure — infrastructure and platform services (your application data resides in your Azure tenant, not ours)
  • Plausible Analytics — anonymous website traffic analytics (EU-hosted)
  • Microsoft Clarity — anonymous behavioral analytics (cookieless mode)
  • Email and communication tools — for responding to inquiries and support requests
  • Payment processors — for billing via Azure Marketplace

All service providers are bound by confidentiality obligations and are prohibited from using your information for any purpose other than providing services to us.

5.2 Legal obligations

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, regulatory inquiries).

5.3 Business transfers

If Nublou is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or use of your personal information.

6. Data Retention

  • Website analytics data: Plausible and Clarity retain aggregated, anonymous data according to their respective retention policies. No personal data is retained by either service.
  • Contact form and demo request data: Retained for as long as necessary to respond to your inquiry and maintain a record of our communications, typically up to 3 years.
  • Product operational data: Deployment metadata, support contacts, and telemetry data are retained for the duration of your subscription plus 30 days post-termination, unless you request earlier deletion or unless we are required to retain it for legal or regulatory reasons.

You may request deletion of your personal information at any time by contacting us at privacy@nublou.com.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

7.1 Rights under GDPR (EU/EEA/UK)

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Restriction: Request that we limit how we use your data.
  • Portability: Request a copy of your data in a structured, machine-readable format.
  • Objection: Object to our processing of your data for certain purposes.
  • Withdraw consent: Where we rely on consent, you may withdraw it at any time.

7.2 Rights under CCPA/CPRA (California)

California residents have the right to:

  • Know what personal information we collect, use, and share
  • Request deletion of personal information
  • Opt out of the "sale" or "sharing" of personal information (Note: Nublou does not sell or share personal information)
  • Not be discriminated against for exercising these rights

7.3 How to exercise your rights

To exercise any of these rights, please contact us at privacy@nublou.com. We will respond to your request within 30 days (or as required by applicable law).

8. Security

We take the security of your information seriously and implement appropriate technical and organizational measures to protect it, including:

  • Encryption: Data in transit is encrypted using TLS 1.2 or higher. Data at rest (in your Azure tenant) is encrypted using Azure platform-managed AES-256 encryption.
  • Access controls: Access to systems and data is restricted to authorized personnel only, using role-based access control (RBAC) and multi-factor authentication (MFA).
  • No local credentials: User authentication is handled by Microsoft Entra ID; Nublou does not store passwords or tokens.
  • Monitoring: We monitor our systems for security incidents and vulnerabilities.

For more details on our security posture, please see our Security & Trust page or request our Application Security Posture & Data Handling Overview document.

9. International Data Transfers

9.1 Website data

Plausible Analytics stores all data on servers located in the European Union and does not transfer data outside the EU. Microsoft Clarity processes anonymous behavioral data globally; no personal data is involved in cookieless mode.

9.2 Product data

Because Nublou is deployed into your Azure subscription, your application data resides in the Azure region you select. Any data that Nublou's vendor environment processes (e.g., deployment metadata, telemetry) is stored in our Azure environment (currently hosted in [specify region, e.g., US or EU]).

If data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or reliance on the recipient's participation in a recognized adequacy framework.

10. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@nublou.com, and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes, we will:

  • Update the "Last Updated" date at the top of this policy
  • Notify you via email (if you have provided your email address) or by posting a prominent notice on our website

We encourage you to review this policy periodically.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Nublou
Email: privacy@nublou.com
Subject line: [Privacy Inquiry]

For security-related questions, you may also contact: security@nublou.com

Last updated: February 15, 2026