Privacy Policy

Read the OhChimp Privacy Policy, including how infrastructure metadata, credentials, usage data, and account information are protected.

1. Introduction

OhChimp ("we", "us", or "our") operates the OhChimp platform, an AI-powered infrastructure cost optimization service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Service").

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and organization details. If you sign up through a third-party authentication provider, we receive basic profile information from that provider.

Infrastructure Metadata

To provide cost optimization recommendations, OhChimp connects to the systems you choose to link: cloud and hosting providers, Kubernetes clusters, databases and data platforms (including caches, search clusters, data warehouses, and streaming services), observability and monitoring tools, CDN and edge networks, code repositories and CI/CD systems, AI provider accounts, and other developer and SaaS platforms. We collect metadata and aggregated metrics only, such as resource configurations, utilization summaries, query and performance statistics, and cost data. We do not store your application data, secrets, or the contents of your workloads.

Integration Credentials

To access your infrastructure, you provide credentials such as API keys, service account keys, kubeconfigs, or access tokens. All credentials are encrypted at rest using PBKDF2 key derivation (100,000 iterations) with per-organization encryption keys before being stored.

Usage Data

We collect information about how you interact with the Service, including chat conversations with the AI assistant, workflow configurations, and audit logs of actions taken within the platform.

Technical Data

We automatically collect standard technical data such as IP addresses, browser type, device information, and access times when you use the Service.

3. How We Use Your Information

• Provide, operate, and improve the Service, including generating AI-powered infrastructure recommendations
• Analyze your infrastructure metadata to identify cost optimization opportunities
• Process your natural language queries through our AI systems
• Manage your account, organization, and team access
• Send service-related communications, including security alerts and usage notifications
• Maintain audit logs for security and compliance
• Monitor and improve the performance and reliability of the Service

4. Third-Party Services

To deliver the Service, we share data with the following categories of third-party providers:

• AI/LLM Providers: Your queries and relevant infrastructure metadata may be sent to large language model providers (such as OpenAI and Anthropic) to generate analysis and recommendations. We send only the minimum context necessary and do not share your credentials or raw infrastructure data.
• Authentication Providers: We use Auth0 for identity management and authentication.
• Cloud Infrastructure Providers: We connect to your configured cloud providers using the credentials you supply, solely to retrieve metadata for analysis.
• Analytics: We may use product analytics tools to understand how users interact with the Service and improve the experience.

5. Data Security

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit (TLS) and at rest
• Integration credentials are encrypted with per-organization keys using PBKDF2 key derivation
• Multi-tenant data isolation through PostgreSQL Row Level Security
• Role-based access control (owner, editor, viewer) within organizations
• Comprehensive audit logging of all platform actions
• SOC 2 Type II compliant infrastructure and processes

6. Data Retention

We retain your account and organization data for as long as your account is active. Infrastructure metadata and analysis results are retained for the duration of your subscription to enable historical comparisons and trend analysis. Chat conversation history is retained for the lifetime of your organization unless you delete it. When you delete your account or organization, we remove your data within 30 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal information
• Export your data in a portable format
• Object to or restrict certain processing of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at privacy@ohchimp.com.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for any such transfers, including standard contractual clauses where required.

9. Children's Privacy

The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at privacy@ohchimp.com.