Privacy policy

Last updated: October 16, 2026

This policy describes the data that FinOps Move2Cloud (the “Service”) processes, why, and how it is protected. It applies to the product's site and to its console. This English version is a translation provided for convenience: in the event of any discrepancy, the French version prevails.

1. Data controller

Move2Cloud, 66 avenue des Champs-Élysées, 75008 Paris, France. For any question about your data, or to exercise your rights: contact@move2cloud.fr.

2. Data processed

• User account: e-mail address, and if you provide them first name, last name and job title. The password is only kept as a hash; the two-factor authentication secret is encrypted.
• Sign-in with Google or Microsoft: if you choose to sign in with one of them, it gives the sign-in service of Move2Cloud accounts the identifier of your account there, your name and your e-mail address; never your password, nor access to your e-mails or files. Their own policies apply to your account with them.
• Organisation: its name, its billing information (company name, address, SIRET and VAT numbers), the e-mail addresses that receive alerts, the composition of the team and the roles.
• Access to cloud providers: the credentials or authorisations you grant the Service. They are encrypted before being saved and are never shown again.
• Cost and inventory data: amounts, services, regions, names of your projects, accounts and resources, usage measurements, recommendations. The Service never reads the content of your resources (files, databases, messages).
• What you create in the Service: budgets, dashboards, reports and exports, support requests.
• Contact or demonstration request: what you enter in the site's forms (e-mail address, phone number if you give it; for a contact request, identity, company and order of magnitude of your cloud spend), to answer you and contact you about the Service.
• Notifications: what the Service tells you in the application (budget, synchronisation, invoice, support, sharing, team), whether you read it, and the subjects you no longer want by e-mail; kept 90 days.
• Logs: sign-ins, significant actions in the organisation, synchronisations and e-mails sent, for security and support.

3. Purposes and legal bases

• Providing the Service (performance of the contract): reading your costs, computing forecasts and recommendations, sending alerts and messages related to your account, answering your requests.
• Securing the Service (legitimate interest): authentication, logging, prevention of abuse.
• Billing (performance of the contract and legal obligation): determining the applicable plan from the total amount of the tracked cloud spend, without its detail; issuing and keeping invoices.

Your data is neither sold nor used for advertising purposes.

4. Artificial intelligence

Some functions (analysis of invoices, composition of a dashboard from a sentence) call on a language model supplied by a specialised provider. The Service sends it cost data: amounts, services, resource types, regions, recommendations, budgets. Before sending, it removes account numbers, e-mail addresses, and the names of your organisation, of your cloud accounts and of the members of your team. The names of your projects and applications, as well as the sentence you enter to describe a dashboard, may be transmitted. No access credential is.

5. Recipients and processors

Your data is accessible to the members of your organisation, according to their role, and to the people at Move2Cloud in charge of operating the Service. The administration of the platform displays neither your costs nor your credentials. The following providers are involved:

• Scalingo (France, osc-fr1 region): hosting of the application, of its database and of its backups, as well as of the sign-in service of Move2Cloud accounts (identity and authentication of users).
• Scaleway (France, Paris region): sending of the Service's e-mails, storage of the reports and exports you generate and of the files joined to support requests, and a backup copy of the database.
• Mollie (Netherlands): online payment of invoices, when it is offered (bank card, SEPA direct debit, PayPal). Mollie receives the information needed for the payment; Move2Cloud keeps neither card numbers nor IBANs.
• A language-model provider (United States): artificial intelligence functions, within the limits described above.

The cloud providers you connect (OVHcloud, Scalingo, Scaleway, AWS, Microsoft Azure, Google Cloud) are queried with the access you have granted; the Service sends them none of your data. No client data is kept at AWS: Move2Cloud only holds there the CloudFormation template made available to AWS clients and the technical identity that assumes, read-only, the role they create in their account.

Transfers outside the European Union. Only the artificial intelligence functions involve a transfer, to the language-model provider established in the United States. This transfer is governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), incorporated into the data processing agreement concluded with this provider; a copy can be sent to you on request. The data sent is limited and pseudonymised as described in section 4.

6. Retention periods

• The data of your account and of your organisation is kept as long as the account exists.
• Removing a cloud account deletes its credentials and the costs read with it. Deleting the organisation erases its access, its credentials, its cost history, its budgets, its alerts and its generated files.
• Backups of the database are made regularly by the host: deleted data may remain in them until they expire.
• Invoices are kept for the period required by law (ten years).

7. Security

• Encrypted exchanges (HTTPS); provider credentials encrypted in the database (AES-256-GCM); passwords kept as hashes.
• Two-factor authentication available to each user, and which the owner of the organisation can require.
• Data partitioned by organisation; read-only access to providers.

8. Cookies

The Service only uses cookies necessary for its operation: the sign-in session, the two-factor authentication step, the current organisation and the language chosen. Your choice of display theme is kept in your browser. There is no advertising cookie and no audience measurement tool.

9. Your rights

You have a right of access, rectification, erasure, restriction, objection and portability over the data that concerns you. You can exercise them by writing to contact@move2cloud.fr. If the answer does not satisfy you, you can refer the matter to the CNIL (cnil.fr), the French data protection authority.

10. Changes to this policy

This policy changes with the Service. The version in force is the one published at this address, with its date of update.