Privacy Policy
What Jungle Cleaner collects about you and your AWS accounts, why, who else sees it, and how to get it deleted.
Last updated 22 August 2026
Who we are
Jungle Cleaner is operated by WebShaped LDA, a company registered in Portugal under NIPC 514348335, VAT PT514348335, with its registered office at Rua de Moçambique 12, Lisboa 1170-245, Portugal. We are the data controller for the personal data described here.
For anything in this policy, including requests to see or delete your data, email privacy@junglecleaner.com. We are not required to appoint a Data Protection Officer and have not appointed one, so your message reaches the people who run the service.
What we collect
Your account
You sign in with Google or GitHub. We never see or store a password. From your chosen provider we receive and store your email address and your name, along with the identifier that provider uses for you. We do not store your profile picture.
Your AWS accounts
When you connect an AWS account, we store:
- The AWS account ID and any name or environment label you give it.
- The ARN of the read-only IAM role you created for us, and the external ID used to assume it. These let us read your account; they are not credentials to it and cannot be used by anyone else.
What we find when we scan
A scan reads your account's configuration and cost data. We store the results so you can come back to them: resource identifiers (such as a volume or database name), regions, estimated monthly costs and savings, your account's total monthly spend, and the plain-English explanation of each finding.
This is infrastructure metadata, not the contents of your systems. We do not read your databases, your files, your logs or your traffic. What is in your S3 buckets stays unknown to us; we can see that a bucket exists and how much it costs.
Slack
If you connect Slack, we store your workspace id and name, the channel you picked, the incoming webhook URL, and a bot token used only to revoke the install when you disconnect. We post scan summaries and verified-savings notices to that channel on your instruction. We do not read messages, member lists, files, or anything else from Slack.
Billing
If you subscribe, we store your Paddle customer and subscription identifiers, the plan and interval you chose, its status, and when the period ends. We never see or store your card details or billing address — those go directly to Paddle, who are the merchant of record for the sale.
Technical data
- API keys we generate so your AI coding tool can reach the service on your behalf.
- Your approximate country, derived from your IP address by our host, purely to quote prices in the right currency.
- Aggregated usage analytics — which pages get visited, and whether people manage to install the tool. This is collected without cookies and is not tied to you as an individual. See our Cookie Policy.
- Server logs, kept briefly for security and debugging.
Why we are allowed to process it
| What | Why | Legal basis |
|---|---|---|
| Account and sign-in | To give you an account and let you back into it | Performance of a contract |
| AWS connection and scan results | To deliver the thing you signed up for | Performance of a contract |
| Slack workspace and channel | To post the notifications you asked for | Performance of a contract |
| Billing records | To charge you, and to keep the tax records we are obliged to keep | Contract, and legal obligation |
| Security logs and abuse prevention | To keep the service and your data safe | Legitimate interests |
| Aggregated analytics | To understand what works and fix what does not | Legitimate interests |
Where we rely on legitimate interests, we have considered whether it is fair to you. You can object at any time — see your rights.
Automated analysis and AI
After your first scan of a sufficiently large account, we run an automated analysis to look for savings our standard checks would miss. It uses a large language model hosted by Amazon Bedrock, which we operate within EU regions.
What is sent to the model is your AWS account ID, your spend broken down by service and region, and the results of read-only AWS API calls it asks for. Under our agreement with AWS, this data is not used to train any model and is not retained by the model provider.
This produces suggestions, which are reviewed before they ever become a recommendation you see. There is no automated decision-making that produces legal or similarly significant effects for you within the meaning of Article 22 GDPR.
Who else sees your data
We do not sell your data, and we do not share it for anyone else's marketing. We use the following processors to run the service:
| Who | What for | What they get | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Database, background processing, and the AI model behind novel findings | All account, connection and scan data | EU (Ireland), with AI inference confined to EU regions |
| Vercel | Application hosting and privacy-friendly usage analytics | Requests to the site, IP address in transit, aggregated page views | EU and USA |
| Paddle | Payment processing as merchant of record, invoicing and sales tax | Email address, billing address, payment details, purchase history | UK, EU and USA |
| Sign-in, where you choose Google | Your name and email address, released by Google when you consent | EU and USA | |
| GitHub | Sign-in, where you choose GitHub | Your name and email address, released by GitHub when you consent | EU and USA |
We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold, your data would transfer with it, and we would tell you first.
Where your data lives
Your account, connection and scan data is stored in the European Union (AWS Ireland), and the AI analysis is confined to EU regions.
Some of our processors are based outside the EEA or may access data from there. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision, together with the technical measures described in our Security Policy. You can ask us for a copy of the safeguards.
How long we keep it
- Pending connection tokens are deleted automatically one hour after they are created.
- Your account, connected accounts and scan history are kept for as long as you have an account, so you can compare a scan against the last one.
- A Slack install is kept until you disconnect it or delete your account.
- Billing and tax records are kept for as long as Portuguese tax law requires, currently ten years, even after you close your account.
- Diagnostic records from failed savings verification are deleted after 90 days.
When you ask us to delete your account we remove your personal data and your scan history within 30 days, keeping only what the law obliges us to keep.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and get a copy.
- Correct anything inaccurate.
- Delete your data — the "right to be forgotten".
- Restrict or object to how we process it.
- Portability — receive your data in a machine-readable format.
- Withdraw consent, where we relied on it, without affecting past processing.
There is currently no button for this in the app. Email privacy@junglecleaner.com and we will action it within one month, free of charge. We would rather tell you that plainly than imply a self-service flow that does not exist yet.
If you think we have got this wrong, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt. We would appreciate the chance to fix it first.
Children
Jungle Cleaner is a tool for people who run AWS infrastructure and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes
If we change this policy in a way that matters, we will update the date at the top and tell account holders by email before it takes effect.