1. Who We Are
OpsGuru is a cloud operations (CloudOps) product offered by Maatara Consulting ("Maatara", "we", "us"). It is available as a hosted service (SaaS) and as software you run in your own environment (on-prem). This policy covers the OpsGuru website, the hosted workspace and the support and licensing services that go with an on-prem installation.
For account, billing and website data, Maatara is the controller (under India's Digital Personal Data Protection Act, 2023, the "Data Fiduciary"). For the data your organisation brings into a workspace ("Customer Data"), your organisation is the controller and Maatara processes it on your behalf under our agreement with you. Legal entity details: Maatara Consulting, 5332 Vista Point Court, Concord, CA 94521.
2. Information We Collect
Account data
- Name, work email, organisation, role and the users and groups you create in your workspace.
- Sign-in details, including identifiers received from your single sign-on provider (for example Okta, Microsoft Entra or Google) over OIDC.
- Billing contact details and plan information. Card payments are handled by our payment provider; we do not store full card numbers.
- Messages you send us, such as support requests and sales enquiries.
Cloud and infrastructure data from connectors and agents
When you connect a cloud account or install an agent, OpsGuru collects operational metadata about your estate, such as:
- Inventory: accounts, subscriptions, projects, hosts, virtual machines, services, tags, owners and how assets relate to each other.
- Configuration and posture: settings checked against frameworks and policies you enable.
- Findings: vulnerabilities, misconfigurations, scan results from the tools you connect, cost and waste items, performance and delivery measurements, AI usage and spend, incidents and data quality check results.
- Cost and usage data from your cloud billing sources.
OpsGuru is designed to work with metadata and results. It does not need the contents of your files, mailboxes or customer databases. Data quality checks return summary results (for example a count or a pass or fail), not the rows they examine. Some metadata, such as a resource owner's name or email tag, can still be personal data, and we treat it that way.
Usage and device data
- Log and security data such as IP address, browser type, timestamps and the actions taken in the workspace (an audit trail).
3. Read-Only Access and Credentials
- Read-only by default. Cloud connectors use read-only roles or keys wherever the provider supports them. Data sources are connected read-only.
- Outbound agents. Agents run inside your network and connect out to the workspace, so you do not need to open inbound access to your environment.
- Vault-held credentials. Credentials you add are encrypted and stored in a server-side vault. They are not displayed again after you save them, and they are retrieved only when a connector, agent or scan needs them. You can rotate or revoke them at any time.
- Changes need you. Features that can change a system, such as remediation or automation, act only within policies you configure and the approvals you set. AI answers point at evidence; a person still reviews anything that changes a system or the spend.
- On-prem. In an on-prem installation, Customer Data and credentials stay in your environment. We receive only what you choose to send us, for example in a support case or for licence checks.
4. Purposes and Legal Bases
We use personal data only for the purposes below. Where the EU or UK GDPR applies, each purpose relies on the legal basis shown.
- Providing the service (creating accounts, running connectors, agents, scans and reports, support): performance of our contract with you or your organisation.
- Keeping the service secure (authentication, abuse prevention, audit logs, incident response): our legitimate interests and, where required, legal obligations.
- Improving the service (understanding feature use and reliability, mostly from aggregated or de-identified data): our legitimate interests.
- Billing, accounting and tax: performance of contract and legal obligations.
- Product news and marketing emails: your consent, or our legitimate interests for existing business contacts. You can opt out at any time.
Under India's DPDP Act, 2023 we process personal data on the basis of your consent or for legitimate uses the Act allows, such as the purpose for which you voluntarily provided the data. For Customer Data, we follow your organisation's instructions.
We do not sell personal data, and we do not use Customer Data for advertising.
5. AI Assistants
AI assistants in OpsGuru answer questions using the workspace data needed for that answer and show the evidence they relied on. If a third-party model provider is used to generate an answer, it acts as our subprocessor under contract and receives only what the request needs. AI output can be wrong, so check it before you act on it.
7. Retention
- Account data is kept while your account is active and for a limited period afterwards to meet legal, tax and accounting duties.
- Customer Data is kept for the life of your subscription and according to the retention settings of each module and your plan (for example, cost history can be kept for up to 18 months). After termination, we delete it or return it within the period set out in our agreement, unless the law requires us to keep it.
- Security and audit logs are kept only as long as needed to protect the service and investigate incidents.
8. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, the credential vault described above, role-based access through Users and Groups, single sign-on, audit logging and least-privilege access for our staff. No system is perfectly secure; if a personal data breach affects you, we will notify you and the relevant authorities as the law requires.
9. International Transfers
Maatara works from the United States and India, and our service providers may process data in other countries. When personal data moves across borders, we use recognised safeguards, such as the European Commission's Standard Contractual Clauses, and we follow any restrictions notified by the Government of India under the DPDP Act. On-prem customers keep Customer Data in the location they choose.
10. Your Rights
Under the GDPR (EU and UK)
You can ask to access, correct or delete your personal data, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can also complain to your local data protection authority.
Under India's Digital Personal Data Protection Act, 2023
You can ask for a summary of the personal data we process and who we share it with, ask us to correct, complete, update or erase it, withdraw consent, nominate another person to exercise your rights if you die or become incapacitated, and use our grievance process. If you are not satisfied with our response, you can approach the Data Protection Board of India.
How to ask
Email info@maatara-consulting.com with the subject "Privacy request". We may need to confirm your identity. If your request concerns Customer Data in a workspace, we will pass it to the organisation that controls that workspace and help them respond.
12. Children
OpsGuru is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to This Policy
We may update this policy as OpsGuru or the law changes. We will post the new version here with a new "Last updated" date and, for material changes, let customers know by email or in the product.
14. Contact
For privacy questions, requests or grievances, email info@maatara-consulting.com. You can also call us on +1 925 334 7756 (USA) or +91 96866 57819 (India). Grievance and privacy contact: info@maatara-consulting.com. Post: Maatara Consulting, 5332 Vista Point Court, Concord, CA 94521.