Privacy Policy

Overview

Kubeadapt (“we”, “us”) provides Kubernetes cost monitoring and optimization. This policy applies to the Kubeadapt website (kubeadapt.io), the web application, the kubeadapt-agent you install in your cluster, and the optional network agent.

Cluster-wide, the agent can list and watch Kubernetes resources and read usage stats from the kubelet. In the namespace it runs in, a Role lets it manage Jobs and ConfigMaps and read Secrets. It has no permission to update your workloads. The optional network agent runs as a privileged container on each node. Our Security page lists every permission, including those of the optional network agent and auto-upgrader.

Data we collect

The agent sends a structured snapshot of Kubernetes resource metadata on each collection cycle. This is configuration and utilization data about your cluster — not the contents of your workloads.

Cluster resource metadata

• Nodes — capacity and allocatable (CPU, memory, GPU), labels (instance type, zone, region, node pool), taints, conditions, and provider ID (used to derive cloud and region).
• Pods — container list, resource requests and limits, owner references, scheduling status, and QoS class.
• Namespaces — names, labels, and status, used as the boundary for cost attribution.
• Workloads — Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs (replica counts, selectors, template specs, schedules).
• Autoscaling & disruption — HorizontalPodAutoscalers, PodDisruptionBudgets, and VerticalPodAutoscalers (when the VPA API group is present).
• Services & Ingresses — type, IP addresses, ports, rules, and TLS references only — never certificate contents.
• Storage — PersistentVolumes, PersistentVolumeClaims, and StorageClasses (capacity, access modes, provisioner, binding status).
• Scheduling — PriorityClasses, LimitRanges, and ResourceQuotas.
• Cloud-native — Karpenter NodePools (when the Karpenter API group is present).
• Metadata on these resources — names, labels, annotations, container image names, IP addresses, and UIDs.

Utilization metrics

• Live CPU and memory usage per node and pod, read from metrics-server (the metrics.k8s.io API). Actual-vs-requested usage is the core signal for rightsizing.
• GPU device utilization and memory — collected only on GPU nodes where an NVIDIA DCGM exporter is present.

Network traffic metadata (only if you install the network agent)

The eBPF network agent is off by default. If you turn it on, it records, per connection:

• Source and destination IP addresses and ports, the protocol, and bytes sent and received.
• DNS query names.
• TLS server names (SNI).
• HTTP method, route, and status code, read from request and response headers.

It does not record payload bodies. If you do not enable it, none of this is collected.

Account & site data

• Account information (name, work email, organization) and, on paid plans, billing information.
• Messages you send us by email.
• Contact and demo form submissions: your name, work email, company, and message (for a demo request, also your cluster scale, cloud, and preferred time); the IP address and browser user agent the form was sent from, used to block abuse; and how you reached the site: the UTM source, medium, and campaign tags, the referring site (its address without the query string), and the first page you visited.
• Product analytics and error reports from the web application.
• Website analytics on kubeadapt.io, only if you accept them: see Cookies & site analytics.

Data we never collect

By design, the agent collects metadata only. The following are never collected or transmitted:

• Environment variable values, Secret contents, or ConfigMap data.
• Application logs or pod stdout/stderr.
• Request or response bodies, including from the network agent.
• TLS certificate contents or private keys.
• The data your applications process or store.

The agent has no permission to read Secrets outside its own namespace, and it does not read Secret or ConfigMap contents. ReplicaSets are read only to resolve workload ownership and are not sent.

How we use data

• Produce cost monitoring and rightsizing recommendations for the clusters you connect.
• Attribute spend to teams, namespaces, and workloads.
• Reply to contact and demo requests.
• Operate, secure, and improve the platform.
• Manage billing, provide support, and send service-related communications.

We do not sell your data, and we do not use your cluster metadata to train models for other customers.

Legal basis (GDPR)

Where the GDPR applies, we process data under: (a) contract — to deliver the service you signed up for; (b) legitimate interests — to secure and improve the platform, balanced against your rights; and (c) legal obligation — to retain billing records as required by law; and (d) consent — for website analytics on kubeadapt.io, which you can withdraw at any time.

Where data is stored

Cluster data is processed and stored in Germany (EU), on servers run by Hetzner. There is no other region. The agent sends data only over HTTPS. If you turn on Kubeadapt AI summaries, the data each summary is based on is also processed by Anthropic or AWS Bedrock, which may be outside the EU. Some of the other subprocessors listed below also process limited data outside the EU. Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Sharing & subprocessors

We do not sell or rent personal data. We share data only with the subprocessors below, which help us run the service. We may also disclose data where required by law.

• Hetzner — hosting for the application and all cluster data (Germany).
• Clerk — sign-in and account authentication.
• Slack — internal notifications when someone submits the contact or demo form.
• Attio — customer relationship management for contact and demo form submissions.
• PostHog (EU cloud) — product analytics and error tracking in the web application, and website analytics on kubeadapt.io, only if you accept them.
• Amazon Web Services — storage of our service credentials and public hosting of the agent container images.
• Anthropic (Anthropic API) and Amazon Web Services (AWS Bedrock) — the language models that write Kubeadapt AI summaries. Summaries are off by default. If you turn them on, the data each summary is based on is sent to one of these services.

Retention

• We keep cluster data and account data until you ask us to delete them.
• We delete contact and demo form submissions from our database 24 months after we receive them. The copies sent to Slack and Attio are kept until you ask us to delete them.
• To delete your account data, including cluster data, email privacy@kubeadapt.io. We act on every request.
• Billing records are retained for the period required by applicable law.

Security

• Cluster-wide, the cluster agent can list and watch resources and read usage stats from the kubelet. Its write permissions are limited to Jobs and ConfigMaps in its own namespace.
• The agent sends data only over HTTPS and refuses a non-HTTPS endpoint by default.
• The agent authenticates with a per-cluster API key.
• The cluster agent ships as a distroless container image with no shell and runs as a non-root user.
• The optional network agent is off by default. If you turn it on, it runs on each node as a privileged container, as root, with host network and host PID access and a read-only root filesystem.

See our Security page for more detail.

Cookies & site analytics

kubeadapt.io sets no cookies unless you accept analytics. On your first visit a banner asks you to accept or decline. We keep your answer in your browser’s local storage so we do not ask again. The site also reads the theme cookie that the web application sets, to match your light or dark theme.

If you accept, PostHog (EU cloud) loads, sets cookies, and records the pages you view, clicks on calls to action such as the sign-up and demo links, and whether you sent the contact or demo form (not what you wrote). PostHog receives your IP address and browser details with each event. If your browser sends Do Not Track, nothing is recorded. If you decline, PostHog does not load.

We use no advertising cookies and we do not sell tracking data. You can change your choice at any time.

Your rights

Depending on your location (e.g. the EEA, UK, or California), you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to withdraw consent. To exercise any right, contact us using the details below. You also have the right to complain to your local data protection authority.

Children

Kubeadapt is a business product and is not directed to anyone under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated directly.

Contact

Privacy questions: privacy@kubeadapt.io. Send data access, correction, and deletion requests to the same address.