Privacy Policy.

Last updated: 2 September 2026

Who we are

LLM CFO, Inc. ("we", "us") provides managed AI cost optimization services, and is the data controller for the personal data described here. This policy covers llmcfo.com and any data handled during a customer engagement. Reach us at hello@llmcfo.com.

What we collect on this website

• Analytics — after you consent, we use Google Analytics 4 to collect anonymized page-view data (page URL, referrer, approximate location, browser, device type; IP addresses are anonymized by GA4), and Microsoft Clarity for product usage insights including heatmaps and session replay. Clarity masks sensitive content such as form inputs by default and is processed by Microsoft under the Microsoft Privacy Statement. Neither loads until you accept; decline or clear the cookie to opt out.
• Email correspondence — when you email us at hello@llmcfo.com, we keep that thread to reply and follow up.
• We do not use marketing cookies or retargeting pixels.

What we collect during an engagement

• Provider invoices & usage exports from your OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, Azure OpenAI accounts (or equivalent gateway logs from LiteLLM, Helicone, Langfuse).
• Aggregated metadata — token counts, model names, latencies, request volumes — needed to baseline and reconcile spend.
• We do not store prompt content, model output, or end-user PII in our systems by default. If a specific optimization requires sampling prompts, we ask explicit per-feature approval first.

How we use it

• Run audits, build optimization plans, produce monthly reconciliation statements.
• Diagnose anomalies in your bill (cost spikes, token leaks, mis-routed traffic).
• We never sell, share with advertisers, or use your data to train any model.

Legal basis

• Analytics and session replay — your consent (GDPR Art. 6(1)(a)), given through the cookie banner and withdrawable at any time.
• Email correspondence and running an engagement — performance of a contract, or steps taken at your request before entering one (Art. 6(1)(b)).
• Security, fraud prevention, and keeping records we are required to keep — our legitimate interests and our legal obligations (Art. 6(1)(f) and (c)).

Where we store it

Customer data is stored in encrypted databases hosted in the EU/US (region selected at engagement). Access is limited to operators on your engagement and logged. We can sign a mutual NDA and DPA before any data exchange.

International transfers

Google Analytics 4 and Microsoft Clarity are operated by companies in the United States, so accepting analytics cookies means your website usage data is transferred outside the EEA. Those transfers rely on the EU Standard Contractual Clauses together with each provider's certification under the EU–US Data Privacy Framework. Engagement data is stored in the region agreed with you; where that is outside the EEA, the Standard Contractual Clauses in our DPA apply. Ask us at hello@llmcfo.com for a copy of the safeguards.

How long we keep it

• Website analytics — GA4 retains event data for 14 months; Clarity retains recordings for 30 days. Your consent choice is stored in a cookie on your own device for 12 months.
• Email correspondence — kept for up to 24 months after our last exchange, unless you ask us to delete it sooner.
• Engagement data — kept for the term of the engagement plus 12 months for reconciliation and dispute resolution, then deleted. Invoices are kept as long as tax law requires.

Your rights

If you're in the EU/UK (GDPR) or California (CCPA), you have the right to access, correct, export, or delete the data we hold about you, to object to or restrict how we use it, and to ask us not to sell or share it (we do neither). Email hello@llmcfo.com and we'll respond within 30 days.

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time and it is as easy to withdraw as it was to give: (or the "Cookie settings" link in the footer of any other page). Withdrawing clears the analytics cookies already set on your device and stops any further collection. It does not affect anything collected before you withdrew.

Complaints. You also have the right to lodge a complaint with a data protection supervisory authority — in the EU, the authority in the country where you live or work (list of authorities); in the UK, the Information Commissioner's Office. We'd appreciate the chance to sort it out first.

Cookies

Nothing but the cookie below is set until you accept.

• llmcfo_consent — strictly necessary, set by us for 12 months to remember whether you accepted or rejected. Set no matter which you choose; without it we'd have to ask on every page.
• _ga, _ga_* — Google Analytics 4, up to 2 years, aggregate traffic measurement. Only after you accept.
• _clck, _clsk, CLID, MUID, ANONCHK, SM — Microsoft Clarity, from one session up to 1 year, heatmaps and session replay. Only after you accept.

Change your mind with the "Cookie settings" link in the footer, or in the "Your rights" section above. You can also block them with any standard ad/tracker blocker, or opt out of GA4 with the Google Analytics opt-out.

Contact

Questions, requests, or breach reports: hello@llmcfo.com · security: security@llmcfo.com.