Privacy Policy

1.Who we are and what this covers

Cloudesk is operated by the company that operates Cloudesk (“we”, “us”). This policy explains how we handle personal data about people who visit this website, sign up, use the app, or contact us. For that data we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the controller under the EU and UK General Data Protection Regulation (“GDPR”).

Data our customers put into Cloudesk is different. When a business uses Cloudesk to run its store, invoices, CRM, HR and payroll, clinic, school or other operations, the personal data of its customers, employees, patients, students and contacts belongs to that business. The business is the data fiduciary / controller and decides why and how that data is used; we only process it on its instructions, under our Data Processing Addendum. If you are a customer, employee, patient or student of a business that uses Cloudesk, please contact that business about your data — we will pass on requests we receive to it.

2.Personal data we collect and why

We collect this data from you, from the members of your workspace (for example when someone invites you), from the services you connect (for example GitHub or your identity provider when you sign in with them), and from our payment partners (payment confirmations).

Visiting this website. The marketing pages don't use analytics, advertising or social-media trackers. Our servers record basic request data (such as IP address, the page requested and the time) to deliver pages and protect the Service; see the Cookie Policy.

We do not use your personal data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our security systems may automatically block an IP address for a limited time if it shows attack patterns.

3.Consent and legal grounds

India (DPDP Act)

We process your personal data on the basis of your consent, given when you sign up and accept this notice, or for a legitimate use permitted by Section 7 of the DPDP Act — for example where you have voluntarily provided data for a specified purpose such as getting an invoice, or to comply with law or a court order. You can withdraw consent at any time, as easily as you gave it — use the details on our contact page, or close your account. Withdrawal does not affect processing already done, and we may then be unable to provide the Service to you.

EU, EEA and UK (GDPR)

• Contract (Art. 6(1)(b)): to provide the Service you signed up for, including your account, workspace and billing.
• Legal obligation (Art. 6(1)(c)): tax invoices and records, responding to lawful requests, reporting incidents.
• Legitimate interests (Art. 6(1)(f)): securing the Service, preventing fraud and abuse, keeping audit records, and improving the product using aggregated information. You can object to this processing (see your rights below).
• Consent (Art. 6(1)(a)): where we ask for it, for example optional marketing emails. You can withdraw it at any time.

4.Who we share it with

We share personal data only as needed to run the Service, and never sell it:

• Service providers (sub-processors) that host, deliver email, take payments or run AI features for us, under contracts that require them to protect the data and use it only for us. The list, and when each is used, is on our Sub-processors page.
• Your workspace. Owners and admins of a workspace you belong to can see your name, email, role and activity in that workspace, including its audit log.
• Services you connect. When you connect a mailbox, a payment account, a publishing service or your identity provider, data flows to and from it as you instruct.
• Authorities and legal process, where required by law — for example a valid order under Indian law, or directions from CERT-In — or to protect people's safety, our rights, or the Service.
• A buyer or successor if our business is merged, acquired or sold, in which case this policy continues to apply to your data.

5.Where data is stored and international transfers

The Service's data is stored in a PostgreSQL database and file storage operated for us by our hosting provider in the region we choose for the Service. Some sub-processors (for example email delivery, payments or AI providers) may process data in other countries, including the United States.

Where Indian law restricts transfers to particular countries, we follow those restrictions. When personal data from the EEA, UK or Switzerland is transferred to a country that doesn't have an adequacy decision (India currently doesn't), we use the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or another lawful mechanism, together with additional safeguards such as encryption. You can ask us for a copy of the relevant safeguards.

6.How long we keep data

We keep personal data only as long as needed for the purposes above or as the law requires. Specific periods built into the Service:

If you have a question about a specific record, use the details on our contact page.

7.How we protect data

We use reasonable security practices and procedures appropriate to the nature of the data, including:

• Encrypted connections (HTTPS with HSTS) for the app and API.
• Passwords stored only as Argon2id hashes — we can't see your password.
• Payment-provider keys, mailbox passwords and tokens, and two-step sign-in secrets encrypted with AES-256-GCM before they're stored.
• Session tokens stored only as SHA-256 hashes, in secure, HttpOnly cookies.
• Two-step sign-in with authenticator apps, single sign-on and SCIM for organisations, role-based access and audit logs.
• A web application firewall, rate limits and security headers.

More detail is on our Security page. No system is perfectly secure, so please also protect your password and turn on two-step sign-in.

Sensitive personal data (India)

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, passwords and financial information such as card or bank details are sensitive personal data. We hold your password only as a hash, and we never receive your card, UPI or net-banking credentials — those are handled by our payment partners, which are required to comply with PCI-DSS. Bank account details that a business enters into Cloudesk (for example for payroll) are Customer Content handled under the DPA.

8.If there is a data breach

We have procedures to detect, contain and investigate security incidents. If a personal data breach affects you, we will tell you and notify the Data Protection Board of India as required by the DPDP Act and its rules, and report cyber-security incidents to CERT-In within the time required by its directions (currently 6 hours of noticing certain incidents). Where the GDPR applies, we notify the competent supervisory authority within 72 hours where required. If a breach affects Customer Content, we notify the affected workspace's owners without undue delay so they can meet their own obligations.

9.Your rights

Everyone

Much of your data can be seen and changed in the app (your profile, security settings, active sessions, and — for workspace owners — exports and deletion). For anything else, use the details on our contact page. We may need to confirm your identity first. We respond within the time the applicable law requires and, in any case, within 30 days.

India — DPDP Act, 2023

• Access: a summary of the personal data we process about you and the processing activities, and the identities of others we have shared it with.
• Correction, completion, updating and erasure of your personal data, unless we must keep it for a specified purpose or by law.
• Withdraw consent at any time.
• Grievance redressal: complain to our Grievance Officer (see Grievance Redressal), who responds within the period set by law.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• If you are not satisfied with our response, you may complain to the Data Protection Board of India.

EU, EEA and UK — GDPR and UK GDPR

You have the right to access, rectify and erase your data; restrict or object to processing (including processing based on legitimate interests); data portability (receive your data in a structured, machine-readable format); and withdraw consent. You may complain to your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

California — CCPA as amended by the CPRA

In the last 12 months we have collected these categories of personal information for the business purposes described above: identifiers (name, email, IP address); commercial information (plan and invoices); internet or network activity (sign-in and usage records); professional information (business name and role); approximate location derived from IP address (for security); and account log-in credentials (sensitive personal information, used only to authenticate you). Sources and recipients are described in this policy.

We do not sell or share your personal information (including for cross-context behavioural advertising), and we have not done so in the last 12 months. We do not use sensitive personal information except for purposes permitted by the CPRA. You have the right to know, access, correct and delete personal information, and not to be discriminated against for exercising your rights. You may use an authorised agent. Because we don't sell or share personal information, there is nothing to opt out of; we treat a Global Privacy Control signal as a valid opt-out request regardless.

10.Children

Cloudesk is a service for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children and we do not collect the verifiable parental consent the DPDP Act requires for processing children's data, so children may not create accounts. If you believe a child has given us personal data, please use the details on our contact page — we will delete it. Schools and other businesses that hold children's data in Cloudesk (for example in the Education module) are the data fiduciaries for that data and are responsible for obtaining parental consent.

11.Emails we send

We send emails you need to use the Service: sign-in codes, invitations, invoices, trial and renewal reminders, security alerts and important notices about the Service or these policies. These are part of the Service and can't be switched off while you have an account. We send marketing emails only with your consent, and each includes a way to unsubscribe.

12.Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect and, where the law requires, ask for your consent again.

13.Contact, privacy officer and representatives

For privacy questions or to exercise your rights, use the details on our contact page.

Grievance Officer: see the Grievance Redressal page.

You can reach us through our contact page.