CloudCruise Privacy Policy
Effective date: June 29 2025
At CloudCruise, we believe automation should never come at the expense of trust. This Privacy Policy explains what data we collect, why we collect it, how we use it, and the choices you have when you use any CloudCruise product, website, API, or related services (collectively, the “Services”). By accessing or using our Services, you agree to the practices described here.
Last updated: June 29 2025. Material changes will be announced on the CloudCruise website and, where appropriate, by email.
1. What This Policy Covers
This Policy addresses “Personal Data”—information that identifies or relates to an identifiable individual—and any other data we process on your behalf, including data you instruct our agents to capture from third-party sites. It does not cover:
services we do not own or control;
information handled solely on customer infrastructure when you deploy CloudCruise fully on-premise.
2. Categories of Personal Data We Collect
Category
Examples
Why We Collect / Use It
Profile & Contact Data
Name, email, company, job title
Create/manage your account;
send essential communications
Authentication Data
Passwords, SSO tokens, portal credentials you upload for automated runs
Execute automation you request; secure your workspace
Payment Data
Card last 4 digits, billing address (processed by Stripe)
Process subscriptions and one-time payments
Device / IP & Log Data
IP address, user-agent, agent-run metadata, error logs
Debugging, fraud prevention, service improvement
Automation Input & Output
Structured JSON data, screenshots, session replay
Deliver results; power observability dashboards
Web Analytics & Cookies
Page views, referrers, cookie IDs
Understand site usage, improve UX, market our Services
We do not use customer data to train any third-party generative AI models.
3. Sources of Personal Data
You — when you create an account, run an agent, upload credentials, or interact with support.
Automated collection — cookies, server logs, session replay (for authenticated users only).
Third parties — payment processor (Stripe), analytics (Google Analytics, Posthog, Langfuse) and cloud hosting (AWS, Vercel).
4. How & Why We Use Personal Data
Providing, Customising & Improving the Services
Spin up agent runs, monitor success/failure, auto-repair workflows.
Personalise dashboard views, remember preferences, recommend new features.
Legal & Security
Detect fraud or abuse, investigate anomalies, comply with HIPAA, GDPR, CCPA, and other laws.
Respond to lawful requests from regulators or courts.
Marketing (low-volume)
Send updates about new integrations, webinars, or industry insights.
You can opt out anytime via the email footer.
5. How We Disclose Personal Data
Recipient Type
Examples
Safeguards
Service Providers
Stripe, AWS, Supabase, Vercel, Sentry
Data Processing Agreements; least-privilege access
AI & Automation Providers
OpenAI, Anthropic, Google, Microsoft Azure, Langfuse, proxy network providers
Used to execute, repair and monitor your automations; Business Associate Agreements where PHI is processed
Customer-Authorised Parties
Slack Connect channels, your downstream APIs
Only on your instruction
Analytics & Cookies
Google Analytics, PostHog
Pseudonymised where possible
Business Transfers
Merger, acquisition, or asset sale
Successor assumes same privacy obligations
Legal / Safety
Law enforcement, courts
Only when required or to protect rights, safety, or property
We do not sell Personal Data for monetary gain. Nevada “sale” status: not selling. California “sharing” for cross-context behavioural ads: none.
6. Cookies
We use:
Essential Cookies – authentication, load balancing.
Functional Cookies – save UI settings (e.g., dark-mode).
Performance Cookies – page analytics via Google Analytics.
Your browser’s “Do Not Track” signal is currently not honoured (consistent with industry norms). Opt-out options are listed in our Cookie Settings modal.
7. Data Security
Encryption in transit (TLS 1.2+) and at rest (AES-256) for all customer-provided data.
Segmented production network; role-based access controls; annual penetration tests.
HIPAA Business Associate Agreement available for covered entities or subcontractor agreements.
No internet or storage method is 100 % secure, but we work hard to safeguard your data. Please keep your credentials confidential and notify us immediately if you suspect unauthorised use.
8. Data Retention
Data Type
Standard Retention
Rationale
Account & Profile
Life of account + 30 days
Allow reactivation / resolve disputes
Payment Records
7 years (tax law)
Regulatory & audit requirements
Agent-Run Logs
Workspace setting: 1–365 days (default 30)
Debugging & quality metrics
Back-ups
35 days rolling
Disaster recovery
We may keep anonymised, aggregated statistics indefinitely.
9. Your Rights & Choices
Depending on where you live, you may have rights to:
access, correct, or delete Personal Data;
opt out of marketing;
restrict or object to processing;
receive a portable copy;
lodge a complaint with a regulator (EEA/UK);
request that we not “sell” or “share” your data (California).
Submit requests by email (see Section 12). We will verify your identity before acting.
10. International Data Transfers
CloudCruise is US-based but uses global cloud infrastructure. Where required, we rely on:
EU Standard Contractual Clauses;
UK International Data Transfer Addendum;
adequacy decisions or equivalent safeguards.
11. Children’s Privacy
CloudCruise is not intended for children under 13, and we do not knowingly collect Personal Data from them. If we learn we have done so, we will delete it promptly.
12. Contact Us
Questions, concerns, or data-subject requests:
Email: founders@cloudcruise.com
Supplemental California & Nevada Notices
California residents may request a list of third parties to whom we disclosed Personal Data for direct-marketing purposes (Civil Code § 1798.83). Contact us as above. We do not currently meet the threshold to maintain a dedicated “CPRA report” but this Policy provides equivalent disclosures.
13. Changes to This Policy
We may update this Policy as we evolve or legal requirements change. Material changes will be posted on our website and, if you have an account, emailed to you. Continued use of the Services constitutes acceptance of the revised Policy.
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M 4.959 24 C 2.22 24 0 21.761 0 19 L 0 5 C 0 2.239 2.22 0 4.959 0 L 19.041 0 C 21.78 0 24 2.239 24 5 L 24 19 C 24 21.761 21.78 24 19.041 24 Z" fill="rgb(0, 0, 0)" height="24px" id="cADxXCCAy" width="24px"/><path d="M 10.396 0 L 12.42 0 L 7.998 5.083 L 13.2 12 L 9.127 12 L 5.936 7.805 L 2.286 12 L 0.261 12 L 4.991 6.563 L 0 0 L 4.177 0 L 7.06 3.834 Z M 9.685 10.781 L 10.807 10.781 L 3.567 1.154 L 2.364 1.154 Z" fill="rgb(255, 255, 255)" height="12px" id="SrUSID9We" transform="translate(5.5 6)" width="13.2px"/></svg>)
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M 4.959 24 C 2.22 24 0 21.761 0 19 L 0 5 C 0 2.239 2.22 0 4.959 0 L 19.041 0 C 21.78 0 24 2.239 24 5 L 24 19 C 24 21.761 21.78 24 19.041 24 Z" fill="rgb(0, 0, 0)" height="24px" id="q9CF99clC" width="24px"/><path d="M 13 8.531 L 13 14 L 10.324 14 L 10.324 8.969 C 10.324 7.656 9.75 6.781 8.794 6.781 C 7.786 6.781 7.265 7.656 7.265 8.75 L 7.28 14 L 4.206 14 L 4.206 4.375 L 7.261 4.375 L 7.265 5.906 C 7.265 5.906 8.221 4.375 9.941 4.375 C 11.853 4.375 13 5.63 13 8.531 Z M 1.529 0 C 0.576 0 0 0.656 0 1.531 C 0 2.406 0.574 3.063 1.54 3.063 C 2.507 3.063 3.059 2.37 3.059 1.531 C 3.059 0.656 2.483 0 1.529 0 Z M 0 14 L 3.059 14 L 3.059 4.375 L 0 4.375 Z" fill="rgb(255, 255, 255)" height="14px" id="MVCHHn3B2" transform="translate(6 5)" width="12.999999829022336px"/></svg>)
