Who we are
This Privacy Policy explains how CloudGate Technologies [full legal entity name] [ABN / ACN] ("CloudGate", "we", "us" or "our") collects, uses, stores and discloses personal information when you use the CloudGate cloud storage application on Android, iPhone and the web (the "Service").
We are based in [registered business address], Australia, and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Where the General Data Protection Regulation ("GDPR") or applicable United States state privacy laws apply to you, additional rights are described in this policy.
By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Information we collect
Information you provide
- Account information: your email address, password (stored in hashed form), and any display name you choose.
- Billing information: if you purchase a paid plan, our payment provider [payment processor, e.g. Stripe / Apple / Google Play] collects and processes your payment details. We do not store full card numbers on our systems.
- Support correspondence: messages, attachments and contact details you send when you contact support.
Your files and content
The Service exists to store files you choose to upload, including photos, videos, documents, scans and other content ("Your Content"). We store Your Content so that we can provide the Service to you.
Information collected automatically
- Device and app information: device model, operating system version, app version, language and time zone.
- Usage information: storage used, number of files, backup status, feature usage and error logs.
- Technical information: IP address, approximate location derived from IP address, and connection information.
We use this information to operate, secure, troubleshoot and improve the Service.
How we use your information
We use personal information to:
- Create and administer your account and authenticate you when you sign in
- Store, sync and make Your Content available across your devices
- Process payments, renewals and cancellations for paid plans
- Provide customer support and respond to your enquiries
- Detect, investigate and prevent fraud, abuse, security incidents and breaches of our Terms of Service
- Send service communications such as storage limit notices, security alerts and material changes to our terms
- Comply with legal obligations and respond to lawful requests
- Analyse aggregated usage to maintain and improve the Service
We do not sell your personal information, and we do not sell or licence Your Content. We do not use Your Content to build advertising profiles about you.
Legal bases (GDPR)
Where the GDPR applies, we rely on: performance of a contract (providing the Service), legitimate interests (security, abuse prevention and service improvement), legal obligation (record keeping and lawful requests), and consent (where separately requested, such as optional marketing).
Your files and your rights over them
You retain ownership of Your Content. Uploading files to CloudGate does not transfer ownership or intellectual property rights to us.
You grant us a limited, non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, reformat and display Your Content strictly to the extent necessary to operate and provide the Service to you, including creating backup copies and generating thumbnails or previews. This licence exists solely so that the Service can function, and ends when Your Content is deleted from our systems, subject to the retention periods described below.
We do not routinely access or review Your Content. We may access Your Content only where necessary to: provide technical support you have requested, comply with a lawful request, investigate a suspected breach of our Terms of Service, or address an urgent security or safety issue.
Where your data is stored
Your Content and account data are stored on infrastructure operated by [hosting provider, e.g. AWS / Google Cloud] in [data centre region(s), e.g. Sydney, Australia].
Where personal information is transferred outside Australia, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles. Where the GDPR applies, such transfers are made under [transfer mechanism, e.g. Standard Contractual Clauses].
Security
We use technical and organisational measures designed to protect personal information and Your Content, including:
- Encryption of data in transit between your device and our servers using industry standard TLS
- [confirm whether encryption at rest is implemented, and describe it here]
- Access controls limiting staff access to systems holding personal information
- Optional passcode protection (Vault Lock) for folders you choose within the app
No method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security, and you provide information to us at your own risk.
When we disclose information
We disclose personal information only in the circumstances below.
- Service providers: hosting, payment processing, analytics, crash reporting and customer support tools, each bound by confidentiality obligations and permitted to use the information only to provide services to us.
- At your direction: when you share a file or folder with another person, that content becomes accessible to anyone you give the link to, for as long as the link remains active.
- Legal requirements: where required by law, subpoena, court order or a lawful request from a government or law enforcement authority.
- Protection of rights: where reasonably necessary to enforce our Terms of Service, investigate suspected fraud or abuse, or protect the rights, property or safety of CloudGate, our users or the public.
- Business transfers: in connection with a merger, acquisition, restructure or sale of assets, in which case we will take reasonable steps to ensure the recipient continues to handle your information in accordance with this policy.
A current list of our service providers is available on request by contacting us.
Retention and deletion
We retain your account information and Your Content for as long as your account remains active.
- Deleting files: when you delete a file, it may remain recoverable for a limited period of [retention window, e.g. 30 days] before permanent deletion.
- Closing your account: when you close your account, we delete or de-identify your personal information and Your Content within [deletion period, e.g. 90 days], except where retention is required by law.
- Inactive accounts: we may delete data associated with accounts that have been inactive for [inactivity period, e.g. 24 months], after giving reasonable notice to the email address on the account.
- Records we must keep: billing and transaction records are retained for the period required by Australian taxation and corporations law.
Backup copies may persist for a short period after deletion as part of routine system backups, and are overwritten in the ordinary course of operations.
Your privacy rights
Subject to applicable law, you may:
- Request access to the personal information we hold about you
- Request correction of information that is inaccurate, out of date or incomplete
- Request deletion of your personal information and Your Content
- Request a copy of your data in a portable format
- Object to or request restriction of certain processing, where the GDPR applies
- Withdraw consent where processing is based on consent
- Opt out of non-essential communications at any time
To make a request, contact us at support@cloudgate-app.com. We will respond within a reasonable period and in any case within the time required by applicable law. We may need to verify your identity before acting on a request.
Complaints
If you believe we have breached the Australian Privacy Principles, please contact us first so we can investigate. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. If the GDPR applies to you, you may also complain to your local supervisory authority.
Cookies and analytics
Our website and web app use cookies and similar technologies to keep you signed in, remember preferences and understand how the Service is used.
- Essential cookies: required for authentication and security. The Service will not function correctly without them.
- Analytics: [analytics provider, or state "we do not use third party analytics"] helps us understand aggregate usage patterns.
You can control cookies through your browser settings. Blocking essential cookies may prevent you from signing in.
Children
The Service is not directed at children. You must be at least [minimum age, e.g. 16] years old to create an account, or the minimum age required in your country to consent to the processing of personal information, whichever is higher.
We do not knowingly collect personal information from children below that age. If we become aware that we have done so, we will delete the information and close the associated account. If you believe a child has provided us with personal information, contact us at support@cloudgate-app.com.
Changes to this policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or through the app before they take effect. The date at the top of this page shows when it was last updated, and continuing to use the Service after changes take effect means you accept the updated policy.
