Privacy Policy

1 Introduction and scope

1.1 Who we are

This website and all related applications linked to this page are operated by Cloudy Development (cloudy-development@outlook.com). We are the data controller for the personal data processed through this website, unless otherwise stated in this policy.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, this policy is intended to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable national data protection laws.

1.2 How to contact us

You can contact us by email at cloudy-development@outlook.com.

1.3 Data Protection Officer (DPO)

We are not required to appoint a Data Protection Officer under applicable law. For all privacy-related matters, please contact us using the details above.

1.4 What this policy covers

This Privacy Policy explains:

• What personal data we collect about you;
• How and why we collect, use, and otherwise process it;
• The legal bases we rely on (under the GDPR);
• Who we share your data with;
• Whether and how we transfer data internationally;
• How long we keep your data;
• Your rights and how to exercise them;
• How we protect your data;
• How we update this policy.

This policy applies to personal data collected through:

• This website and all other applications published by this developer;
• Any related services, including newsletter, blog, e-commerce store, membership area, mobile apps, APIs, contact forms, and comment systems;
• Our communications with you (email, social media, support tickets, etc.).

If you use our services as a business customer or on behalf of an organization, some sections may not apply; however, personal data of individuals (e.g. contacts, users, employees) is still covered by this policy.

2 Personal data we collect

2.1 Categories of personal data

Depending on how you interact with us, we may collect and process the following categories of personal data:

(a) Identity and contact data — None.

(b) Account and authentication data

• User ID;
• Password (stored in hashed form);
• Security questions/answers (if applicable);
• Two-factor authentication data (e.g. phone number for SMS codes, authenticator app data).

(c) Profile and preference data

• Profile picture;
• Language and timezone preferences;
• Notification preferences;
• Marketing preferences (e.g. newsletter subscriptions);
• Account settings and customizations.

(d) Transaction and payment data (if you purchase from us — only for some applications, not applicable to every app)

• Order details (products/services purchased, quantities, prices);
• Billing and shipping addresses;
• Payment information (e.g. credit card details, PayPal account);
• Transaction IDs and references.

(e) Communication data

• Messages sent via contact forms, support forms, or chat widgets;
• Email correspondence with us;
• Call recordings or transcripts (if applicable and notified separately);
• Feedback, reviews, and survey responses.

(f) Technical and usage data (automatically collected)

• IP address;
• Browser type and version;
• Operating system and device type;
• Screen resolution and language settings;
• Referring URLs and exit pages;
• Pages visited, time spent, clickstream data;
• Date and time of access;
• Crash reports and error logs;
• Cookie identifiers and similar tracking technologies (see Section 9 and our Cookie Policy).

(g) Location data (if applicable)

• Approximate location derived from IP address;
• Precise location data (if you explicitly enable it, e.g. for location-based features).

(h) User-generated content

• Comments, posts, reviews, forum messages, uploaded files, images, or other content you submit to the website.

(i) Special categories of personal data (sensitive data)

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation). If you choose to send us such data voluntarily (e.g. in a support message), we will process it only as necessary to respond to your request and in compliance with applicable law.

In some cases we may collect and process special categories of personal data. Where we do, this processing is based on your explicit consent, as further described in Section 3.

(j) Data about children

Generally our services are not directed to children under 13/16 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete it. Where an application targets children, we may collect personal data from children under 13/16 with verifiable parental consent, in compliance with applicable laws such as the US Children's Online Privacy Protection Act (COPPA) and relevant EU national rules. See Section 13 for more details.

(k) Data obtained from third parties

In some cases, we may receive personal data about you from third-party sources, such as:

• Social media platforms (e.g. when you log in via Google, Facebook, or other providers);
• Business partners or affiliates;
• Data brokers or public sources (where permitted by law);
• Payment processors, fraud detection services, or identity verification providers.

Where this occurs, we will comply with GDPR Article 14 obligations, including providing this privacy notice within one month of obtaining your data or at the time of first communication, whichever is earlier.

2.2 Data you provide vs. data collected automatically

• Data you provide directly: Sections 2.1(a)–(e), (h), and (i) where applicable.
• Data collected automatically: Sections 2.1(f)–(g), and parts of (a)–(e) inferred from your usage (e.g. inferred preferences).

3 Purposes and legal bases for processing

For each purpose, we specify the categories of data involved and the GDPR legal basis we rely on (Article 6, and Article 9 where sensitive data is processed).

3.1 Providing and maintaining our services

Purpose: To create and manage your account; provide access to the website and its features; deliver purchased products or services; process orders and payments; provide customer support; and ensure the technical functioning of the website.
Data categories: Identity and contact data; account data; transaction and payment data; communication data; user-generated content; technical data.
Legal basis: Performance of a contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); and legitimate interests in ensuring service quality and security (Art. 6(1)(f)).

3.2 Communication with you

Purpose: To respond to your inquiries; send service-related notifications (e.g. password resets, order confirmations, important updates); and communicate about your account or transactions.
Data categories: Identity and contact data; communication data; account data.
Legal basis: Performance of a contract (Art. 6(1)(b)); legitimate interests in customer relationship management (Art. 6(1)(f)); and legal obligations where applicable (Art. 6(1)(c)).

3.3 Marketing and newsletters

Purpose: To send you marketing communications, newsletters, promotional offers, product updates, and invitations to events, where you have consented or where soft-opt-in rules apply.
Data categories: Identity and contact data; preference data; transaction history (for personalized offers).
Legal basis: Your consent (Art. 6(1)(a)); or legitimate interests in direct marketing to existing customers where permitted by law (Art. 6(1)(f)), subject to your right to object. You may withdraw your consent or opt out at any time (see Section 7).

3.4 Analytics and service improvement

Purpose: To analyze how users interact with our website; measure performance; identify errors; conduct A/B testing; and improve user experience, features, and content.
Data categories: Technical and usage data; cookie identifiers; aggregated or pseudonymized analytics data.
Legal basis: Legitimate interests in understanding and improving our services (Art. 6(1)(f)), subject to cookie/consent rules where required (see Section 9).

3.5 Security, fraud prevention, and compliance

Purpose: To detect, prevent, and investigate fraud, abuse, security incidents, and illegal activities; to protect our rights and property; to comply with legal obligations; and to enforce our Terms and Conditions.
Data categories: Identity, contact, account, transaction, technical, and usage data; communication data; user-generated content.
Legal basis: Legitimate interests in security and fraud prevention (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)); and, where necessary, performance of a contract (Art. 6(1)(b)).

3.6 Personalization and targeted advertising (if applicable)

Purpose: To personalize content and advertisements; build user profiles; and deliver targeted ads on our website or third-party platforms.
Data categories: Technical and usage data; preference data; cookie identifiers; possibly inferred interests.
Legal basis: Your consent (Art. 6(1)(a)) where required by law (e.g. for certain cookies or profiling); otherwise legitimate interests (Art. 6(1)(f)) where permitted. You can object to or opt out of certain personalized advertising as described in Section 7 and our Cookie Policy.

3.7 Legal claims and disputes

Purpose: To establish, exercise, or defend legal claims; handle disputes; and cooperate with regulators and law enforcement.
Data categories: Any relevant categories of personal data.
Legal basis: Legitimate interests (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)).

3.8 Automated decision-making and profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4 How we collect your data

We collect personal data:

• Directly from you when you register an account, place an order, subscribe to our newsletter, fill out forms, contact us, post content, or participate in surveys or promotions.
• Automatically as you navigate the website, via cookies, pixels, scripts, and similar technologies (see Section 9 and our Cookie Policy).
• From third parties, as described in Section 2.1(k).

At the point of collection (e.g. forms, checkout pages), we provide specific notices where required, including whether providing data is mandatory and the consequences of not providing it.

5 Sharing and disclosure of personal data

5.1 Categories of recipients

We may share your personal data with the following categories of recipients:

• Service providers and data processors acting on our behalf, including hosting and infrastructure providers; content delivery networks (CDNs); email delivery and marketing platforms; payment processors and fraud detection services; analytics and advertising providers; customer support and helpdesk tools; and security and backup providers.
• Professional advisors: legal, accounting, auditing, and insurance providers.
• Business partners and affiliates: where necessary to provide joint services or promotions you have requested.
• Public authorities and regulators: where required by law, regulation, legal process, or governmental request.
• Other third parties: as otherwise described to you at the time of collection or with your consent.

5.2 Data processors and safeguards

All service providers processing data on our behalf are bound by written contracts that include data protection obligations consistent with GDPR requirements (including Standard Contractual Clauses where relevant). We conduct due diligence and, where appropriate, audits to ensure compliance.

5.3 Corporate transactions

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, personal data may be transferred to the relevant third party as part of the transaction. We will require the recipient to honor this policy or provide equivalent protections, subject to applicable law.

6 International data transfers

6.1 Where your data may be transferred

Some of our service providers and affiliates may process your personal data outside the European Economic Area (EEA), including in countries such as the United States and the United Kingdom.

6.2 Safeguards for international transfers

Where personal data is transferred outside the EEA to countries without an adequacy decision by the European Commission, we implement appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Binding Corporate Rules (BCRs), where applicable;
• Reliance on adequacy decisions (e.g. UK, Switzerland, Israel, EU–US Data Privacy Framework for certified US recipients).

For transfers to the United States, we rely on the EU–US Data Privacy Framework (DPF) where the recipient is certified, or on SCCs supplemented by additional measures as needed. You may request a copy of these safeguards by contacting us.

6.3 Your rights regarding transfers

You have the right to obtain information about the safeguards applicable to transfers of your personal data. You may also lodge a complaint with your local supervisory authority if you believe your data is not adequately protected.

7 Your rights and how to exercise them

7.1 Overview of data subject rights

Depending on your location and applicable law, you may have the following rights:

• Right of access (Art. 15): to obtain confirmation whether we process your personal data and, if so, access to that data and related information.
• Right to rectification (Art. 16): to request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten", Art. 17): to request deletion of your data in certain circumstances.
• Right to restriction of processing (Art. 18): to limit how we use your data in specific situations.
• Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine-readable format and, where feasible, transmit it to another controller.
• Right to object (Art. 21): to object to processing based on legitimate interests or public task, and to direct marketing.
• Rights related to automated decision-making and profiling (Art. 22): to not be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with your local data protection authority (see Section 15).

Additional rights may apply under local laws (e.g. California, Virginia, Colorado, Connecticut, etc.), including rights to opt out of sale/sharing and targeted advertising.

7.2 How to submit a request

You can exercise your rights by contacting us at cloudy-development@outlook.com. To help us process your request efficiently, please:

• Clearly state which right(s) you wish to exercise;
• Provide sufficient information to identify you (e.g. name, email, account ID);
• Specify any relevant details (e.g. time period, specific data).

We may request additional information to verify your identity, especially for sensitive requests.

7.3 Response time and fees

We will respond to your request within one month of receipt, extendable by two further months for complex or numerous requests (we will inform you within the first month if an extension is needed). In most cases, our services are provided free of charge. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, as permitted by law.

7.4 Limitations

Certain rights may be limited by applicable law, for example where processing is necessary for:

• Compliance with a legal obligation;
• Performance of a contract;
• Establishment, exercise, or defense of legal claims;
• Public interest tasks or official authority.

7.5 Opt-out and preference management

• Marketing emails: use the "unsubscribe" link in any email or contact us.
• Cookies and tracking: use our cookie consent banner and preference center (see Section 9 and our Cookie Policy).
• Targeted advertising: use opt-out mechanisms provided by industry initiatives (e.g. Your Online Choices, DAA, NAI) and platform settings.

8 Data retention

8.1 General retention principles

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law (e.g. tax, accounting, or legal obligations).

8.2 Specific retention periods

• Account data: retained while your account is active and for a limited period after closure, to handle potential disputes and comply with legal obligations.
• Transaction and payment data: retained in line with tax and accounting laws.
• Marketing and newsletter data: retained until you unsubscribe or withdraw consent, plus a short period to manage suppression lists and comply with legal requirements.
• Communication data (support requests): retained for a limited period from the last interaction.
• Technical and usage logs: retained for a limited period for security, debugging, and analytics.
• User-generated content: retained as long as your account is active or the content is published, unless you delete it or we remove it for policy or legal reasons.

Where we cannot specify an exact period, we use criteria such as the duration of the contractual relationship, statutory limitation periods, the nature of the data, and potential risks.

8.3 Deletion and anonymization

At the end of the retention period, we securely delete or anonymize personal data, unless further retention is required by law. Anonymized data, which cannot reasonably identify you, may be retained indefinitely for statistical and research purposes.

9 Cookies and similar technologies

9.1 What are cookies and similar technologies

Cookies are small text files stored on your device when you visit our website. Similar technologies include pixels, tags, scripts, local storage, and SDKs (in mobile apps).

9.2 Types of cookies we use

• Strictly necessary cookies: essential for the website to function (e.g. session management, security). These do not require consent.
• Preference cookies: remember your choices (e.g. language, region).
• Analytics cookies: help us understand how users interact with the website (e.g. pages visited, errors).
• Marketing and advertising cookies: used to deliver relevant ads and measure campaign effectiveness.
• Third-party cookies: set by external services (e.g. analytics, social media, advertising networks).

For a detailed list of cookies, their purposes, durations, and providers, see our Cookie Policy.

9.3 Cookie consent and management

Where required by law (e.g. under the GDPR and ePrivacy rules), we obtain your consent before placing non-essential cookies. You can manage your cookie preferences via our cookie banner and preference center. You can also control cookies through your browser settings, though this may affect website functionality.

9.4 Do Not Track and Global Privacy Control

We honor "Do Not Track" signals and/or Global Privacy Control (GPC) where technically feasible and required by law.

10 Data security

10.1 Security measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage, including:

• Encryption in transit (e.g. HTTPS/TLS) and, where appropriate, at rest;
• Access controls and authentication mechanisms (including multi-factor authentication for administrative access);
• Regular security testing, vulnerability assessments, and patch management;
• Pseudonymization and minimization of data where feasible;
• Secure development practices and code reviews;
• Incident response and disaster recovery plans;
• Employee training on data protection and confidentiality.

10.2 Limitations

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continually improve our measures and respond promptly to incidents.

11 Data breach notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by law. Where the breach is likely to result in a high risk to you, we will also notify you without undue delay, unless:

• The data is encrypted or otherwise rendered unintelligible;
• We have taken measures that ensure the high risk is no longer likely to materialize;
• Notification would involve disproportionate effort (in which case we will use public communication or similar measures).

12 Third-party links and services

Our website may contain links to third-party websites, applications, or services (e.g. social media, payment providers, embedded videos). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you interact with. We are not responsible for their data practices.

13 Children's privacy

Services not directed to children

Our services are not directed to children under 13/16 years of age, and we do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

Services directed to children

We may collect personal data from children under 13/16 only with verifiable parental consent and in compliance with applicable laws (e.g. COPPA in the US, national implementations of GDPR). We will:

• Provide clear notice to parents;
• Obtain verifiable parental consent before collection;
• Allow parents to review, delete, and refuse further collection of their child's data;
• Not condition a child's participation on unnecessary data collection.

14 Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• The "Last updated" date at the top of this page will indicate when changes were made.
• We encourage you to review this policy periodically.
• Continued use of our services after changes constitutes acceptance of the updated policy, subject to applicable law.

15 Supervisory authority and right to complain

If you are located in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local data protection authority if you believe our processing of your personal data violates applicable law. Examples of supervisory authorities:

• Italy: Garante per la protezione dei dati personali – garanteprivacy.it
• France: CNIL – cnil.fr
• Germany: BfDI (federal) or relevant state authority – bfdi.bund.de
• Spain: AEPD – aepd.es
• Netherlands: Autoriteit Persoonsgegevens – autoriteitpersoonsgegevens.nl
• Ireland: Data Protection Commission – dataprotection.ie
• United Kingdom: Information Commissioner's Office (ICO) – ico.org.uk
• Other countries: please search for "data protection authority [your country]".

We encourage you to contact us first so we can attempt to resolve your concerns directly.

16 Specific notices for certain laws (if applicable)

16.1 California (CCPA/CPRA) notice

If you are a California resident, you have additional rights under the CCPA/CPRA, including:

• Right to know what personal information is collected, used, shared, or sold;
• Right to delete personal information;
• Right to opt out of sale or sharing of personal information;
• Right to limit use and disclosure of sensitive personal information;
• Right to non-discrimination for exercising your rights.

We have not sold/shared personal information in the past 12 months.

16.2 Other US state privacy laws

Similar rights may apply if you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, or other states with comprehensive privacy laws. Where applicable, we provide mechanisms to opt out of targeted advertising and certain profiling.

17 Glossary

• Personal data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
• Controller — the entity that determines the purposes and means of processing personal data.
• Processor — an entity that processes personal data on behalf of the controller.
• Legitimate interests — our interests in conducting and managing our business, provided they are not overridden by your rights and interests.

18 Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

cloudy-development@outlook.com

For EU/UK users, our designated contact (if required under GDPR Art. 27) can be reached at the same email address.