Privacy Policy

1. Who we are

CloudPilot is operated by Iraya Digitech Ltd, a private limited company registered in England and Wales under company number 16795896, whose registered office is at 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. For the personal data described in this policy we are the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Contact us about privacy at privacy@cloudpilot.app or by post at our registered office.

2. Data in your Odoo instances

This policy does not cover the personal data in your Odoo databases, backups and files. We process that data on your behalf as a processor, under the Data Processing terms. If you are a customer of one of our customers, contact that organisation about your data.

3. What we collect

• Account data: name, email address, password (handled by our authentication provider, never stored in plain text), team roles and account settings.
• Billing data: company name, billing address, VAT number and invoice email. Card details are handled by our payment processor, not by us.
• Service data: information about the servers, instances, domains and settings in your account, and the cloud provider and storage credentials you add, which we store encrypted.
• Usage and log data: IP address, browser and device information, and records of actions taken in the dashboard and API, kept for security and troubleshooting.
• Communications: emails and messages you send us, and notifications we send you.
• Website chat: the messages you write in the chat on our website, the page you started it on and, if you send a message to our team, your name, email address and message, which we receive by email. Questions are answered by an AI model using only our public documentation: your messages are sent through OpenRouter to the AI provider that runs the model, to be answered. Don't share passwords or other sensitive information in the chat.
• Website analytics: if you accept analytics cookies, information about how you use our website, such as the pages you visit, collected with Google Analytics.

4. How we use it, and our lawful bases

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details.

5. Who we share it with

We don't sell personal data. We share it only with service providers who help us run CloudPilot (listed on our GDPR page), with professional advisers, with authorities where the law requires, and with a buyer if our business is sold. Our providers may use it only on our instructions.

When you connect a cloud provider, GitHub or a storage provider, we send it the instructions needed to carry out what you ask, using your credentials. Those providers handle the data under their own terms and privacy policies.

6. International transfers

Our main systems are hosted in the UK and the European Union, which the UK recognises as providing adequate protection. On the Starter plan, the Odoo databases and files we host for you are stored on CloudPilot shared servers in the United States, run by Akamai (Linode). Some providers, such as Google, and OpenRouter and its AI providers (website chat), may process data in the United States or elsewhere. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

• Account and service data: for as long as your account is open, then deleted within 90 days of closure, except as below.
• Backups held in CloudPilot storage: as set by your retention settings, and deleted within 30 days of account closure.
• Billing records: six years after the end of the financial year they relate to, as required by UK tax law.
• Security and access logs: up to 12 months.
• Website analytics: up to 14 months.
• Website chats: 90 days after the last message.

8. Security

We protect personal data with technical and organisational measures. These include encryption in transit, encrypted storage of credentials, least-privilege access, hardened servers and regular security updates. Read more on our GDPR page.

9. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to our use of your data, including for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To exercise these rights, email privacy@cloudpilot.app. We will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, but we'd appreciate the chance to help first.

10. Cookies

We use a small number of cookies and similar technologies:

Analytics cookies are set only if you accept them in the cookie banner. You can change your choice at any time using Cookie settings, also in the footer of every page.

11. Children

CloudPilot is a business service and is not intended for children. We do not knowingly collect children's personal data.

12. Changes to this policy

We may update this policy, and will post the new version here with a new date. If the changes are significant, we will tell account holders by email or in the dashboard.