Privacy Policy

1. Who we are and scope

Cloudrizz is a platform that lets you build, version, and deploy web applications by describing them to an AI assistant (such as ChatGPT or Claude) connected over the Model Context Protocol (MCP), and through our dashboard. We are the operator of the Service and, for the purposes described in Section 2, the controller of the personal data processed through your Cloudrizz account.

This policy applies to the Cloudrizz marketing site, dashboard, documentation, authentication, and APIs. It does not govern the separate privacy practices of the applications that our customers build and operate using Cloudrizz, or of third-party services you choose to connect (see Section 2).

The legal entity operating Cloudrizz, its registered address, and the competent lead supervisory authority are available on request at the contact details in Section 16. If you need these details in writing for a data-protection filing, email us and we will provide them.

2. Our role: controller and processor

Cloudrizz plays two distinct roles depending on the data:

• Controller. For your account, billing, authentication, support, product usage, and the operation of the Service, Cloudrizz is the controller and this policy governs that processing.
• Processor. For the content you create inside your apps (your code, databases, files, and the personal data of your own end-users that your apps collect and store), you are the controller and Cloudrizz acts as a processor that hosts and processes that data on your behalf, under your instructions and our terms. You are responsible for having a lawful basis and your own privacy notice for the end-users of your apps.

3. Information we collect

We collect the following categories of personal data:

• Account and profile. Your name, email address, and the organizations or teams you belong to, including role and membership information.
• Authentication data. A securely hashed password (we never store your password in plain text), passkey (WebAuthn) credentials, email one-time codes for two-factor verification, and, if you choose social sign-in, the identifier and basic profile returned by Google or Microsoft. Session and sign-in cookies are described in Section 6.
• Billing data. Subscription plan, status, seat counts, usage counters used for metering, and a customer identifier. Payments are processed by Paddle as the merchant of record. Paddle, not Cloudrizz, collects and stores your payment card and tax details; we receive only the transaction and subscription metadata needed to run your account.
• App content you create. Source code, file uploads, database contents, environment variables and secrets (encrypted at rest), deployment artifacts, custom domains, and version history. Secrets and environment variables are stored encrypted and injected into your apps at deploy time.
• AI prompts and outputs. The instructions, messages, and content you or your apps send to AI models through the Service, and the generated responses. See Section 7.
• Usage, logs, and telemetry. Records of actions you take (for example MCP tool calls, builds, and deployments), deploy logs, error logs, rate-limit and quota counters, approximate request counts, and limited technical data such as IP address, timestamps, and user-agent, used for security, debugging, abuse prevention, and service quality.
• Product analytics. Aggregate, privacy-preserving usage analytics about how the marketing site and dashboard are used. Our built-in analytics are cookieless by default (see Section 6).
• Communications. Messages you send us (for example support email) and our replies.
• End-user data in your apps (processor). Data that the applications you build collect from their own users, which we host on your behalf. We do not use this data except to provide the Service to you.

We do not intentionally collect special categories of data (such as health, biometric, or precise geolocation) about you for our own purposes. If your apps process such data about their end-users, you are responsible for doing so lawfully.

4. How we use information

• Provide, operate, maintain, and secure the Service.
• Authenticate you and protect your account (including two-factor and passkey sign-in).
• Build, host, deploy, and serve your apps and their content.
• Process subscriptions, metering, invoicing, and prevent payment fraud (together with Paddle).
• Provide customer support and respond to your requests.
• Monitor, debug, and improve reliability, performance, and quality, and enforce quotas, rate limits, and our terms.
• Detect, prevent, and investigate abuse, security incidents, and illegal activity.
• Send service and transactional communications (for example security alerts, billing notices, and important changes). We do not send marketing email without a lawful basis or your consent where required.
• Comply with legal obligations and enforce our rights.

We do not sell your personal data, and we do not use the private content of your apps or your AI prompts to train our own models.

5. Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract: to provide the Service you sign up for, authenticate you, host your apps, and handle billing.
• Legitimate interests: to secure and improve the Service, prevent abuse, and keep records, balanced against your rights.
• Legal obligation: to meet tax, accounting, and other legal requirements.
• Consent: where required, for example optional cookies or certain communications. You can withdraw consent at any time.

6. Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. Session cookies are set with the SameSite=Lax attribute and are shared only across Cloudrizz subdomains to support sign-in across the dashboard, API, and MCP endpoints. These cookies are essential and cannot be disabled while you use a signed-in area.

Our built-in product analytics are cookieless by default and do not track you across other websites. Where a cookie-based analytics mode or any non-essential cookie is used, we request consent where the law requires it. We honor Global Privacy Control (GPC) signals where applicable.

7. AI features, prompts, and recordings

• Built-in AI. When you use the included Cloudrizz AI models, your prompts and content are processed by our AI infrastructure running on Cloudflare to generate a response. They are used to provide the feature and are not used to train our models.
• Bring-your-own keys. If you configure your own OpenAI, Anthropic, or Google AI key on an app, those requests go directly from the Service to that vendor under your own account and are governed by that vendor's terms and privacy policy.
• Semantic search and maps. Features that use managed search or geospatial data store the relevant content and embeddings with our database provider (Neon) to serve your app's queries.
• Meeting recording. If you use the meeting-recording feature, a bot may join a video meeting to record and transcribe it. You are responsible for obtaining the consent of all participants as required by applicable law. Recordings and transcripts are stored to provide the feature and are processed on your behalf.

8. How we share information and sub-processors

We share personal data only as needed to run the Service, and with the service providers (sub-processors) listed below, each bound by appropriate data-protection terms. We also disclose data when required by law, to protect rights and safety, or in connection with a corporate transaction (with notice where required).

• Cloudflare (global): hosting, compute, storage, CDN, DNS, security, and built-in AI (Workers, D1, R2, KV, Durable Objects, Queues, Workers AI).
• Neon (managed PostgreSQL): data for geospatial and semantic-search features, reached through Cloudflare Hyperdrive.
• Paddle: payments, subscription billing, invoicing, and sales tax, as merchant of record.
• Resend: delivery of transactional and app email.
• Scaleway: a small always-on server used for apex-to-www domain redirection and related infrastructure.
• Meeting BaaS: the meeting-bot provider that records and transcribes meetings for the meeting-recording feature (when you use it).
• OpenAI, Anthropic, and Google: AI model providers, used only when you enable a feature backed by them or configure your own key.
• Google and Microsoft: identity providers, only if you choose social sign-in.

A current list of sub-processors is available on request. We will seek to give notice of material changes so you can object where you have that right.

9. International data transfers

Our providers may process data in countries outside your own, including the United States. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), together with additional safeguards where needed.

10. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. We retain certain records for longer where required for legal, tax, security, or dispute-resolution purposes. App content and backups are deleted on a rolling basis after account closure (see Section 13). Logs and telemetry are kept for a limited period appropriate to their purpose and then deleted or aggregated.

11. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit and at rest for secrets and environment variables, hashed passwords, two-factor and passkey authentication, per-app isolation so one app cannot access another, scoped access tokens, rate limiting, and least-privilege access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

12. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information; we do not sell or share personal information as those terms are defined.

To exercise any right, email privacy@cloudrizz.com. We will verify your request and respond within the time required by law. You will not be discriminated against for exercising your rights. For data held in your apps where we act as a processor, direct the request to the relevant app operator; we will assist them as required.

13. Account closure and deletion

You can close your account and request deletion of your account data from your dashboard or by emailing us. On closure we delete or anonymize your personal data and your app content within a reasonable period, except where we must retain specific records for legal, tax, or security reasons. Deletion propagates to backups on our normal backup-rotation schedule.

14. Children

The Service is not directed to children and is not intended for anyone under the age of 16 (or the minimum age required in your country). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or in the dashboard. Your continued use of the Service after an update means you accept the revised policy.

16. How to contact us

For privacy questions or to exercise your rights, email privacy@cloudrizz.com or hello@cloudrizz.com. See also our Terms of Service and Refund Policy.