Privacy & cookies

1. Introduction

Cloud Billing (“we”, “us”) provides a multi-tenant billing and operations platform (“Service”). This policy explains how we handle personal data when you visit our website, create an account, or use the Service as a customer, vendor, or end user acting on behalf of an organisation.

Where the Service is offered to your company or organisation, that organisation is typically the controller of personal data entered into workspaces, and we act as a processor according to our data processing terms. See our Data processing addendum for more detail.

2. Data controller

For website visitors and for the account relationship with us as platform operator, the controller is [Your legal entity name], registered at [Registered address]. Align this with the fields in Site settings (Impressum) where you publish the same entity. You can reach our privacy team at the address on our Contact page.

For registered office and regulatory details, see also our Impressum.

If you have appointed a data protection officer or EU/UK representative, insert their contact details here once confirmed.

3. Personal data we process

Depending on how you interact with us, we may process:

• Account and identity: name, email address, organisation name, role, authentication identifiers (e.g. user ID from Supabase Auth), and profile preferences.
• Service content: data you choose to store in the product (e.g. customers, invoices, inventory, attendance, shop or warehouse records). This may include third-party personal data for which your organisation is responsible.
• Technical and usage: IP address, approximate location derived from IP, device and browser type, timestamps, pages viewed, API usage, diagnostic logs, and security signals.
• Billing: payment-related metadata processed by our payment service provider (e.g. Stripe), such as billing contact, subscription state, and transaction references—not full card numbers, which are handled by the payment provider.
• Support and enquiries: messages you send via contact forms, email, or in-product support, including attachments you provide.

4. Purposes and legal bases (EEA/UK)

Where European data protection law applies, we rely on the following bases:

• Contract: operating the Service, authenticating users, processing subscriptions, and providing support you request.
• Legitimate interests: securing the platform, detecting abuse, improving reliability and performance, analysing aggregated usage, and direct B2B communications where allowed (balanced against your rights).
• Legal obligation: tax, accounting, and regulatory requirements where applicable.
• Consent: where we expressly ask for it (for example non-essential cookies—see our Cookie notice below).

5. Recipients and subprocessors

We share data with:

• Infrastructure and auth: e.g. Supabase (database, authentication, storage if enabled)—see their documentation for regions and certifications.
• Payments: Stripe or other processors you enable, for billing and fraud prevention.
• Hosting and email: your deployment provider (e.g. Vercel) and transactional email providers as configured.
• Professional advisers: lawyers, accountants, or insurers where required.
• Authorities: if compelled by lawful request, or to protect rights, safety, and integrity of the Service.

Maintain a current subprocessor list for enterprise customers (often published on your website or annexed to the DPA).

6. International transfers

Your data may be processed in countries outside where you live, including the United States. Where required, we use appropriate safeguards such as Standard Contractual Clauses (EU Commission 2021/914), the UK International Data Transfer Agreement or Addendum, or other mechanisms recognised by applicable law. You may request a copy of relevant transfer mechanisms from the contact above.

7. Retention

We retain personal data only as long as necessary for the purposes above, including legal, tax, and dispute resolution needs. Workspace content is retained according to your subscription, backups configured in Supabase or your host, and your written off-boarding instructions. When an account ends, you should export data you need; we delete or anonymise in line with our retention schedule and the DPA.

8. Security

We implement administrative, technical, and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation at the database layer (e.g. row-level security), and monitoring. No method of transmission or storage is completely secure; report suspected vulnerabilities responsibly via our Security page.

9. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is consent-based. You may lodge a complaint with a supervisory authority. To exercise rights, contact us via Contact. If we process data solely on instructions from your employer, we may refer your request to them where appropriate.

10. Automated decisions

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects within the meaning of the GDPR. If that changes, we will update this policy and explain any available rights.

11. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it promptly.

12. Changes to this policy

We may revise this policy to reflect product, legal, or regulatory changes. We will post the updated version with a new “last updated” date and, where appropriate, notify account administrators by email or in-product notice.

13. Related documents

• Terms of service
• Cookie notice (this page, below)
• Acceptable use policy
• Data processing addendum
• Impressum (legal notice)