Last updated: 13 August 2026
This Privacy Policy explains what personal data CloudGate ("the Platform", "we", "us") collects, why we collect it, and what you can do about it. It applies to the CloudGate platform and its marketplace.
1. Data we collect
Account and organization data
- Name, email address, and phone number.
- Your organization, department, project, and assigned role.
- Authentication data — password hashes and, where enabled, multi-factor authentication settings. We never store passwords in readable form.
Cloud credentials
- The service keys you supply so the Platform can act in your cloud accounts. These are encrypted at rest and are used only to carry out operations you or your organization request.
- SSH key pairs you create or register for access to the machines you provision.
Usage and operational data
- Subscriptions, orders, and the configuration you selected.
- Resource inventory and the relationships between resources, used to show and manage what you own.
- Cost and usage records used to produce invoices.
- Audit logs of every state change — who did what, when, and to which resource.
- Technical logs, including error diagnostics and request identifiers, used to operate and debug the Platform.
Support data
- Tickets, enquiries, and the correspondence within them.
2. Why we use it
- To provide the service — authenticating you, provisioning and managing the resources you order, and showing you what you have.
- To bill accurately — aggregating usage into daily costs and invoices.
- To keep the Platform secure — detecting misuse, investigating incidents, and enforcing access control.
- To meet legal and compliance obligations — including retaining audit records where regulation requires it.
- To communicate — operational notifications about your subscriptions, invoices, and support requests.
We do not sell your personal data, and we do not use it for advertising.
3. Audit logging
Every create, update, and delete performed through the Platform is recorded in an immutable audit log, together with the identity of the account that performed it. This is a security and compliance control and cannot be disabled or selectively erased by users.
4. Sharing
We share data only where it is necessary:
- Cloud providers — the configuration needed to create and manage resources is sent to the provider you selected (AWS, Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, or an Apache CloudStack based cloud). Their handling of that data is governed by their own terms.
- Within your organization — administrators can see the subscriptions, costs, and audit records of the organization they administer.
- Service providers — infrastructure, email delivery, and monitoring providers acting on our instructions.
- Legal — where we are required to disclose by law or valid legal process.
Where CloudGate is operated as a multi-tenant service, your data is scoped to your tenant and is not shared with other tenants.
5. Retention
- Account data is kept while your account is active.
- Invoices, cost records, and audit logs are kept for the period required by applicable accounting and regulatory rules, which may extend beyond the closure of your account.
- Service keys are kept until you revoke them or your account is closed.
- Technical logs are kept for a limited operational period and then discarded.
6. Security
- Service keys and other secrets are encrypted at rest.
- Access is enforced by role-based permissions, and every request is scoped to the caller's organization and tenant.
- Multi-factor authentication is available and we recommend enabling it.
- Audit logs are immutable.
No system is perfectly secure. Keeping your own credentials confidential, and granting service keys no more permission than a task needs, materially reduces your risk.
7. Your rights
Subject to applicable law, you may request access to the personal data we hold about you, ask for it to be corrected, or ask for it to be deleted. Some data cannot be deleted on request where we are legally required to retain it — audit logs and invoices in particular. Requests can be raised through the support section of the Platform.
8. Data location
The resources you provision are created in the region and availability zone you choose at order time, and your content stays where you put it. Platform data is processed in the locations used by the deployment operating your tenant.
9. Changes to this policy
We may update this policy. The "last updated" date above reflects the current version, and material changes will be communicated through the Platform.
10. Contact
Questions about this policy, or a request concerning your personal data, can be raised through the support section of the Platform.