Privacy Policy

Last updated: 5 November 2026

Who we are

CloudOps is operated by Devops Team SRL, a company registered in Romania, European Union. We are the data controller for the personal data described here. As an EU company, we operate under the General Data Protection Regulation (GDPR). You can reach us at [email protected].

What we collect, and why

• Account data — when you create an account: your name, email address, and organization membership. Used to authenticate you, operate your organization's access controls, and contact you about your account. Legal basis: performance of a contract.
• Product and service updates — occasionally we email account holders about significant new CloudOps features and services (for example, the opening of the marketplace). We send these only to the email address on your account, only about CloudOps itself, and never on behalf of others. Accounts created on or after 5 November 2026 receive them only after saying yes (we ask once in the console; Settings → Notifications changes it any time). Legal basis: your consent for those accounts (GDPR Art. 6(1)(a)); for accounts created earlier, our legitimate interest in keeping account holders informed about our own services (GDPR Art. 6(1)(f)). Either way you can stop them at any time — see “Stopping product emails” below.
• Quote requests — when you use the form on our pricing page: the name, work email, company, and message you submit. Used solely to reply to your request. Legal basis: taking steps at your request prior to a contract.
• Infrastructure data — the servers, virtual machines, networks, and jobs you manage through the platform, including hardware inventory produced by scans you initiate. Processed to provide the service you configure; we never scan or modify machines you have not connected and authorized.
• Billing data — for paid usage and marketplace transactions: invoicing details and an itemized ledger of charges. Card details are handled by our payment processor (Stripe) and never touch our servers. Legal basis: performance of a contract and legal (accounting) obligations.
• Operational logs — every provisioning action runs as a recorded job with an audit trail (what changed, when, by whom). This is a core feature of the product and also serves security. Legal basis: legitimate interest in operating a secure, auditable service.

What we do not do

• We do not sell personal data, to anyone, for any purpose.
• Our public website uses Google Ads only if you accept them in the cookie banner (see the sections below). We never use your data for ad personalisation or remarketing. The console is never measured, and sets cookies only to keep you signed in.
• We do not read the contents of your servers, disks, or databases. The platform touches machines only through the jobs you can see in your own audit trail.

Advertising measurement

We advertise CloudOps on Google Search. If, and only if, you accept the cookie banner, our public website loads the Google Ads tag so we can tell whether an ad led to someone setting up CloudOps. Until you accept, nothing is loaded and nothing is sent to Google.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• On our website: when you arrive from one of our ads, Google adds a click identifier to the address. With your consent we keep it, the ad campaign details and the page you arrived on, in the _gcl_* cookies Google sets and in our own CLOUDOPS_AD_CLICK cookie, for up to 90 days.
• In our records: if you then create a CloudOps account, we store that click with your new organization, and note when it reaches a few setup steps (account created, environment ready, AI agent connected, first agent-created server or volume, subscribed to a paid plan).
• What Google receives: when your AI agent creates its first server or volume, the next time you open the console it tells Google that one conversion happened for that ad click, with a random reference number. When you subscribe to a paid plan, it likewise tells Google that a purchase happened for that ad click, with the plan’s list price and a random reference number. Google does not receive your name, email address, organization, servers or anything you do in the console.
• No personalisation: we turn off ad personalisation and remarketing. We do not build advertising audiences from our visitors.
• Legal basis: your consent (GDPR Art. 6(1)(a)).
• Retention: the cookies expire after 90 days. The click and setup-step records are deleted together with your organization.
• Transfers: Google may process the data in the United States under the EU–US Data Privacy Framework.
• Changing your mind: choose “Cookie settings” in the footer of any page and select Reject. The cookies are removed from your browser, and nothing is sent to Google afterwards, even for a setup step you complete later. To have the stored click deleted, email us.

Where your data lives

The platform and its data are hosted on infrastructure in Romania, European Union. Traffic to our public endpoints is proxied through Cloudflare (CDN and DDoS protection). Email is delivered via Amazon SES, which processes it in the United States (AWS region us-east-1); that transfer relies on the EU–US Data Privacy Framework and on the AWS GDPR Data Processing Addendum, which includes the EU Standard Contractual Clauses. Payments are processed by Stripe. These providers process data on our behalf under their own GDPR commitments.

Dedicated servers you order from our ready-to-order catalog run in third-party data centres in the European Union, the United Kingdom and Canada, operated by our infrastructure partners. They act as our sub-processors under Article 28 of the GDPR, bound by data-processing terms at least as protective as ours. The United Kingdom and Canada are covered by European Commission adequacy decisions. We do not read the contents of those servers. You can ask us at any time for the names of the sub-processors that host your server, and we will tell you before we add or replace one. Every third party that processes customer data for us is listed, with what it receives and where, on our subprocessor list. Business customers can request a Data Processing Agreement (GDPR Art. 28).

How long we keep it

Account and infrastructure data: for as long as your account is active, then deleted on request or after account closure. Quote requests: until handled, then archived in our support mailbox. Billing records: as long as accounting law requires. Audit logs: retained while the resources they describe exist, because they are the record of what was done to your infrastructure.

Stopping product emails (your right to object)

You can stop product and service update emails at any time, free of charge: use the “Unsubscribe” link at the bottom of any such email and confirm (no sign-in needed), use the unsubscribe button your mail app shows, or turn off “Product announcements” under Settings → Notifications. This is your right to object to direct marketing (GDPR Art. 21(2)): when you object we stop sending these emails, and you do not need to give a reason. If you said yes to them, stopping them withdraws that consent (GDPR Art. 7(3)). This does not affect emails we must send to run your account (security, billing and invitations). The single reminder we send when a new tenant is ready but nobody has signed in to it is separate: it has its own unsubscribe link and its own switch, “Setup reminders”.

Your rights

Under the GDPR you can ask us for access to, correction of, export of, or deletion of your personal data; you can object to or ask us to restrict processing; and you can withdraw consent where processing is based on it. Write to [email protected] — we respond within 30 days. You also have the right to lodge a complaint with your supervisory authority; in Romania that is ANSPDCP (dataprotection.ro).

Changes

If this policy changes materially, we will note it here with a new "last updated" date, and notify account holders by email for significant changes.

Questions? Contact us.