Privacy Policy

1. Who we are

CloudCastle is the product name for remote management and security software under evaluation. The exact operating legal entity and registered postal address remain unverified; this page does not identify an approved contracting party or data controller. That is a launch blocker, not a waiver of responsibility for data already collected.

For questions about this policy, or to exercise any right described in section 9, contact privacy@cloudcastle.ai.

2. Two different roles we play

This distinction matters, because it determines who you should ask about your data.

• Direct account and evaluation data: controller identity, purposes and lawful bases must be confirmed for the approved scope before collection.
• Data managed through an IT provider: contact that provider about your data as well as the privacy address below. Controller/processor roles and any required processing agreement must be established for the actual service; they cannot be inferred solely from who created an account.

3. What we collect

Account and billing information

Account and contact forms request names, email addresses, organisation details and optional contact information. Subscription records may also contain billing information. Payment readiness and the complete payment-data flow are not yet verified for launch. Do not send card numbers or payment credentials through contact or support channels.

Endpoint and telemetry data

Depending on enabled components and configuration, an agent can process:

• Hardware and operating-system inventory: model, serial number, machine UUID, CPU, memory, disks, OS version and patch level.
• Network identifiers used to group a machine to the right customer site: local IP, the network gateway's hardware address, and the public IP address the machine connects from.
• Health metrics: CPU, memory and disk utilisation, uptime, service and process state, and event-log entries relevant to faults.
• Installed software inventory and update status, so we can patch what is out of date.
• The username of the person signed in to the machine, used to route support and to attribute a device to the right person.
• Security telemetry: detections, quarantine actions, and the file paths and hashes involved in them.

Remote support sessions

Remote support can transmit screen content and permit interaction with the computer. Confirm operator authority, consent settings, recording configuration and audit visibility for the specific evaluation. Complete session/action audit coverage is not yet verified.

Backup content

Backup features can process selected files and system images, including sensitive content. Storage locations, access, encryption, restore capability and deletion of every copy must be confirmed before backup data is included in an approved evaluation.

Email security

Email-security integrations can process message metadata, bodies, links and attachments, including quarantined messages. Processing depends on the approved connection mode. Retention and deletion across messages, quarantine, logs and backups are not yet fully verified. Do not connect a customer mailbox without explicit scope and data-handling approval.

Website data

The website processes sign-in/session data and information submitted through its forms. The complete website data-flow and third-party inventory still require privacy review.

4. Sensitive content and use restrictions

• Security scanning, email analysis, backups and remote sessions may expose file or message content; a blanket “we never read personal files” assurance would be inaccurate.
• Do not submit passwords, card data, private mailbox content or unnecessary personal information to contact forms.
• Any collection involving input, audio, video or browsing activity must be explicitly reviewed against the enabled features and approved scope.
• Data sale, advertising use or model training is not authorised by this evaluation notice. Any existing restrictions on those uses remain in force.
• Purposes, recipients and restrictions must be documented before expanding an evaluation.
• This disclosure does not grant permission to process data outside applicable law or an existing agreement.

5. Why we process it

Proposed purposes include endpoint management, threat investigation, email analysis, support, account administration and compliance. Actual purposes and applicable lawful bases must be confirmed for each approved scope. This notice is not itself consent, a processing agreement or a substitute for legally required disclosures.

6. Automated decisions and AI

Automation and AI can triage alerts and propose or execute actions according to configured governance. Some tiers allow automated or AI handling; critical actions require human approval. Confirm the effective policy, disablement controls and available audit records before evaluation. Do not assume every action is human-reviewed, reversible or visible in every interface.

7. Who we share it with

The complete recipient and subprocessor inventory is not yet approved. Review must cover:

• Payment processing, if approved — any Stripe use must be confirmed for the actual payment flow; see Stripe's privacy policy.
• Infrastructure, email delivery and AI providers — identify actual recipients, locations and contractual safeguards for enabled features.
• Your IT provider — establish its access and processing role for the evaluation.

Disclosures to authorities and any transfer on acquisition remain subject to applicable law and existing agreements, including any required notice. This page does not waive those duties or establish an unverified notification procedure.

8. Where it is stored, and for how long

Storage locations and custody across live systems, exports, subprocessors and backups require reconciliation. No verified universal retention or deletion schedule is published here:

• Telemetry and health metrics: effective retention and deletion require verification.
• Security detections and audit logs: retention, access and investigation/legal holds require verification.
• Backup content: configured expiry does not prove removal of all replicas or backups; deletion requires evidence.
• Billing records: applicable tax, accounting and contractual retention duties remain in force.
• Account closure: request the applicable schedule and scope; closure is not proof that every copy has been deleted.

Removing an endpoint or closing an account is not proof of successful uninstall or deletion of local state, credentials, logs or server-side copies. Confirm the outcome on each device and storage system. Existing deletion commitments remain applicable.

9. Your rights

You may ask us to show you the personal data we hold about you, correct it, delete it, export it in a portable format, or restrict how we use it. Write to privacy@cloudcastle.ai. Applicable statutory deadlines, fee restrictions and protections against discrimination remain in force; an operational response-time commitment has not yet been verified.

If an IT provider manages your data, send your request to that provider as well. Contact-route delivery and monitoring have not yet been verified; lack of acknowledgement does not suspend legal deadlines or obligations to assist with a valid request.

Depending on jurisdiction and circumstances, privacy laws in California, Colorado, Connecticut, Virginia and elsewhere may provide access, deletion, correction, portability, objection, opt-out and appeal rights. UK and EEA individuals may have rights under the UK GDPR or GDPR, including the right to complain to a supervisory authority. This page does not limit those rights or rights under an existing agreement.

10. Security

Encryption coverage, key custody, production access controls and audit completeness require evidence for the actual deployment and evaluation scope. This page does not assert universal encryption at rest, universal MFA or verified incident-response readiness. Do not treat a healthy service-status indicator as security or launch approval.

Applicable breach-assessment and notification duties, including any legally required deadlines and contractual commitments, remain binding. A universal 72-hour customer notification outcome has not been operationally verified.

11. Children

CloudCastle is not directed at children under 13, and we do not knowingly collect their personal information. Do not include children's data in an evaluation without appropriate authorisation and privacy review. If you believe we hold a child's data, contact privacy@cloudcastle.ai to request investigation and deletion as required by law.

12. Changes

Changes will be identified on this page. Existing notice, consent and contractual requirements still apply; revising this text does not cancel prior promises or legal duties.

13. Contact

Privacy: privacy@cloudcastle.ai
Support: support@cloudcastle.ai
Security reports: security@cloudcastle.ai
Registered entity and postal-address verification, and contact delivery/monitoring, remain launch blockers.