AT A GLANCE
We use account information to run your workspace, host your projects, and manage subscriptions. Stripe handles payment details. Files you publish are public, while account and database access are controlled separately.
01 Who this covers
This policy describes how CloudAuro handles information through cloudauro.com, its customer dashboard, hosting services, managed database APIs, and related service communications. It also explains the difference between CloudAuro account data and information collected by independently operated websites hosted on CloudAuro.
02 Information we handle
- Account information: your name, email address, password hash, verification status, account settings, and authentication or recovery records. CloudAuro stores password hashes rather than plaintext account passwords.
- Project information: uploaded website files, project names, deployments and file manifests, domain names, DNS verification records, database structures and records, and scoped API credentials.
- Staff login information: we store manager-created staff names, email addresses, password hashes, and authentication sessions for private website inboxes. Credentials from the retired visitor-account feature may remain as inactive archived records.
- Billing information: selected plan, subscription and payment status, billing-event references, and Stripe customer, subscription, and checkout identifiers. CloudAuro does not directly store full payment-card numbers or card security codes.
- Technical information: IP addresses, request paths, timestamps, response codes, security events, administrative actions, and storage or bandwidth usage. Our reverse proxy and service providers may collect additional connection and browser information.
- Communications: information you choose to send when contacting CloudAuro about your account, support, or privacy.
03 How we use information
We use information to create and authenticate accounts; deliver verification and recovery emails; publish and maintain websites; operate databases and staff inbox logins; verify domain ownership and configure HTTPS; process subscriptions; enforce plan limits; provide support; investigate abuse; and troubleshoot, secure, back up, and recover the service.
We may also retain or disclose information when required by applicable law or reasonably necessary to investigate fraud, respond to legal requests, or protect the service and its users.
04 Service providers
Some information is processed by providers that help operate CloudAuro:
- Stripe processes payments and provides checkout and billing management. Payment information entered into Stripe's pages is handled by Stripe. Read Stripe's privacy policy.
- Cloudflare provides DNS, traffic proxying, security, and custom-domain certificate services. It processes connection information and domain-validation information. Read Cloudflare's privacy policy.
- Email delivery providers process recipient addresses and service-email contents to deliver account verification, recovery, and other communications.
Information is stored on CloudAuro-operated infrastructure and may also be processed by providers in other countries. Providers' handling of information is described in their own policies and agreements.
06 Hosted websites & visitor data
Published HTML, images, scripts, and other static website files are accessible to visitors. Do not upload passwords, private keys, or confidential information as public website files. Taking a site offline or deleting it cannot recall copies already downloaded or cached by others.
Website operators choose what information their sites collect and place in managed databases. They are responsible for their own privacy notices, permissions, lawful collection and use, and responses to their visitors' requests. Contact the website operator first about information you supplied to a hosted website. CloudAuro handles that information to provide the hosting and database services.
07 Retention & deletion
Account and project information is retained as needed to operate the service. Deployment history and backups may contain earlier versions of information. Logs, billing references, and security or audit records may remain for operational, accounting, legal, or abuse-prevention purposes.
You can delete projects and managed databases through the dashboard. Deleting a project preserves its linked database so it can be reused; delete that database separately if you no longer need it. Account deletion initiates background cleanup and does not mean that every backup, provider record, or legally required record is immediately erased. Cancel an active subscription before requesting account deletion.
Retention depends on the type of record and its purpose. This policy does not promise a single deletion deadline for all systems, backups, or providers.
08 Security
CloudAuro uses measures including password hashing, session and API authorization, tenant access checks, upload validation, and HTTPS in its public deployment. Access to operational systems is restricted to authorized administration. No online service or security measure can guarantee complete protection against every incident.
09 Your choices & requests
You can update account details and passwords, manage billing, revoke scoped database tokens, and delete projects or databases using the available dashboard controls. You can request account deletion from account settings.
Depending on applicable law, you may have additional rights to request access, correction, deletion, a copy of personal information, or limits on certain processing, and to raise concerns with a relevant regulator. Contact us about a request; we may need to verify your identity and assess any applicable exceptions. Do not send your password, recovery codes, or API secrets.
10 Policy updates
We may update this policy when the service or its information practices change. The date above identifies the latest revision. We will provide any additional notice or choices required by applicable law.
11 Contact CloudAuro
Use our contact form for privacy questions and personal-information requests. Include the relevant account email or website address, but do not include passwords or API secrets.