Privacy policy

Who we are

CloudDeck is operated by [Company legal name] ([ABN / company number]), of [registered address] (“we”, “us”). This policy explains how we handle personal information when you visit this website, request a demo, or use the CloudDeck portal. Contact us about privacy at [privacy contact email].

What we collect

• Demo requests: your name, work email, company, the range of clients you manage, anything you write in the message field, and a one-way hash of your IP address used for abuse prevention.
• Portal accounts: email address, role (owner, admin, operator or viewer) and the client tenant you belong to, plus the session cookies that keep you signed in.
• Audit log: each action taken in the portal, who took it, when, on which resource, and the IP address it came from.
• AWS resource details: when you use the portal, CloudDeck reads instance names, IDs, tags, state and CloudWatch metrics from your AWS account through the role you deployed. These are displayed, not stored, apart from what the audit log records.
• Error reports: if the portal hits an error, a technical report may be sent to our error monitoring service with secrets and personal data removed.

We never collect or store AWS access keys.

How we use it

• To reply to your demo request and arrange a call.
• To provide the portal: sign-in, permissions, the actions you request, and the audit trail.
• To keep the service secure, prevent abuse and fix faults.
• To meet legal obligations.

We don’t sell personal information and we don’t use it for advertising.

Cookies and local storage

The portal uses strictly necessary cookies to keep you signed in. This website uses no analytics or advertising cookies. The label printer on the home page remembers the name you type in your browser’s session storage; it stays on your device and is cleared when you close the tab.

Who processes it for us

• Vercel hosts the website and portal.
• Supabase provides the database and authentication.
• Amazon Web Services: CloudDeck calls AWS APIs in the account you connect; that data stays in your account.
• Sentry receives scrubbed error reports, when error monitoring is enabled.
• Resend delivers notification emails, when email is enabled.

Some of these providers store data outside Australia. We rely on their contractual commitments to protect it.

How long we keep it

Demo requests are kept for up to [retention period] unless you become a customer. Portal account data is kept while your organisation uses CloudDeck. Audit logs are kept for [audit retention period] so actions can be traced.

Your choices

You can ask to access, correct or delete your personal information by contacting [privacy contact email]. If you’re unhappy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to your local data protection authority.

Security

Our security model describes how access to your AWS account is scoped and how portal data is isolated.

Changes to this policy

We’ll update the date above when this policy changes, and tell customers about material changes.