Privacy Policy
We take your privacy seriously. This policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it, in plain language.
1. Who we are
CloudScale Consulting ("we", "us", "our") is a technology consultancy and software product business. We are the data controller for any personal information collected through this website and our products.
CloudScale Consulting
Company Registration: 2022/874901/07
VAT Number: 4480310319
Data controller contact: [email protected]2. What data we collect and why
We collect only the data we genuinely need. Here is what we collect and the lawful basis for doing so:
Data: Your name and email address when you contact us via email.
Purpose: To respond to your enquiry and provide support.
Legal basis: Legitimate interest / contractual necessity.
Data: Email address and billing information collected by PayPal at checkout, and the email address you give, if any, when you click the PayPal subscribe button in one of our plugins.
Purpose: To process your subscription payment, issue receipts, and manage renewals, and to contact you if a checkout you started does not complete.
Legal basis: Contract performance.
Note: Payment card details are entered directly into the PCI-DSS compliant checkout operated by PayPal (our payment provider) and are used only to process your payment. In line with PCI DSS, your full card number is not stored by CloudScale Consulting or PayPal. PayPal's privacy policy applies to data handled at checkout: paypal.com/privacy/merchant.
Data: This website does not use third party analytics, tracking pixels, or cookies beyond those strictly necessary for operation. No Google Analytics, Facebook Pixel, or similar services are installed on cloudscale.consulting.
Legal basis: N/A, we do not track visitors on this website.
Data: Data processed by our plugins (SEO metadata, security logs, analytics, backups, scan results) is stored within your own WordPress database on your own server. Backups leave your server only when you configure a cloud destination in the plugin settings: your own S3, Google Drive, Dropbox or OneDrive account, or the optional CloudScale Managed Cloud Backup service described below.
Data: CloudScale Managed Cloud Backup, an optional paid service in the Backup & Restore plugin. When you subscribe, the plugin uploads your backup files (a copy of your site's database and files, which can include personal data of your site's users) to storage CloudScale operates on Amazon Web Services, in the region nearest your site or the one you choose. Backups are encrypted at rest with keys managed by Amazon S3, and the plugin can also encrypt each backup with your own password (AES-256) before it leaves your server. To do this the plugin sends api.cloudscale.consulting your licence key, your site's hostname, and the average round-trip time it measured to each storage region; it receives a short-lived upload credential, and backup files go straight to the storage, not through our API. The plugin also sends, only when you use them, the email and message you type into its contact form with your hostname and licence key, and the product name, hostname and optional email you give when you click the PayPal button (so a checkout that does not complete can be followed up).
Purpose: To store your backups off site and make them available to restore, to bill the subscription, and to answer your messages.
Legal basis: Contract performance. For personal data inside your backups, you are the controller and CloudScale Consulting processes it on your behalf, only to store it and return it to you.
Retention: Each backup is deleted automatically 90 days after it is uploaded, or sooner if you delete it. Backups are deleted within 90 days of cancellation.
Data: Requests the Cyber & DevTools and SEO AI Optimizer plugins make to our API at api.cloudscale.consulting. Each plugin's readme lists every endpoint under "External services", with what is sent and when. In summary: the address a request comes from (the own-IP lookup, which sends nothing else); a plugin, theme or server component name and version, and nothing that identifies your site (vulnerability lookup); the first 5 characters of a password's SHA-1 hash, never the password or the full hash (the optional breached-password check, which runs when a password is set); nothing at all (the IP reputation list, software release list and AI model list downloads); the AI request data, which for a content feature you run (an image prompt, an SEO description) includes that post's title and its text or a summary of it, and, for billing, your email address and site URL (the optional Managed AI subscription); your licence key and the domain to scan (the optional Active Vulnerability Verification); fix-recipe usage counts and failed-check identifiers, each sent with your licence key and so linked to your licence, not anonymous (two opt-in features, off by default). Visitor data, database contents, passwords and your own API keys are never sent to us, and post content only as part of an AI feature you run on that post with Managed AI switched on.
Purpose: To provide the feature that made the request: keeping your own server off your own blocklist, matching installed software against published vulnerabilities, supplying AI capacity, scanning a site you own, and billing.
Legal basis: Contract performance for subscription features; legitimate interest for the security lookups, each of which can be switched off in the plugin settings.
Retention: Rate-limiting records are deleted after one hour. A Managed AI request that runs asynchronously is held only while the reply is collected and is deleted within an hour of completion; no other copy of AI request content is kept. Ordinary web-server access logs, holding the requesting address and the URL asked for, are kept for routine operations and abuse prevention only. Vulnerability verification findings are stored for the life of the subscription so that scans can be compared. Licence and billing records are retained as described in section 5.
3. Third party services
We use the following third party services in the delivery of our products:
- PayPal: payment processing. PayPal collects billing information and securely processes your card details at checkout without storing the raw card number. Their privacy policy is at paypal.com/privacy/merchant.
- Amazon Web Services: storage for CloudScale Managed Cloud Backup (Amazon S3), in the region nearest your site or the one you choose. Their privacy notice is at aws.amazon.com/privacy.
- Anthropic / Google / OpenAI: AI API providers used optionally within our plugins. With your own API key, your content is sent from your server to the AI provider under your account and we never see it. Under the Managed AI subscription, the plugin sends that content to api.cloudscale.consulting and we forward it to Anthropic or Google under our account; we do not use it to train models and do not retain it after the reply. Their privacy policies apply: anthropic.com/privacy and policies.google.com/privacy.
- Cloudflare: our website and DNS provider. Cloudflare may process request metadata (IP addresses, request headers) for security and performance purposes. Their privacy policy is at cloudflare.com/privacypolicy.
We do not sell your personal data to any third party and we do not share it beyond what is necessary to deliver the services described above.
4. Cookies
This website does not use tracking or advertising cookies. The only cookies that may be set are strictly necessary session cookies required for the checkout process (set by PayPal). No cookie consent banner is required for our own website content.
Our Site Analytics WordPress plugin is designed so that the websites using it also require no cookie consent banner: all data is stored server side with no client side tracking cookies.
5. Data retention
We retain personal data only for as long as is necessary for the purposes described in this policy:
- Support correspondence: retained for up to 2 years after the enquiry is resolved.
- Billing records: retained by us and our payment provider PayPal in accordance with applicable legal obligations (typically 7 years for tax purposes).
- Managed Cloud Backup files: deleted automatically 90 days after upload, or sooner if you delete them.
- Subscription data: retained for the duration of your subscription and for 12 months after cancellation for legal and tax compliance.
6. Your rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your data ("right to be forgotten"), subject to legal obligations to retain certain records.
- Portability: receive your data in a structured, machine readable format.
- Objection: object to processing of your data based on our legitimate interests.
- Restriction: request that we restrict processing of your data in certain circumstances.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the relevant supervisory authority in your country.
7. International transfers
CloudScale Consulting is based in South Africa. If you are in the European Economic Area or United Kingdom, your data may be transferred to and processed in South Africa. We ensure appropriate safeguards are in place in accordance with applicable data protection law.
PayPal processes data in accordance with GDPR compliant standard contractual clauses where required.
8. Security
We take reasonable technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure, or alteration. This website is served over HTTPS. Support emails are handled via secure email.
No method of transmission over the internet is completely secure. While we use commercially reasonable measures, we cannot guarantee absolute security.
9. Applicable law
This Privacy Policy is governed by the laws of the Republic of South Africa, including the Protection of Personal Information Act 4 of 2013 (POPIA).
Where applicable, this policy also complies with the EU General Data Protection Regulation (GDPR) and UK GDPR for users in those jurisdictions.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We will notify active customers of material changes by email where required by applicable law.
Continued use of our website or products after changes are made constitutes acceptance of the updated policy.
11. Contact
For any privacy query, data access request, or complaint, please contact us:
CloudScale Consulting
Company Registration: 2022/874901/07
VAT Number: 4480310319
Email: [email protected]
Website: https://cloudscale.consulting
Anything here that is unclear, or that you want in writing differently, ask.
Get in touch