Privacy Policy
Last updated 08 October 2026 · version 3
Who we are
CloudStorm provides cloud infrastructure, an agentic workspace, sites and shops, endpoint management and mobile device testing.
- Address: 801 W Big Beaver Rd, Ste 300, Troy, MI 48084, United States
- Email: [email protected]
- Phone: +1 (248) 810-5579
In this policy, "we", "us" and "our" mean CloudStorm. "CloudStorm" means the website at oncloudstorm.com, the customer portal at app.oncloudstorm.com, and the APIs behind them.
This policy describes what CloudStorm actually does today. Where something is not built yet, we say so rather than implying it exists.
Who this policy covers
- Visitors to oncloudstorm.com who never sign up.
- Beta waitlist entrants who give us an email address at /beta or through the waitlist pop-up.
- Customers and their users with a CloudStorm account.
- Other people whose details end up in CloudStorm — alert recipients added by you or by us so infrastructure alerts reach them.
What we collect, and why
If you join the beta waitlist
The /beta form asks for one thing: your email address.
The waitlist pop-up on our landing page also asks for your name (required) and your company (optional). Those two values are sent to our server but are not saved — only your email address is stored.
When you submit the form we:
- Create a pending customer record holding your email address. Because that form does not collect a name, your email address is also written into the contact-name and organisation-name fields of that record.
- Add your email address to our marketing contact list at Mailjet, so we can send beta news.
- Send you a confirmation email through Mailgun, and later an approval email containing a sign-up link. We store only a SHA-256 hash of the token in that link. The token expires after 30 days.
- Write a permanent audit record containing your email address, your IP address and your browser's user-agent string.
Why: to run the beta waitlist, to tell you when you are approved, and to keep a record of who asked for access.
Unsubscribing: there is no unsubscribe link in the product yet. Email [email protected] and we will remove you from the mailing list and mark your waitlist record as deleted. The audit record of your original request stays — see How long we keep data.
Your account and your organisation
When you create an account or complete beta onboarding, we collect and store:
- Your name, email address, phone number and postal address.
- Your organisation's name, legal name, tax ID, industry, employee count, country, address, phone number and accounts-payable email address.
- Your acceptance of our Terms and this Privacy Policy — recorded with the document version you accepted, the date and time, your IP address and your browser user-agent.
- Account status information: whether the account is active, suspended or cancelled, the reason and date of any suspension, and the dates of beta request, approval and emails sent.
We can also add free-text notes to your customer record.
Why: to create and run your account, to invoice you, to meet tax and legal obligations, and to prove which version of our terms you agreed to.
Login and security data
For each user we store:
- Email address, a bcrypt hash of your password (never the password itself), full name, phone number, job title, profile photo URL, a short bio, and display preferences (timezone, currency, language, temperature unit, date format, time format).
- Role and permissions, whether you must change your password, whether two-factor authentication is on, failed login attempt count, lockout expiry and last login time.
If you turn on two-factor authentication we also store:
- Your authenticator-app secret, encrypted with a dedicated key.
- Your recovery codes, hashed.
- If you use SMS as a second factor, your phone number in full. This one is stored in plain text, because we have to be able to dial it. We also store the last four digits separately for display.
- One-time SMS codes, hashed, with an expiry and attempt count.
Why: to log you in, to keep other people out of your account, and to stop brute-force attacks.
Payments and billing
- Invoices: invoice number, billing period, amount, status, due date, paid date and the Stripe invoice ID.
- Payments: amount, method, Stripe payment ID, status and date.
- Saved cards: the Stripe payment-method token plus card brand, last four digits and expiry month/year.
We never receive or store full card numbers or security codes. Those go straight to Stripe.
Why: to bill you and to take payment.
Technical records: IP address, browser and activity
- Sessions. Every time a token is issued we record the user, a token ID, issue and expiry times, any revocation time, the IP address and the user-agent string your browser sent. This is not device fingerprinting — we do not run any fingerprinting script. It is the plain user-agent header, which usually says which browser and operating system you use. You can see and revoke your own sessions in the customer portal under Security.
- Audit log. Every privileged action — successful or failed — is recorded with the acting user, the action, the target, a JSON record of what changed, your IP address, your user-agent, and any error message. Those change records often contain email addresses.
- Failed logins from unknown email addresses are recorded with the IP address and user-agent, but not the email address that was typed.
Why: security, fraud prevention, incident investigation and an accountability trail for administrative actions.
Things you create in CloudStorm
- AI worker role definitions: name, role, description, system prompt text and tags.
- Your table column preferences, so your view follows you between devices.
- Your profile bio.
Why: to provide the features you are using.
Credentials you connect
If you connect your own third-party account (Anthropic, OpenAI, GitHub, Bitbucket, Twilio and similar), we store the secret encrypted with a dedicated key, plus non-secret settings and a display label such as your username on that service.
These are write-only by design. There is no screen or API that shows a stored secret back to anyone, including us. The system only ever exposes a yes/no flag saying whether a secret is set, and decrypts it in memory for the duration of a single request.
For Bitbucket specifically, the connection requires your Atlassian account email address as well as an API token, because that is what Bitbucket's API needs.
Why: so CloudStorm can act against your own accounts on your behalf.
Images and documents
- Profile photos. Your profile photo URL is a free-text field. If you point it at an outside website, that website will see the IP address of everyone who views your profile.
- Branding images (logos, favicons, social images) are public.
If you do not have a CloudStorm account
Your details may still be in CloudStorm if:
- You are an alert recipient. A CloudStorm customer, or we, can add an email address and phone number to an alert group so infrastructure alerts reach you. There is no self-service way for you to remove yourself. Email [email protected] and we will remove you.
- You tried to log in and failed. We keep the IP address and user-agent of failed login attempts, including from people who have never had an account.
Beta programme
CloudStorm is pre-release software.
- Accounts are approved manually. Joining the waitlist does not create a usable account. We review requests and send an approval email with a sign-up link when we are ready.
- Features change, break and get removed. There is no uptime or service-level commitment during the beta.
- Because the platform is still being built, parts of it — including how data is stored — may be rebuilt or migrated.
- We will tell beta participants by email before we do anything that removes or resets their data.
Cookies
We do not use advertising cookies, analytics cookies or tracking pixels. There is no Google Analytics, Google Tag Manager, Meta Pixel, session-replay tool or heatmap tool anywhere in CloudStorm.
Because of that, we do not show a cookie banner. Every cookie we set is strictly necessary to log you in or to run a remote console session. All of them are HttpOnly, meaning JavaScript in your browser cannot read them, and in production all of them are Secure and SameSite=Strict on the oncloudstorm.com domain.
| Cookie | What it does | Lifetime |
|---|---|---|
cloudstorm_customer_at | Signs you in to the customer portal. This is the authentication mechanism. | 15 minutes |
cloudstorm_customer_rt | Refreshes your customer session. Sent only to the /graphql path. | 7 days |
Third-party requests your browser makes
These do not set cookies for us, but they do send data directly from your browser to another company:
- Google Fonts. Every CloudStorm page loads a font from fonts.googleapis.com and fonts.gstatic.com. This happens on the public landing page and login page, before you have an account and before you log in. Google receives your IP address, your user-agent and the CloudStorm page URL.
Companies that process data for us
We only list companies that are actually wired up and in use.
| Provider | What we use it for | Personal data it receives |
|---|---|---|
| Cloudflare | Edge proxy, CDN and firewall in front of oncloudstorm.com, www, app. and api., the Sites & Shops hostnames under cloudstorm.site, and the instance hostnames under cloudstorm.cloud whose server has no public IP address of its own | All traffic to those hostnames: URLs, headers, cookies, request and response bodies (including login submissions) and your IP address. Cloudflare is not in the path for backend01/backend02.oncloudstorm.com, or for an instance hostname whose server has its own public IP address; those connect straight to our servers. |
| Stripe | Card payments and refunds | Your contact email address and organisation name, payment amounts, our internal customer and invoice identifiers, and card tokens. Stripe holds your card details; we do not. |
| Mailgun | All transactional email — password resets, invites, beta confirmations and approvals, invoice and payment notices, alert emails, approval codes | Recipient email address, sender details, subject and the full message body. That body can contain your name, a live password-reset link, a beta onboarding link, an invoice number and amount, or the name of an affected server. |
| Mailjet | Marketing contact list for beta waitlist news | Your email address only. Nothing else is sent. |
| Twilio | Outbound SMS — two-factor codes, approval codes and alerts | Recipient phone number and the message text. Every message is prefixed "CLOUDSTORM: ". If you connect your own Twilio account, your Twilio credentials are sent to Twilio once to check they work. |
| Amazon S3 (us-east-2, United States) | Object storage | Branding images and profile photos. |
| Amazon Secrets Manager (us-east-2, United States) | Retrieving our own service credentials at runtime | No personal data. Listed for completeness. |
| Sentry | Error monitoring and performance tracing for our backend only | Exception messages, stack traces including the values of variables in the failing code, request metadata including request bodies up to roughly 10 KB, the release version and the environment name. Ten percent of requests are traced. Fields whose names look like secrets, tokens, cookies or IP addresses are stripped automatically; a field named something like "email" or "name" is not. Our browser apps do not send anything to Sentry. |
| Google Places API | Address autocomplete when you enter an address | The address text you type. The request is proxied through our server, so your browser never talks to Google here. |
| Google Fonts | Serving the site font | Your IP address, user-agent and the page URL, on every page load. |
| Atlassian Statuspage | Publishing maintenance windows and incidents | Maintenance and incident text we write. No customer data. |
| Anthropic | Checking an Anthropic API key you connect | If you connect your own Anthropic API key, that key is sent to Anthropic to be validated. No customer content is sent. |
| GitHub | The GitHub connection in the customer portal | Your GitHub personal access token, and repository names when listing branches. |
| Bitbucket (Atlassian) | The Bitbucket connection in the customer portal | Your Atlassian account email address and API token, and repository names when listing branches. |
| OpenAI | Checking a customer-supplied OpenAI key | Your OpenAI API key, on a single request to list models. No prompts, completions or customer content are ever sent to OpenAI. |
Browser-based console sessions run entirely on our own infrastructure. No outside company is in that path.
Where your data is stored
Our database and our object storage are in the United States (Amazon S3, us-east-2). Our servers are in the United States.
If you are outside the United States, using CloudStorm means your personal data is transferred to and stored in the United States.
The companies listed above are global businesses and may process data in other countries under their own terms.
How long we keep data
We are being direct here because most of our data has no automatic expiry.
- We do not currently have a general retention or deletion schedule. Personal data is kept indefinitely unless you ask us to remove it and we act on that request manually.
- The audit log is never deleted. It is append-only by design. It holds IP addresses, user-agents, actions and change records that often contain email addresses.
- Session records are never deleted. Revoking a session marks it revoked; the IP address and user-agent stay in the database.
- Password reset tokens and beta onboarding tokens are never deleted. They are marked used. Their expiry limits whether they work, not whether they are stored.
- Used two-factor SMS codes and recovery codes are marked used, not deleted.
- Deleting an account normally means a "soft delete". The record is hidden from the product but every field is retained.
- Server telemetry is the only data with a real limit: alert evaluations for 30 days, and daily check-in and metrics summaries for 90 days.
- Profile photos are overwritten when replaced rather than deleted.
When we do a full deletion
A complete wipe is possible but deliberately hard to do, and it requires more than one person to authorise. It removes payments, invoices, instances, networks, users and the customer record, and cascades to billing methods, connections, agent roles, consent records and support grants.
Even a full wipe is not complete erasure. By design, it writes one permanent snapshot into the audit log that retains: the organisation name, contact name, contact email address, the Stripe customer ID, financial totals, the record of documents accepted, and every portal user's ID, email address and full name. We keep that snapshot for financial and legal record-keeping. We will not tell you your data is gone when part of it is not.
How we protect your data
These are the measures actually in place:
- HTTPS on every CloudStorm site and API.
- Passwords are hashed with bcrypt at cost 12. We never store or see your password.
- Optional two-factor authentication using an authenticator app or SMS. Authenticator secrets are encrypted at rest with a dedicated key; recovery codes and SMS codes are hashed.
- Account lockout after repeated failed logins, and rate limiting on the login endpoint.
- Authentication cookies are HttpOnly, Secure and SameSite=Strict in production, and refresh cookies are restricted to a single path.
- Secrets you connect are encrypted at rest with a dedicated key, and there is no path in the product that reveals them to anyone.
- An audit log of every privileged action, both successful and failed.
- Card data never touches our servers. Stripe handles it.
- Any access to your account for support is recorded as a request with a written reason, an expiry, and your administrator's approval.
What we do not do, so you are not misled: names, email addresses, phone numbers, addresses, tax IDs, IP addresses and two-factor phone numbers are stored in ordinary database columns. They are not individually encrypted. They are protected by access controls on our servers and database.
No system is perfectly secure. We cannot guarantee that data sent to us or held by us will never be accessed by someone who should not have it.
Your choices and your rights
Everything below is handled by a person. Email [email protected]. Please use the email address on the account so we can identify you, and tell us what you want.
- Get a copy of your data. There is no self-service export, download or data-portability feature in CloudStorm. Any download or export buttons you may see in the product are placeholders that do not return your stored data. Email us and we will put a copy together manually.
- Correct your data. You can edit your own profile and your organisation's details in the customer portal. For anything else, email us.
- Delete your account or your data. There is no self-service account deletion. Email us. We will explain what can be removed and what has to be retained, including the audit-log exception described above.
- Come off the mailing list. Email us and we will remove you from the marketing list.
- Stop receiving alert emails or texts if someone added you as a recipient. Email us — there is no self-service opt-out for alert recipients.
- Review and end your sessions. Signed-in customers can see their active sessions, with the IP address and browser recorded for each, and revoke them, in the customer portal under Security.
- Withdraw a support access grant. Your administrators can revoke an approved support access grant.
We aim to respond within 30 days. Depending on where you live, you may have additional rights under local law — tell us in your message and we will deal with your request under that law.
Children
CloudStorm is a business product. It is not directed at children and we do not knowingly collect personal information from children. We do not ask for or verify anyone's age at sign-up. If you believe a child has given us personal information, email [email protected] and we will delete it.
Changes to this policy
We will update this page when what we do changes, and we will change the "Last updated" date at the top. When you sign up, we record which version of this policy you accepted, so there is a durable record of the terms you agreed to. For material changes we will email registered customers.
Contact
CloudStorm 801 W Big Beaver Rd, Ste 300 Troy, MI 48084 United States
Email: [email protected] Phone: +1 (248) 810-5579