Privacy Policy

1. Introduction

Welcome to CloudNexus. We are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, process, and safeguard your information when you use our cloud infrastructure, hosting services, and related platforms.

By accessing our services, you agree to the practices described in this policy. We recommend reviewing this document periodically for updates.

2. Information We Collect

We collect information necessary to provide, secure, and improve our services. This includes:

2.1 Account Information

• Name, email address, and billing details.
• Authentication credentials (encrypted) and two-factor authentication setup.
• Organization name and role within your account.

2.2 Technical & Usage Data

• Server metrics, resource utilization, and API usage logs.
• IP addresses, device identifiers, and browser information.
• Deployment logs, error reports, and diagnostic data.

2.3 Payment Information

We do not store full credit card numbers. Payments are processed securely via PCI-DSS compliant third-party providers (e.g., Stripe). We retain only the last four digits and expiration date for billing records.

2.4 Customer Data (Data Subject Data)

When you host applications on CloudNexus, you may store data belonging to your users. We collect and process this data solely to maintain your infrastructure. We do not access, analyze, or sell this data.

3. How We Use Information

We use the collected data for the following purposes:

• Service Provision: To provision, manage, and maintain your cloud resources, instances, databases, and storage.
• Billing & Invoicing: To process payments, generate invoices, and manage subscription tiers.
• Security & Compliance: To detect unauthorized access, prevent DDoS attacks, and ensure infrastructure integrity.
• Support: To diagnose issues, respond to tickets, and provide technical assistance.
• Improvement: To analyze aggregate usage patterns and enhance platform performance.
• Communication: To send service alerts, maintenance notifications, and security advisories.

4. Data Sharing & Disclosure

We do not sell your personal information. We may share data only under the following circumstances:

• Subprocessors: We engage third-party vendors for email delivery, analytics, and payment processing. All subprocessors are bound by strict Data Processing Agreements (DPAs).
• Legal Requirements: We may disclose data if required by law, court order, or government authority.
• Business Transfers: In the event of a merger or acquisition, data may be transferred as part of the business assets, subject to confidentiality obligations.
• Consent: We may share data with your explicit permission.

5. Security & Encryption

Security is the foundation of CloudNexus. We implement industry-leading measures to protect your data:

• Encryption at Rest: All storage volumes, databases, and backups are encrypted using AES-256.
• Encryption in Transit: All traffic is secured via TLS 1.3. We support custom SSL certificates and certificate pinning.
• Access Controls: Role-based access control (RBAC), API key rotation, and mandatory MFA for administrative accounts.
• Physical Security: Our data centers are SOC 2 Type II and ISO 27001 certified, featuring 24/7 surveillance, biometric access, and redundant power.
• Vulnerability Management: Continuous penetration testing and bug bounty programs.

6. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active. Upon deletion, data is removed within 30 days, except for billing records required by tax laws.
• Logs & Metrics: Retained for 90 days by default. Custom retention policies are available on Enterprise plans.
• Backups: Retained according to your configured snapshot policies.

7. Your Rights

Depending on your jurisdiction (e.g., GDPR, CCPA), you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete information.
• Erasure: Request deletion of your data ("Right to be Forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing for direct marketing purposes.

To exercise these rights, please contact our Data Protection Officer (DPO) using the details below.

8. Cookies & Tracking

We use cookies and similar technologies to ensure the functionality of our dashboard and website:

• Essential Cookies: Required for authentication, session management, and security.
• Analytics Cookies: Used to understand how users interact with our documentation and marketing pages. We do not use tracking cookies within the secure dashboard.
• Preferences: Store your language and region settings.

You can manage cookie preferences through your browser settings or our cookie consent banner.

9. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or dashboard notification. The "Last Updated" date at the top of this page indicates the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy, your data, or our security practices, please reach out to us.