Privacy Policy

Introduction

ChenPo LLC, doing business as CloudRepo ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our repository management services. ChenPo LLC is a North Dakota limited liability company.

We wrote this policy to be clear and straightforward. If anything here is confusing, reach out to us at privacy@cloudrepo.io and we will explain it in plain language.

Information We Collect

Information You Provide

• Account Information: We collect email addresses where we need them, including on signup forms before signup finishes, and the account and billing details you give us.
• Repository Data: We store the artifacts and repositories you upload to our service. Your artifacts are yours. We do not scan, analyze, or mine their contents.
• Support Communications: We collect information you provide when contacting our support team.
• Payment Information: We use third-party payment processors and do not store credit card information directly.

Information Collected Automatically

• Usage Data: We collect information about how you interact with our services, including API calls, bandwidth usage, and storage metrics.
• Log Data: Our servers automatically record information including IP addresses, browser types, and access times. Logs may contain user identifiers for troubleshooting purposes.
• IP Addresses: We collect IP addresses to protect our users and our infrastructure. IP addresses captured during signup are retained for 30 days for abuse detection and incident response.
• Cookies: We use cookies and similar technologies as described in the Cookies section below.
• Website Visitor Identification: On our website and our documentation, we use Apollo.io and Snitcher to learn which companies, and sometimes which people, visit our pages, as described in the Cookies section below.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send you service notices, technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues
• Protect against fraudulent or illegal activity

Cookies

We use cookies and similar technologies to operate our service and understand how people use it. Here is what we use and why:

Strictly Necessary Cookies

These cookies are essential for our service to function. They maintain your session and authenticate your requests. You cannot opt out of these cookies without losing access to authenticated features.

Analytics Cookies

We use PostHog to understand how visitors use our website and product and to detect errors. We also record visits to our website and product (session recordings). We collect email addresses where we need them, including on signup forms before signup finishes, and use them, with account information and device, network, usage, error and session-recording data, to run, support, debug and improve our service. When we know who you are, we link that data to you.

Website Visitor Identification

On our website, www.cloudrepo.io, and our documentation, www.cloudrepo.io/docs, we use Apollo.io and Snitcher to learn which companies visit our pages, so we can reach teams weighing a move to CloudRepo. They do not run in the CloudRepo portal.

Apollo's script loads from our own servers, or directly from Apollo when ours is unavailable, and it sends Apollo, directly from your browser, the web address of each page you open (including anything after the page name), the site that sent you here, campaign tags, your IP address and details of your browser and device. It keeps an ID for your browser in cookies or browser storage for this site. Apollo may load a script from LiveIntent, which can match your browser to a hashed copy of an email address LiveIntent already holds, so Apollo can sometimes name the person as well as the company. LiveIntent itself receives the web address of the page you open, an ID for your browser, your IP address and the values of any ID cookies that other companies, such as advertising and analytics providers, have set in your browser.

Snitcher's script also loads from our own servers, and everything it sends goes to Snitcher through them: the web address and title of each page you open (including anything after the page name), the page that sent you there, how long you stay on each page, an ID for your browser that the script keeps in its own cookie and in browser storage for this site, an ID for each visit, and details of your browser and device, including hashes the script computes from them (such as your screen size, time zone, language, graphics hardware and installed fonts). Our servers pass on your IP address so Snitcher can identify your company.

Each says how it uses what it receives in its own policy: Apollo's privacy policy, Snitcher's privacy policy and LiveIntent's privacy policy.

To opt out, turn on Global Privacy Control in your browser: while it is on, our website and documentation do not load these scripts. You can also ask Apollo to remove you from its database on its removal page, ask Snitcher at support@snitcher.com, and clear this site's data in your browser to delete the IDs.

Support Cookies

We use Intercom for customer support. Intercom may set third-party cookies to maintain your support conversation state and provide a seamless help experience.

Booking Cookies

We use Calendly for the booking calendar on our /meet page, and Calendly sets its own third-party cookies inside that calendar.

Managing Cookies

You can manage or refuse cookies through your browser settings. Most browsers allow you to block or delete cookies in their privacy or security settings. Note that disabling strictly necessary cookies may prevent you from using authenticated features of our service. For more details, consult your browser's help documentation.

Data Sharing and Disclosure

We do not sell, trade, rent, or market your personal information to third parties. We put our users first and only share your information in the following limited situations:

• Service Providers: We share data with third-party vendors who perform services on our behalf (e.g., payment processing, email delivery, analytics, customer support). For a complete list, see our subprocessor list.
• Legal Requirements: We may disclose information if required by law or in response to valid legal requests.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We would notify you before your information becomes subject to a different privacy policy.
• Consent: We may share information with your explicit consent.

If you need a formal data processing agreement, one is available on our Trust Center.

Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Automated code analysis and security testing gates in our development pipeline
• Access controls and authentication mechanisms
• Background checks on all personnel with access to production systems
• Incident response procedures

Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. Cancelling your subscription does not by itself delete your data. When you submit a verified deletion request to security@cloudrepo.io, we will within 30 calendar days delete the data that procedure covers (your artifacts and repository data in object storage) unless we are required to retain it for legal purposes. Deletion is an operator-run procedure, and it does not reach every record that may contain your personal information. We state plainly what it does not reach: your account and identity records (the organization record, user records, authentication credentials, API tokens, and SSO configuration) are retained, and we have no automated facility to remove them today. Repository metadata rows are retained with storage counters reset to zero, and prior copies remain recoverable from object versioning and point-in-time recovery for their retention window.

Log retention: We keep logs as long as we need them for security, operations and debugging. Logs may contain user identifiers (such as user IDs and IP addresses) for troubleshooting purposes.

Signup IP retention: IP addresses captured during account signup are retained for 30 days in a forensics record used for abuse detection and incident response.

Your Rights and Choices

You have the following rights regarding your information:

• Access: You can request a copy of the personal information we hold about you.
• Correction: You can request that we correct inaccurate information.
• Deletion: You can request that we delete your personal information. Verified deletion requests are fulfilled within 30 calendar days, to the scope and subject to the retention exclusions described under Data Retention above.
• Portability: You can request your data in a machine-readable format. We provide exports in CSV or JSON format.
• Withdraw Consent: Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.
• Email choices: The notification emails set up for your organization in the admin portal stop when they are removed there. If you get one you did not ask for, forward it to support@cloudrepo.io and we will take you off it.

To exercise any of these rights, contact us at privacy@cloudrepo.io.

International Data Transfers

All customer artifacts and account data are stored in the United States (AWS US-West). Certain subprocessors we use for operational purposes (see our subprocessor list) process limited categories of data (including billing contacts, operational records, support conversations, email addresses, and error and session metadata) and may do so outside the United States. We ensure appropriate safeguards are in place to protect your information in accordance with this privacy policy.

Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it.

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information.

Categories of Personal Information We Collect

• Identifiers: Name, email address, IP address, account ID
• Commercial Information: Billing records, subscription history, service usage
• Internet Activity: Browsing history on our site, interactions with our services, API usage logs
• Professional Information: Company name, job title (when provided)

How We Use This Information

We collect and use personal information for the business and commercial purposes described in the "How We Use Your Information" section above, including providing our services, processing payments, improving our platform, and communicating with you.

We Do Not Sell or Share Your Personal Information

CloudRepo does not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

Your CCPA Rights

• Right to Know: You can request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You can request that we delete personal information we have collected from you.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will not receive different pricing or quality of service for making a request.

Submitting a Request

To submit a verifiable consumer request, email us at privacy@cloudrepo.io from the email address associated with your account. We may need to verify your identity before processing the request. We will respond to verified requests within 45 calendar days. If we need additional time (up to 45 more days), we will let you know in writing.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) provides you with additional rights regarding your personal data.

Controller and Processor

CloudRepo acts as a data controller for your account, billing and contact details (including email addresses entered on signup forms before signup finishes) and the usage data we collect, and as a data processor for the artifacts and repository data you store with us. When we process artifacts on your behalf, we act only on your instructions and do not access, analyze, or use the contents of your artifacts for our own purposes.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Processing Activity	Legal Basis
Providing our services (account management, repository hosting)	Contract performance, Art. 6(1)(b)
Payment processing	Contract performance, Art. 6(1)(b)
Analytics and service improvement	Legitimate interest, Art. 6(1)(f)
Website visitor identification (Apollo.io, Snitcher)	Legitimate interest, Art. 6(1)(f)
Security monitoring and fraud prevention	Legitimate interest, Art. 6(1)(f)
Legal and regulatory compliance	Legal obligation, Art. 6(1)(c)

Your GDPR Rights

In addition to the rights listed in the "Your Rights and Choices" section above, you have the right to:

• Object to Processing: You can object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds.
• Restrict Processing: You can request that we limit how we use your data in certain circumstances.
• Withdraw Consent: Where processing is based on consent (Art. 7(3)), you may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Response Timeline

We will respond to GDPR requests within 30 calendar days. If we need additional time due to the complexity or volume of requests, we will let you know within the initial 30-day period.

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For material changes, we will provide additional notice via email or through our services.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: privacy@cloudrepo.io
• Company: ChenPo LLC d/b/a CloudRepo
• Jurisdiction: North Dakota, United States

Privacy Contact

For privacy-related inquiries, you can also reach our privacy team at dpo@cloudrepo.io.

Legal Information

This Privacy Policy is provided by ChenPo LLC, a North Dakota limited liability company doing business as CloudRepo. Any disputes arising from this policy shall be governed by the laws of North Dakota.