This policy covers the KamalCloud website and the KamalCloud application. KamalCloud is operated by Martin Business Consultants, [registered address]("we", "us"). For personal data about the people using the service, we are the controller. For personal data that lives inside the infrastructure you connect, you are the controller and we process it on your instructions.
This website
The marketing site and the docs use Google Tag Manager, a service from Google, to load Google Analytics. Google Analytics sets cookies and collects information about your visit: the pages you view, how you arrived, the links and forms you use, your browser and device, and an approximate location derived from your IP address. We use it to understand which pages are read and which parts of the site work.
You can block these cookies in your browser settings, or install Google'sGoogle Analytics opt-out add-on. The site works the same without them.
The server that hosts the site may also keep standard request logs, such as IP address, browser and page requested, for security and to keep the site running.
What we collect in the app
- Your account: your name, email address and a hashed password. We never store the password itself.
- Sessions: for each sign-in, the IP address and browser it came from, so you can recognise your sessions and we can spot abuse.
- Team membership: who belongs to which account, in what role, and who invited them.
- Infrastructure you connect: cloud provider and git host credentials, servers, apps, environments, domains, secrets and variables, backup settings and SSH keys. Credentials and secrets are encrypted; see Security.
- Activity: deployments, tasks, backups, restores and shell sessions, each with who ran it and when, plus the output of runs. What is typed into a shell is not stored.
- Billing: our payment processor's customer and subscription identifiers. We do not see or store card numbers.
- Correspondence: whatever you send us when you contact us.
The data inside your applications and databases stays on your servers. KamalCloud does not copy it, except where you configure backups, which go to storage buckets you own.
Why we use it
- To provide the service you signed up for (performance of a contract).
- To keep it secure, for example rate limiting, abuse prevention and investigating incidents (legitimate interests).
- To bill you and keep the records the law requires (contract and legal obligation).
- To email you about the service: password resets, invitations, and the notifications you turn on. We do not send marketing email without your consent.
We do not sell personal data, and we do not use it for advertising.
Who else processes it
- Hosting: [hosting provider and region], where the application and its database run.
- Email delivery: [email provider], for account and notification email.
- Payments: Stripe, for subscriptions and invoices, if you are on a paid plan.
- Website analytics: Google, through Google Tag Manager and Google Analytics, for visits to the marketing site and the docs.
Some data goes only where you point it:
- Your cloud providers and git hosts, when KamalCloud acts on your connected accounts
- Your backup buckets
- The Slack, Discord, email or webhook destinations you configure for notifications
International transfers
Where personal data leaves the [EEA/UK], we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep it
- Account and infrastructure data: for as long as your account exists.
- After you cancel: your data is kept, so the account can be reactivated, until you ask us to delete it. We then delete it within [30] days, apart from records we are legally required to keep, such as invoices.
Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, and object to or restrict how we use it. Email ted@martinconsultants.business and we will respond within one month. You can also complain to your local data protection authority.
Children
KamalCloud is a tool for businesses and developers, and is not meant for anyone under 16.
Changes
If we change this policy in a way that matters, we will update the date above and tell account owners by email before the change takes effect.
Contact
Martin Business Consultants, [registered address]. ted@martinconsultants.business