Controller
Cloud2Gether determines the purposes of processing for website visits, demo requests, direct marketing choices, user and organization accounts, service administration, billing, fraud prevention, security and legal compliance.
Legal / Privacy
Privacy Policy
This notice explains what Cloud2Gether processes, why we process it, how long we keep it and which choices are available to you. It covers our websites, applications, cloud analysis services, AI features and business communications.
Scope and who this notice covers
This notice applies to visitors, prospective customers, customer administrators and authorized users of Cloud2Gether services. It also applies when you contact us, request a demo, create an account, connect a cloud environment, use an integration or interact with an AI feature.
A customer organization may provide additional privacy information to its employees, contractors or other users. When we process personal data solely on that customer's instructions, the customer's notice and agreement with Cloud2Gether also apply.
When Cloud2Gether is controller or processor
The legal role depends on who decides why and how the data is used.
Processor
For customer cloud inventory, configurations, tags, IaC information, costs, relationships, snapshots and other Customer Data submitted or connected to the platform, Cloud2Gether generally processes data on the customer's documented instructions.
Customers are responsible for having an appropriate legal basis and permissions for the Customer Data they make available to Cloud2Gether. Processing terms, security commitments and deletion instructions should also be documented in the customer agreement or Data Processing Addendum (DPA).
Data we process
We apply data minimization: the categories below are processed only when relevant to the service or interaction you choose.
| Category | Examples | Typical source |
|---|---|---|
| Account and organization | Name, business email, job title, organization, team, user role, language, account status and authentication identifiers. | You, your organization or an identity provider |
| Commercial and support | Demo-form answers, cloud environment choices, number of cloud accounts, messages, support history, meeting notes and communication preferences. | You, your organization or our CRM/support channels |
| Billing and transaction | Plan, subscription status, invoices, payment status, dates and limited payment-method details. Full card data may be handled by a payment processor. | You, your organization or payment providers |
| Cloud connection | Account identifiers, tenant/project/subscription information, role or service-account details, connection credentials and sync logs needed to maintain authorized connections. | Your organization and connected cloud providers |
| Cloud and IaC metadata | Resource inventory, names, tags, configurations, relationships, account/region context, cost and usage data, IaC definitions or references, drift findings, dependency signals and generated action plans. | Connected providers, integrations and content supplied by your organization |
| AI interactions | Prompts, instructions, selected platform context, outputs, feedback and safety or diagnostic metadata related to an AI interaction. | You and the platform context used for the requested feature |
| Technical and security | IP address, browser/device details, timestamps, session and authentication events, audit logs, error data and abuse or security signals. | Your browser, device, identity provider and our systems |
| Website preferences | Language, cookie choices and limited analytics or campaign data where enabled and permitted. | Your browser and consent choices |
Resource names, tags, IaC files and support messages can contain personal data or secrets if users place them there. Avoid adding personal or sensitive information that is not needed for cloud management, and never place credentials in prompts, tickets, tags or resource names.
Why we use personal data and our legal grounds
| Purpose | What it includes | Typical legal ground |
|---|---|---|
| Provide and administer the service | Create accounts, authenticate users, run authorized analyses, maintain integrations, deliver AI features and provide support. | Contract performance or steps requested before a contract |
| Operate, secure and improve | Monitor availability, troubleshoot, prevent misuse, protect accounts and understand feature performance. | Legitimate interests, contract performance and legal obligations |
| Billing and records | Manage subscriptions, invoices, tax and accounting records, disputes and contractual rights. | Contract performance and legal obligations |
| Sales and customer communication | Respond to demo requests, provide requested information and manage the commercial relationship. | Pre-contractual request and legitimate interests |
| Optional marketing | Send product news, educational content or promotions when permitted. You can opt out at any time. | Consent where required; otherwise legitimate interests subject to your right to object |
| Compliance and claims | Respond to lawful requests, enforce agreements, investigate incidents and establish or defend legal claims. | Legal obligations and legitimate interests |
The applicable legal ground may vary by country and context. Where consent is the basis, refusing or withdrawing consent does not affect service processing that relies on another valid ground.
Connected cloud environments, credentials and AI
- Connect
Your organization authorizes a provider or integration.
- Analyze
Cloud2Gether reads permitted metadata and generates the requested result.
- Control
Your team reviews recommendations and decides what, if anything, to change.
Cloud2Gether supports authorized, read-only connections to cloud providers. Depending on the provider and connection method, this can involve access keys, delegated roles, application/client credentials, service-account keys or API credentials. Read-only access means Cloud2Gether does not create, modify or delete cloud resources; it does not mean every metadata field returned by a provider is anonymous.
We use connected data to discover and classify resources, compare executions, map relationships, measure IaC coverage and drift, evaluate provider dependency, analyze cost where enabled, generate findings and produce requested AI assistance or action plans.
Cloud2Gether does not require access to the contents of workloads merely to provide infrastructure inventory and analysis. Customers should scope provider permissions to the documented minimum and rotate or revoke credentials whenever a connection is no longer needed.
AI features may send the prompt and the minimum relevant platform context to specialized service providers acting under contractual restrictions. Customer Data must not be used for a materially different purpose without a separate notice, appropriate agreement and valid legal basis.
Infrastructure data can be confidential even when it does not identify a person. Contractual confidentiality and security commitments also apply to that data.
International data transfers
Cloud2gether Corp is established in the United States. Cloud2Gether and its service providers may therefore process data outside the country where a customer or user is located. Before a regulated international transfer, we assess the role of the parties, the destination and the lawful transfer mechanism.
Where the Brazilian LGPD applies, safeguards may include an adequacy decision, ANPD standard contractual clauses or another mechanism permitted by Article 33 of the LGPD and ANPD Resolution 19/2024. Where the GDPR applies, safeguards may include an adequacy decision or approved standard contractual clauses, together with supplementary measures where required.
You may request information about the applicable destination countries and a copy of the relevant transfer safeguards, subject to the protection of commercial and security-sensitive information.
Application, database, backup and replication locations depend on the production configuration and service providers in use. For the data-location information applicable to your service, contact [email protected] before onboarding or connecting a production environment.
How long we keep data
We keep data only for the period needed for its stated purpose, contractual commitments, security and legal obligations. The principal criteria are:
| Data | Retention rule |
|---|---|
| Cloud snapshots and analysis history | According to the subscribed plan, currently 8, 15, 30 or 45 days, unless the customer agreement states otherwise. |
| Account and organization records | For the active relationship and a limited period after deactivation for reactivation, support, security and dispute handling. |
| Sales, demo and support records | Until the request or relationship is concluded, then for a limited period justified by follow-up needs, objections and legal claims. |
| Billing, tax and contracts | For the periods required by applicable accounting, tax and legal rules. |
| Security and audit logs | For a proportionate period based on security, fraud prevention, investigation and audit needs. |
| Backups | Removed or overwritten through the ordinary backup lifecycle, unless preservation is legally required. |
When retention ends, data is deleted or anonymized within the technical limits of the systems. A customer contract or DPA may define more specific return and deletion instructions for Customer Data.
Security and incident response
We maintain technical and organizational measures designed to protect data against unauthorized access, loss, alteration, disclosure or destruction. Controls are selected according to the nature of the data, processing scope, current technology and risk, and are reviewed as the service evolves.
No internet service can guarantee absolute security. If a personal-data incident presents a relevant risk or harm, Cloud2Gether will follow applicable notification duties to customers, affected individuals and regulators. Customers should immediately report suspected credential exposure or unauthorized access and rotate affected cloud credentials.
Your privacy rights
Depending on the law that applies, you may have the right to:
- Confirm whether we process your data and access it
- Correct incomplete, inaccurate or outdated data
- Request deletion, anonymization, blocking or restriction where applicable
- Request portability where legally available
- Withdraw consent and object to certain processing, including direct marketing
- Receive information about sharing and international-transfer safeguards
- Request review of certain solely automated decisions that affect your interests
- Complain to the ANPD, an EU data protection authority or another competent regulator
Send a request to [email protected]. We may need to verify your identity and authority before responding. Requests are free, except where the law permits a charge for manifestly unfounded or excessive requests.
For Customer Data processed on behalf of your employer or another Cloud2Gether customer, contact that organization first. We will assist the customer as required by law and the applicable DPA.
Children and teenagers
Cloud2Gether is a business service and is not directed to children. We do not knowingly request personal data from children. If you believe a child provided data to us, contact [email protected] so we can evaluate and take appropriate action.
Changes to this notice
We may update this notice when our services, providers or legal obligations change. We will update the date above and, when a change materially affects how personal data is used, provide an appropriate additional notice.
Version history
- Initial published version
Contact and data protection channel
For questions, privacy requests or complaints, contact the Cloud2Gether privacy channel:
- Privacy channel
- [email protected]
- Data controller
- CLOUD2GETHER CORP., a Delaware stock corporation · Delaware file no. 10391380 · EIN 41-2512940
- Registered office
- 13 W Main St, PO Box 953, Felton, Kent County, Delaware 19943, United States
- Mailing address on file
- 2 S Biscayne Blvd, Suite 2450, Miami, Florida 33131, United States
You may also submit a complaint to the Brazilian National Data Protection Authority (ANPD) or the competent authority in your jurisdiction. ANPD
Trademark ownership
The C2G Cloud2Gether trademark (USPTO Reg. No. 7,676,210) is owned by INNOVT TECHNOLOGY LLC.