LEGAL / PRIVACY
Privacy Policy
Everything we hold about you is six rows, and they are the first thing on this page. Every claim below was read out of the code that runs this site rather than out of a template, and where it names a number, that number is the one the server enforces.
The inventory
If it is not one of these six rows, we do not have it.
Each row says why the thing exists, where it lives on our side, and when it is gone. Only one of them depends on you asking, and it is the message you sent us.
| What | Why it exists | Where it lives | Gone after |
|---|---|---|---|
| Your messageName, email, phone, message | You typed it into the contact form, so that we can answer you. | Sent to our support mailbox as an email. Never written to a database. | When you ask |
| Your waiting list sign-upWork email, team size | You joined the Chartroom waiting list, so that we can tell you when there is a place. | Sent to our support mailbox as an email. Never written to a database. | Once we decide |
| Your IP address, browser and referrerWeb server access and error logs | Written by the web server for every page request, as on any website. | Two log files on our own server. Requests for images, fonts and stylesheets are not logged at all. | 90 days |
| A rate-limit recordIn memory only | Stops the forms being abused: five submissions per fifteen minutes. | The server's memory. Never written to disk. | 30 minutes |
| A delivery idApplication log | Lets us trace a message that did not arrive. | Our application log. It holds no name, no address, and no message text. | 90 days |
| Nothing elseNot collected | No cookies, no analytics, no tracking pixels, no fingerprinting, no ad networks, and no third-party scripts. | Our content security policy blocks requests to other origins outright. | Never held |
None of it is sold, shared for advertising, or used for marketing you did not ask for.
Two companies touch it: Amazon Web Services, and the provider that holds our mailbox.
Ask us and we will tell you what we hold, correct it, or delete it. See your rights, or email support@cloudcitycomputing.com.
The policy
The whole document, in fourteen numbered clauses.
Who we are
Cloud City Computing, LLC ("Cloud City Computing", "we", "us", "our") operates the website at cloudcitycomputing.com (the "Website"). We are the controller of the information described in this policy. You can reach us at support@cloudcitycomputing.com.
What we collect
Information you send us
Our contact form asks for four things, all of which you type yourself: your name, email address, phone number, and your message. There is no account to create, no password, and nothing else is requested.
When you submit the form, our server checks the fields, strips control characters, and sends the contents to our own support mailbox as an email through Amazon Simple Email Service. The submission is not written to any database. After it is sent, it exists as an email in our mailbox, the same as if you had emailed us directly.
The waiting list on our Chartroom page asks for two things, both of which you enter yourself: a work email address and the size of your team. It is handled in the same way: it is sent to our support mailbox as an email, and it is not stored anywhere else.
Information collected automatically
Our web server keeps an access log, which is standard for any website and is written by the web server itself rather than by our application. Each entry records the requesting IP address, the date and time, the page requested, the response status and size, the referring page if your browser sends one, and your browser's user agent string. Requests for static files such as images, fonts and stylesheets are not logged at all. There is a second file, an error log, which records the same kind of entry when a request fails.
Two smaller things are worth naming plainly rather than leaving implied. When either form is submitted successfully, our application log records that a message was relayed and the identifier the email service returned for it, so that we can trace a delivery problem. That record does not contain your name, your address, or your message. Separately, to stop the forms being abused, we allow five submissions per fifteen minutes, across both forms, from the same IP address, which means that IP address is held in the server's memory for up to thirty minutes. Neither is used for anything else.
We use this information only to keep the Website running, to investigate errors, and to detect and prevent abuse.
What we do not collect
No cookies, no analytics, no tracking pixels, no advertising, and no third-party scripts of any kind. To be specific rather than reassuring, the Website does not use:
- cookies of any kind, including so-called essential cookies;
- analytics of any kind, first-party or third-party;
- tracking pixels, beacons, session recording, or browser fingerprinting;
- advertising networks, remarketing, or data brokers;
- third-party scripts, fonts, or embedded content. Our fonts are served from our own server and our content security policy blocks requests to other origins outright;
- social media buttons or widgets that report back to their platform. The external links on this site are ordinary links, and they tell LinkedIn or GitHub nothing until you click them.
Why we use it
We use the information above for these purposes and no others:
- To reply to you. If you send us a message, we use your contact details to answer it and to discuss the work you are asking about.
- To tell you about a place. If you join the Chartroom waiting list, we use your address to send you one email, from a person, when there is a place for a team your size. There is no newsletter and no sales sequence.
- To keep the Website secure and working. Server logs let us find errors and identify abuse.
- To meet legal obligations, if we are ever required to.
We do not use your details for anything else. In particular the waiting list is not a mailing list, we do not add you to one, and we do not send you marketing you did not ask for.
If you are in the United Kingdom or the European Economic Area, our legal bases are your request to take steps before entering into a contract (replying to your enquiry, or telling you about the place you asked for) and our legitimate interests in running a secure website and in responding to people who contact us. We do not rely on consent, because we do not do anything that requires it.
Who else handles it
We keep the list of companies that touch your information as short as we can:
- Amazon Web Services. The Website and its form endpoints run on Amazon EC2, and contact form and waiting list submissions are delivered by Amazon Simple Email Service in the US East (N. Virginia) region.
- Our email provider, which holds the support mailbox your message arrives in.
That is the entire list. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to anyone else except where we are legally required to, or where it is necessary to establish or defend a legal claim.
How long we keep it
- Contact form emails stay in our support mailbox for as long as we need them for the conversation you started and for our ordinary business records. We delete them on request.
- Waiting list sign-ups stay in our support mailbox until we have invited your team or decided not to. We delete them sooner on request.
- Server access and error logs, and the application log entries described above, are rotated routinely and kept for no longer than 90 days.
- Rate limiting records exist in memory only, are never written to disk, and are gone within thirty minutes.
How we protect it
The Website is served only over HTTPS. Our form endpoints validate and sanitise every field before use, cap the size of what they will accept, and rate limit submissions. We send strict security headers, including a content security policy that prevents the page from loading or contacting third-party resources. Storing nothing is itself a protection: there is no database of enquiries to breach. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Your rights
Wherever you live, you can ask us to do any of the following, and we will not treat you differently for asking:
- tell you what information we hold about you;
- correct it if it is wrong;
- delete it;
- give you a copy in a portable format;
- stop or limit how we use it.
California residents. Under the CCPA as amended by the CPRA you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and have not done so in the preceding twelve months. We do not offer financial incentives in exchange for personal information.
United Kingdom and European Economic Area. You have the rights of access, rectification, erasure, restriction, portability, and objection under the UK GDPR and the EU GDPR, and the right to lodge a complaint with your supervisory authority.
To exercise any of these, email support@cloudcitycomputing.com. We will respond within 30 days. We may need to confirm your identity first, which for a form submission normally means replying from the address you used.
Children
The Website is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us information, email us and we will delete it.
Where your information goes
We operate from the United States and our servers are located there. If you contact us from outside the United States, the information you send is transferred to and processed in the United States, where privacy laws may differ from those in your country.
Do Not Track
Some browsers send a Do Not Track signal. There is no accepted standard for responding to it, and in our case there is nothing for it to change: we do not track you across websites or over time, whether or not you send the signal.
Links to other websites
The Website links to sites we do not control, including LinkedIn and GitHub. We are not responsible for their content or their privacy practices, and this policy does not apply to them. Read the privacy policy of any site you visit.
Changes to this policy
We may update this policy from time to time. The current version always appears on this page with its date at the top. If we make a change that materially affects how we handle your information, we will say so prominently on the Website before it takes effect.
Contact us
Questions about this policy, or about anything we hold, go to support@cloudcitycomputing.com.
See also our Terms of Use, which govern your use of this website.