Who is responsible
Apex Edge Sales Engineering Limited is the controller of the personal data described here. We are registered in England and Wales under number 15821626, at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, and registered with the Information Commissioner's Office under ZB796431.
Anything about privacy, cookies, or your rights goes to privacy@
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address and account details | To create your account, sign you in, and contact you about your subscription | Performance of a contract |
| Authentication records and sign-in events | To sign you in, and to detect and investigate misuse | Legitimate interests in keeping accounts secure |
| Your second factor, if you set one up: the authenticator, when it was added, and when it was last used | To ask for a code at each sign-in, as you chose | Performance of a contract, and legitimate interests in keeping accounts secure |
| The workloads, use cases, and results you save | To provide the service you are paying for | Performance of a contract |
| Billing name, billing address, tax registration number, and subscription records: the plan you pay for, what it costs, the period paid for, whether each payment was taken, any refund, and each change you or we made to it | To take payment, calculate tax, issue invoices, and give you the plan you paid for | Performance of a contract, and legal obligation for tax records |
| Activity and audit records of what happened in your account, including each export, each use case deleted or restored, closing or reopening your account, a second factor added, removed, or reset, a payment disputed with your card issuer, and, where our staff suspended, reactivated, closed, or reopened your subscription or changed your plan, whether and when we told you by email and anything our staff added to that email | To keep an accurate record of changes, exports, support, and access, and to know that you were told of a step we took | Legitimate interests |
| Each email we send you about your subscription: what it was about, the address it went to, and whether the email service reports it delivered, delayed, bounced, or marked as spam | To know that what we must tell you reached you, and to tell you another way where it did not | Performance of a contract, and legitimate interests in reaching you |
| Why you cancelled your plan, where you chose to say, and any words you added | To understand why subscribers leave, and improve the service | Legitimate interests in improving the service |
| Notes our staff keep about your subscription: what was agreed with you, or worth knowing when you next contact us | To serve you consistently whoever you deal with | Legitimate interests in giving good service |
| The months in which you used your account, each recorded once, and counted in totals that name nobody | To know how many subscribers use the service each month | Legitimate interests in understanding and improving the service |
| Whether and when you acknowledged a notice we asked you to acknowledge | To know who has read something we needed them to read | Legitimate interests in being sure an important notice was read |
| What you agreed to: which of our documents, the version of each, when, how, and the words you were shown | To know, and to be able to show, what you and we agreed | Performance of a contract, and legitimate interests in establishing what was agreed |
| A request about your personal data, or a personal data breach, and how we dealt with it | To answer it within its deadline, and to document a breach as the law requires | Legal obligation |
| A complaint, a legal notice, or a security report, and how we dealt with it | To answer it, and to show how it was handled | Legitimate interests in handling complaints, notices, and reports properly |
| Information about a suspected fraud, a stolen means of payment, or a false identity, kept with the record of the action we took until your subscription is deleted | To prevent and detect fraud and misuse of the service | Legitimate interests, and legal obligation where the law requires us to report it |
| Support correspondence | To answer you | Performance of a contract, and legitimate interests |
| A record of each failure the product meets: the page, the technical message, and, for a failure in your browser, your account | To find and fix what went wrong, including when you quote the reference an error screen showed you | Legitimate interests in running a service that works |
A notice we address to you by name is shown only to you. Once your subscription is deleted, nothing about a notice identifies you: we keep only how many subscribers a notice named and how many acknowledged it, never who.
We do not use your data to train models, we do not sell it, and we do not share it for anybody else's marketing. We may give personal data to the police, a regulator, or another authority where the law requires it, or where it is needed to prevent or detect fraud or crime.
CloudVerdict is a service for businesses and is not for children.
Paying for a plan
You pay on our payment processor's pages, not ours. When you buy a paid plan we send you to our payment processor's own secure payment page, and your payment details and invoices are on its billing page. Your card is typed there. We never receive it and never hold it.
What we send our payment processor when you start to buy a plan: your name, the email address you sign in with, and the identifier of your subscription, so that it can keep a customer record for you and tell us which subscription a payment belongs to.
What you give our payment processor on its pages: your card or other payment details, your billing address, and a VAT number if you have one. It works out the tax from the address and the number.
What our payment processor tells us: the plan you bought and what it costs, the period each payment covers, whether a payment was taken or failed, a change or a cancellation and its date, and a refund. It also tells us the billing name, billing address, and VAT number you gave it, and whether it could verify the number, which we keep against your subscription so that our staff can answer a question about an invoice. We do not receive your card details.
What is not sent to the cloud providers
Nothing. The cloud providers CloudVerdict prices receive no data from CloudVerdict about you or your workloads. We read the prices they publish to the world; we send them nothing. They are the subject of the measurement, not a party to it.
Our staff can reach your account, and it is recorded
Apex Edge Sales Engineering staff can enter your account to support you. This is deliberate, and it is recorded.
Every such session records who opened it, whose account it entered, why, and when it ended. Every action taken during one names the member of staff as well as you. The record is kept so that access can be reviewed, and so that you can be told what was done, and it is deleted with everything else when your data is deleted.
Each action our staff take in the administration is recorded with who took it, when, and, where it is known, the network address it came from, so that an action can be traced to the person and the network it came from. That address is our staff's own and is never given to a subscriber. It is cleared from the record at the first daily deletion after 365 days, or sooner where the record itself is deleted. That period can be changed, and this notice is updated when it is. Our lawful basis is our legitimate interest in keeping access to your account accountable.
While acting for you, staff cannot, as you, change your name, your subscription's name, your password, or your second factor, or close or reopen your account. If you lose your second factor and ask us to remove it, we do so only once we are satisfied the request is yours, and the removal is recorded with the reason.
Your password
We never send you a password, and nobody here knows yours. If we set up your account for you, we email you an invitation link, and you choose your own password before you can reach anything. No member of staff can see your password or set it, and it is never sent by email.
Setting up an account creates the account and its subscription and nothing else, so an account existing does not mean anybody has used it.
Records that cannot be edited
The activity record and the audit record are deliberately immutable while your subscription exists. A correction is a new entry, not a change to an old one, because a record that can be rewritten is not a record. Both are deleted with everything else, as set out below.
How long we keep things
When a subscription is closed, everything we hold about it in CloudVerdict is deleted 30 days later. What that deletion does not reach is set out below: a subscription that is still paying for a plan; emails you and we have exchanged; the record of a request, complaint, report, or personal data breach about the subscription, kept with its kind and dates alone or, for a breach, with what happened, its effects, and what we did; and invoices, which the law makes us keep. The date is fixed when the subscription is closed and recorded against it. Until that date a closure can be undone, and everything comes back as it was: you can reopen an account you closed yourself by signing in, unless we have kept it closed for a reason our terms allow, and one we closed or kept closed is reopened by us.
An acknowledgement of a notice is kept until the notice is deleted or your subscription is deleted, whichever comes first.
What you agreed to is kept with your subscription, and deleted with it. The text of each version of a document is kept as it stood, because it names nobody.
A request, complaint, or report, and how we dealt with it, is kept for 6 years after we closed it, so that we can show how it was handled. When your subscription is deleted, we remove from it who sent it, what it said, and how it ended in words, and keep only its kind and its dates; a personal data breach also keeps what happened, its effects, and what we did, which the law requires us to document.
A use case you delete is kept until a date set from the same period, and then deleted. It leaves your list at once, and you can restore it, with every version, until that date. On that date the daily deletion removes it with every version and result.
Each day, every closed subscription whose date has passed is deleted, with everything about it and about you: the subscription, your use cases and their results, the activity record, every audit entry that names you or the subscription, including anything our staff recorded about it and why, and your account with its sign-in details. The deletion runs within a day of the date, and anything it cannot delete is tried again each day until it is. The period is a setting we can change. A change applies to subscriptions closed after it and never moves a date already given, and this notice is updated when it changes.
Deletion can come sooner. A closed subscription can be deleted at once, when you ask us to or when an account should not exist; after a switch to another service, only when you ask. The same things are deleted. You do not have to wait for the 30 days to end.
Records of failures are kept for 30 days. A failure the product meets is recorded with the page it happened on and a technical message, and a failure in your browser is recorded with your account while you are signed in. Each is deleted 30 days after it happened, or with your account if that is sooner and the record names it. The period is a setting we can change, and this notice is updated when it changes.
Totals that name nobody. We keep monthly totals of what was paid and refunded for each plan, and how many paid subscriptions started and ended. They hold no name, account, or invoice, and are not deleted with a subscription.
What is left is a count, not a record of you. We keep a line saying that a subscription closed on 1 date was deleted on another. It holds those 2 dates and nothing that identifies you or the subscription.
A closed subscription that is still paying for a plan is deleted once the plan has ended. An account that pays for a plan cannot be closed, so this arises only where a payment completes as an account is being closed. We end the plan, or reopen the subscription, and the deletion follows.
Emails you and we have exchanged are not held in CloudVerdict, and are not deleted with your subscription. A message you send to 1 of our addresses, and our reply, are kept in that mailbox for as long as they are needed to answer you and to keep a record of what was asked and agreed. You can ask us to delete them at any time, at privacy@
A suspended subscription is not deleted. While it is suspended you can sign in and see that it is suspended and who to contact, and nothing else. Its data is kept unchanged until it is reactivated or closed.
Invoices, which the law makes us keep. Invoices and tax records are kept for 6 years after the end of the financial year they belong to, which is what United Kingdom tax law requires of a company, and longer only where the law requires it of a particular record. They are held by our payment processor, with the customer record they belong to: your billing name, billing address, VAT number, and what you were charged and refunded. Deleting your subscription deletes our own record of what you paid, of each change to your plan, and of everything our payment processor told us about it; it does not delete those invoices.
Backups. A backup is kept for 7 days at most and then overwritten, so what is deleted has left every backup within 7 days. A backup is used only to recover from a failure, and to test that it can be, and a copy restored to test it is deleted the same day.
Our providers' own logs. The services we use keep short-lived operational logs of their own, such as a record of sign-ins, of requests to the site, and of emails sent, and these can include your email address. We do not copy them anywhere, and each expires on the schedule its provider sets. The failures we record ourselves are described above. Who those providers are is set out under Who processes data for us, below.
Who processes data for us
We use a small number of service providers, our sub-processors, each for a purpose of its own:
| Who | What for | Where |
|---|---|---|
| Our hosting provider | Serving the site and every screen | Ireland (EEA) |
| Our database and sign-in provider | Holding your account and what you save, and signing you in | Ireland (EEA) |
| Our email delivery service | Sending the emails we send you, and alerts to our own staff | Ireland (EEA) |
| Our payment processor | Taking payment, calculating tax, and issuing invoices, on its own pages | Its own infrastructure, under its published terms |
Some of these providers are incorporated in the United States. Where a transfer outside the UK or EEA takes place, it is made under an approved safeguard such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
The named list of our sub-processors, with what each does and where it processes, is given on request: write to privacy@
Measuring the site
We do not measure the site. We do not count page views, record where a visit came from, or time how pages load, with or without cookies, and nothing is added to a page to do so.
Our hosting provider keeps the ordinary records a web server keeps of the requests it answered, among them the IP address a request came from, in order to answer them and to keep the service secure and working. We use them for nothing else. Our lawful basis is our legitimate interest in providing a service that is secure and works.
Cookies
What CloudVerdict stores in your browser, and why, is set out in the Cookie Notice.
Your rights
You have the right to ask us for a copy of your personal data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. You can also withdraw consent where we relied on it.
These rights do not depend on what you pay. PDF and CSV export are paid features of the product, and neither is how we answer a data protection request. A request for a copy of your personal data, or for it in a portable form, is answered by us as a process, whatever tier you are on. Send it to privacy@
We respond within one month. If we need longer because a request is complex, we will tell you within that month and explain why. A copy of your data is given as 1 file, in a common format a computer can read, sent securely, normally to the email address you sign in with, once we are satisfied the request is yours. We may ask you to confirm who you are before we act on a request, and we may refuse or charge a reasonable fee for a request that is manifestly unfounded or excessive, as the law allows.
Complaints
If you are unhappy with how we have handled your data, please tell us first at privacy@
You also have the right to complain to the Information Commissioner's Office, at ico.org.uk, or to the supervisory authority in your own country.
Security
We take reasonable technical and organisational measures to protect personal data, among them keeping every subscriber's data separate from every other subscriber's.
To report a security problem or a suspected personal data breach, email security@
Changes to this notice
We may change this notice. Where a change materially affects you, we will give notice to the email address held on your subscription at least 30 days before it takes effect, unless the law or a risk to the security of the service requires it sooner. The effective date at the top says when the current version came into force.
Contact points
Each kind of correspondence has its own address. Using the right one matters: a data rights request has a statutory clock running on it, and a security report should not wait in a support queue.
| Purpose | |
|---|---|
| General and sales enquiries | contact@ |
| Product support | support@ |
| Billing, invoices, VAT, refunds, and payments | billing@ |
| Privacy, cookies, and data rights | privacy@ |
| Legal notices and contractual correspondence | legal@ |
| Security reports and suspected personal data breaches | security@ |