Privacy Policy

1. Who We Are

Cloudops S.L. ("Cloudops", "we", "us", or "our") operates the Uxxu software architecture platform, available at uxxu.io and app.uxxu.io (the "Platform"). Cloudops is incorporated under the laws of Spain and is the data controller for personal data processed in connection with the Platform.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have in relation to your data. It applies to all visitors, registered users, and organisation administrators of the Platform.

2. Data We Collect

2.1 Account Information

When you register for a Uxxu account we collect your email address and the name or display handle you choose. This information is used to create and authenticate your account and to communicate with you about the Platform.

2.2 Organisation and Billing Information

If you create or administer an organisation on the Platform, we may collect company name, billing address, and VAT number for invoicing purposes. Payment processing is handled by our third-party payment provider; we do not store full payment card details on our systems. We retain transaction records for billing and accounting purposes as required by law.

2.3 Architecture Content

The architecture diagrams, models, components, and documentation you create within the Platform are stored on our infrastructure on your behalf. This content belongs to you. We process it solely to provide the Platform to you and do not analyse, sell, or use it for any other purpose.

2.4 Usage and Technical Data

We collect technical data needed to operate and secure the Platform, including IP address, browser and device information, request timing, and security events. If a website visitor accepts optional analytics, Rybbit also processes page views, referrers, events, session duration, approximate location, and a pseudonymous visitor identifier calculated from IP address and user agent. Our website integration does not send your UxxU account ID, name, or email address to Rybbit.

2.5 Communications, Support, and Waitlists

When you contact us by email, through our contact form, or via in-platform support features, we collect the information you provide, including your email address, subject, and the content of your message, to respond to your enquiry.

When you join a product waitlist, we collect your email address and any optional company, technology stack, or notes you provide to manage early access, understand product demand, and send the updates you requested.

2.6 Cookies and Similar Technologies

We use cookies and browser storage to operate the Platform and remember your preferences. Optional website analytics is disabled unless you actively consent. Google reCAPTCHA processes device, network, and interaction data and sets a necessary security cookie to distinguish people from automated abuse on protected forms. Please refer to our Cookie Policy for details on what cookies we set, their purpose, and how to control them.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• Creating and managing your account and organisation.
• Providing access to the Platform and its features.
• Processing payments and managing subscriptions.
• Sending account-related communications: verification emails, password resets, billing receipts, and plan change notifications.
• Responding to support requests and technical enquiries.
• Managing beta waitlists and sending the early-access updates you request.
• Monitoring and improving Platform performance, reliability, and security.
• Detecting and preventing fraud, abuse, and security incidents.
• Complying with legal obligations and responding to lawful requests from authorities.
• Sending product updates, feature announcements, and other communications about Uxxu where you have given consent or where we have a legitimate interest in doing so, and subject to your right to opt out at any time.

4. Legal Basis for Processing (GDPR)

For users in the European Union and European Economic Area, we process personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract performance (Art. 6(1)(b)) — processing necessary to provide the Uxxu service you have signed up for, including account management, content storage, and billing.
• Pre-contractual steps (Art. 6(1)(b)) — responding to enquiries you make before entering into a contract with us.
• Legitimate interests (Art. 6(1)(f)) — processing to answer other enquiries and for Platform security, form-abuse prevention, fraud prevention, and service reliability, where our interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — processing required to comply with applicable law, including tax and accounting obligations.
• Consent (Art. 6(1)(a)) — where you have made an affirmative choice, including joining a product waitlist, optional Rybbit website analytics, marketing communications, or other optional data uses. You may withdraw consent at any time as easily as you gave it.

5. Data Sharing and Third-Party Processors

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share data only with trusted service providers who help us operate the Platform, and only to the extent necessary for that purpose. These providers are contractually required to process data solely on our behalf and in accordance with this Privacy Policy.

Categories of third-party processors we use include:

• Cloud infrastructure — for hosting, data storage, and compute.
• Payment processing — for handling subscription payments securely.
• Email delivery — for sending transactional and account-related emails.
• Identity and form security — Google, when you choose Google sign-in and for reCAPTCHA abuse prevention on protected forms.
• Analytics — Rybbit, for consent-based pseudonymous website usage analysis.

We may also disclose data where required by law, court order, or competent government authority, or in connection with a merger, acquisition, or sale of our business, in which case we will notify affected users where legally permitted.

6. International Data Transfers

Cloudops S.L. is based in Spain (European Union). Some of our third-party service providers are based outside the EEA. Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs) or reliance on an adequacy decision. You may request more information about the specific safeguards applicable to a transfer by contacting us at support@uxxu.io.

7. Data Retention

We retain personal data for as long as your account is active or as necessary to provide the Platform and comply with our legal obligations. Specifically:

• Account data is retained for the life of your account. After an erasure request is verified, we delete or anonymise it unless a specific legal obligation requires retention.
• Architecture content in a personal workspace is deleted when that workspace is closed. Content owned by a shared organisation remains available to that organisation after the user's identifiers are removed or replaced.
• Billing and transaction records are retained for as long as required by applicable tax and accounting law (typically 5–7 years depending on jurisdiction).
• Technical and usage logs are retained for a limited period (generally 90 days) and then deleted or anonymised.
• Contact and support correspondence is retained for up to 24 months after the enquiry is closed, unless it must be kept longer for a legal claim or obligation.
• Waitlist entries are deleted after 12 months without an update, and their network address is removed after 30 days.
• In-product feedback is deleted after 24 months. Its network address and browser details are removed after 90 days.
• Generic application history is deleted after 24 months.
• Completed privacy-request records are retained for 24 months for accountability, using a hashed subject reference after the account is removed.
• Consent-based Rybbit website analytics may be retained for up to 36 months in our hosted analytics account.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using HTTPS/TLS.
• Encryption of data at rest where supported by our infrastructure providers.
• Secure storage of credentials using industry-standard hashing.
• Access controls limiting which staff can access personal data.
• Regular security reviews and dependency monitoring.

No method of transmission or storage is completely secure. If you discover or suspect a security vulnerability, please report it immediately to support@uxxu.io.

9. Your Rights

Depending on your location, you may have the following rights in relation to your personal data. Signed-in users can download a machine-readable copy of their account data or submit an erasure request under Account settings. You can also exercise any right by contacting us at support@uxxu.io. We normally respond within one month and may ask for information needed to verify your identity.

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data in certain circumstances ("right to be forgotten").
• Restriction — request that we limit how we process your data in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing purposes.
• Withdrawal of consent — withdraw consent at any time where processing is consent-based, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — complain to your national data protection authority if you believe your rights have been violated. In Spain, the relevant authority is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know — the right to request information about the categories and specific pieces of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom it is shared.
• Right to Delete — the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct — the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing — we do not sell or share personal information for cross-context behavioural advertising purposes.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To exercise your California privacy rights, contact us at support@uxxu.io with "California Privacy Request" in the subject line.

11. Children's Privacy

The Platform is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child under 16, please contact us at support@uxxu.io and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date at the top of this page and, where required, notify you directly by email or in-platform notification. We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact and Data Controller

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Cloudops S.L.
Registered in Spain
Email: support@uxxu.io
Website: uxxu.io/contact