1. Who we are
CustomerCloud is a trading name of Declan Morton, a sole trader based in the United Kingdom. The data controller is the individual trading as CustomerCloud.
| Controller | Declan Morton, trading as CustomerCloud |
| Postal address | Available on request |
| Contact | hello@customercloud.cc |
2. What this notice covers
- customercloud.cc — our marketing site, signup, and the account area where a client manages their subscription.
- Correspondence with us by email.
- Our sales and waitlist activity.
It does not cover the booking or ordering websites we build and host for our clients (ChairTime salon sites, OrderBoard takeaway sites). On those sites the business owner is the controller and we act on their instructions. See section 9.
3. What we collect, and why
3.1 If you sign up as a client
Held in our control-plane database (Tenant table):
| Data | Field | Why |
|---|---|---|
| Business name | businessName | To identify and address your account |
| Your name | ownerName | To address you |
| Trade | businessType | To provision the right product |
| Admin email address | adminEmail | Your login and our primary contact route |
| Business phone | storePhone | Shown on your storefront; support contact |
| Sending email address | fromEmail | The address your customer emails are sent from |
| Subdomain | slug | Your site address, e.g. yourshop.customercloud.cc |
| Products bought | products | Billing and provisioning |
| Password | adminPasswordHash (bcrypt) | To let you log in |
| Brand colour, logo | primaryColor, logoUrl | To brand your site |
| Currency | stripeCurrency | Billing |
| Stripe identifiers | stripeCustomerId, stripeSubscriptionId, stripeConnectAccountId | Subscription billing and payouts |
| Subscription state | subscriptionActive, pastDueSince, suspendedAt, cancelledAt, purgeAt | Billing lifecycle |
| Account history | TenantEvent rows | An audit trail of every change to your account |
| Our internal notes about you | operatorNotes | Support and account management |
3.2 If you join the waitlist
Name, email address, business name, town and trade. This is not stored in a database — it is emailed to our own inbox, which is the record. Where an automation webhook is configured, the same five fields are also sent to it.
3.3 If you email us or use the in-product “Report a bug” form
Whatever you send us: your email address, your message, and the account it relates to. Bug reports reach hello@customercloud.cc.
3.4 If we contact you as a prospect
For business-to-business marketing we hold business contact details — business name, a role email address, town, and trade. Sources are public business listings and directories. See section 5.
3.5 When you simply visit the site
- We set no cookies on a cold visit and we run no analytics, tag manager or advertising pixels of any kind. See the Cookie Policy.
- Our hosting provider processes your IP address in order to serve the page and keep logs, as any web host does.
- We apply rate limits to public forms, which involves briefly holding your IP address in memory to count requests. It is not written to a database.
4. Lawful bases
| What we do | Lawful basis |
|---|---|
| Create and run your account; provision your store; take support requests | Contract — Art. 6(1)(b) |
| Take your £99/month subscription | Contract — Art. 6(1)(b) |
| Keep financial and tax records | Legal obligation — Art. 6(1)(c) |
| Waitlist sign-up and the confirmation email we send back | Consent, or steps at your request prior to a contract — Art. 6(1)(a)/(b) |
| Security, rate limiting, fraud prevention, keeping logs | Legitimate interests — Art. 6(1)(f): running a service that is not abused |
| Business-to-business marketing email | Legitimate interests — Art. 6(1)(f), within the limits PECR sets. See section 5 |
We do not ask you for, and have no business need for, any special category data about you as a client.
5. Marketing
We send business-to-business marketing email.
- We only send it to corporate subscribers at role addresses — limited companies, PLCs, LLPs, Scottish partnerships and public bodies, written to at a published address like
info@orbookings@rather than to a named person. Under PECR, sole traders and ordinary partnerships are treated like individuals and we do not cold-email them, and neither do we email a business whose legal status we have not established. This depends on your business’s status, not ours. - Every message identifies us and gives an address.
- Every message carries an unsubscribe route, and we keep a suppression list so that an unsubscribe is permanent. That suppression record is the one thing we will not delete on request, because deleting it would let us contact you again by accident.
6. Who we share your data with
We use a small number of suppliers. They act on our instructions and may not use your data for their own purposes.
| Supplier | What they do for us | Where |
|---|---|---|
| Railway | Hosts our application and database | US / EU |
| Stripe | Subscription billing, and the Connect account that pays you | EU / US |
| Resend | Sends all of our outbound email — service messages and marketing alike | US |
| Google (Workspace / Gmail) | Our own hello@customercloud.cc mailbox, where correspondence and enquiry-form sign-ups land | US / EU |
| Anthropic | Reads a photo of your price list or menu when you use AI import | US |
| Cloudflare | DNS only — points your subdomain at your store | US |
| Automation webhook | Receives waitlist sign-ups, where one is configured | Depends on the endpoint configured |
Cloudflare is DNS only. Our subdomain records are deliberately not proxied, so Cloudflare is not in the path of your visitors’ traffic and does not see their IP addresses.
The full list, with what each one receives and on what basis, is in our Data Processing Agreement — the same document our clients get.
We do not sell your data, and we do not share it for anyone else’s marketing.
7. International transfers
Most of the suppliers above are US companies. Where your data leaves the UK, the mechanism we rely on is the one contained in that supplier’s own data processing terms — in each case either the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the supplier’s own UK-approved mechanism, incorporated into our contract with them by their standard terms rather than negotiated separately by us.
Which supplier receives what, and how much of it, is set out supplier by supplier in our Data Processing Agreement. If a transfer position matters to your own assessment, ask us and we will point you at the specific terms.
8. How long we keep it
| Your account record | While you are a client. If you cancel, your store and its database are permanently deleted 30 days later |
| Financial and billing records | 6 years from the end of the accounting period (HMRC) |
Account history (TenantEvent) | Kept for as long as we hold your account record |
| Support email and bug reports | Kept while we may need them to support you |
| Waitlist and prospect data | Kept while the enquiry or the prospect is live |
| Marketing suppression list (a one-way fingerprint of an unsubscribed address) | Kept indefinitely, and deliberately so — see section 5. Deleting it is the one thing that would let us contact you again by mistake |
We keep your data for as long as your account is active. You can ask us to delete it at any time and we will, apart from records we are required by law to keep — invoices and other financial records — and the marketing suppression list.
9. When we are not the controller
If you are a customer of one of our clients — you booked a haircut or ordered a takeaway on a site we host — then that business is the controller of your data, not us. They decide what to collect and why; we process it on their instructions under a written agreement.
Contact that business first. If you cannot reach them, email hello@customercloud.cc and we will pass your request on and help them answer it.
10. Your rights
You can ask us to:
- give you a copy of your data (access);
- correct anything wrong (rectification);
- delete it (erasure — subject to records we must keep by law, such as invoices);
- restrict or object to what we do with it, including objecting to marketing, which we will always honour;
- give you a portable copy in a machine-readable format;
- and to have a human review any decision made purely by automated means (we do not make any).
Email hello@customercloud.cc. We will respond within one month.
If you are not satisfied you can complain to the Information Commissioner’s Office — ico.org.uk, 0303 123 1113. We would rather you told us first.
11. Security
Measures in place:
- Passwords stored as bcrypt hashes.
- Two-factor sign-in on our operator account (password plus an emailed code).
- All traffic over HTTPS with HSTS.
- Rate limiting on every public form.
- Card details never touch our systems — payment pages are Stripe’s.
- Stripe webhook signatures verified on every event.
12. Changes
We will post any change here and, for anything significant, email our clients.
See also our Cookie Policy and our Terms of Service.