Privacy Policy

Last updated 3 November 2026.

1. Who is responsible

AINOW Group OÜ (registry code 17614812), Tartu mnt 67/1-13b, Kesklinna linnaosa, Harju maakond, 10115 Tallinn, Estonia, is the data controller for cloudaisecurity.com. Privacy contact: machines@ainow.xyz.

2. What we collect

• Account data: your email address, name if you add one, passkey public keys, sign-in times, and the organisations you belong to.
• Provider credentials: the admin keys or API tokens you connect, stored encrypted (see Security). We never display them after entry.
• Configuration facts: what the provider APIs return about projects, workspaces, members (including their email addresses and roles), API key metadata, settings and aggregate usage. We never read prompts, responses or customer content.
• Statements and trust page content you write, and the exports you generate.
• Billing data: handled by Stripe; we store Stripe identifiers, plan and status, not card numbers.
• Technical data: IP address, user agent and request logs for security and debugging; product analytics counts without personal identifiers.

3. How we use it

To provide the service (performing our contract with you), to secure it and prevent abuse (our legitimate interests), to send transactional email such as sign-in links, alerts and trial notices, to bill you, and to meet legal obligations such as keeping tax records. We do not sell personal data or use it for advertising.

4. Who processes it for us

• Cloudflare, Inc.: hosting, database, file storage, background jobs, email delivery, bot protection and analytics. Core data is stored in Cloudflare’s network; some services do not offer regional storage.
• Stripe, Inc.: payments, subscriptions, invoices and tax calculation.
• AI providers you connect (OpenAI, Anthropic, Cloudflare): we send only your credential to their APIs to read configuration; they are your providers under your agreements with them.

Transfers outside the EU rely on standard contractual clauses or equivalent safeguards.

5. Public trust pages

When you publish a trust page, the facts, check results and statements on it are public and may be cached by search engines and visitors. Member email addresses and credential details are never shown on trust pages.

6. Cookies

We use one strictly necessary session cookie to keep you signed in and, where enabled, Cloudflare Turnstile to protect sign-in forms. No advertising or cross-site tracking cookies.

7. How long we keep it

• Credentials: until you remove the connection or your organisation is deleted; then deleted immediately.
• Configuration facts and check results: for the history period of your plan (90 days to 2 years), then deleted.
• Account and organisation data: while the account exists, then within 90 days of deletion.
• Request logs and security logs: up to 12 months.
• Billing and tax records: as long as tax and accounting law requires.

8. Your rights

You can access, correct, export or delete your data, object to or restrict processing, and complain to a supervisory authority (in Estonia, the Data Protection Inspectorate). Email machines@ainow.xyz. If you are a member of a customer’s organisation and your data appears in configuration facts, contact that customer first; we assist them as their processor for that data.

9. Changes

We will post changes here and notify material changes by email or in the app.