Privacy notice
Version 1.0. Effective from 15 November 2026.
This notice explains how we use personal data collected through this website, cloudbusiness.software, and the CloudBusiness account site, account.cloudbusiness.software, where businesses sign up, subscribe and manage their subscriptions. It also covers emails you send us.
It does not cover the data that businesses store in our products, such as Stockist WMS or TinyBiz. For that data the business is the controller and we act as its processor, under our data processing agreement. Each product’s website has its own privacy notice for that website.
Who we are
Gotham Projects Ltd, trading as CloudBusiness.Software, is the data controller for the personal data this notice describes. We are registered in England and Wales with company number 06554421. Registered office: 1 Crow Hill Drive, Mansfield, Nottinghamshire, NG19 7AE. Our Information Commissioner’s Office registration number is ZB402964. Contact us about privacy at hello@cloudbusiness.software.
What we collect and why
On this website
| What | Why | Lawful basis |
|---|---|---|
| Aggregate statistics about how the website is used | To understand which pages help visitors and improve them | Legitimate interests; you can turn statistics off on our cookies page |
| Anything you write in an email to us, with your name and email address | To reply to you | Legitimate interests in answering enquiries |
On your CloudBusiness account
| What | Why | Lawful basis |
|---|---|---|
| Early access applications: name, work email, company, role, size of business, current system, what you want to fix, and whether you want updates | To decide whether a product fits your business and invite you to sign up | Legitimate interests in assessing enquiries; consent for updates, which you can withdraw at any time |
| Account details: your name, email address, business name, sign-in details (a scrambled password or passkey, and two-factor settings) and your role on the account | To set up and run your account, keep it secure and contact you about it | Contract with your business, and legitimate interests in running it securely |
| Billing contacts’ names and email addresses | To send invoices and payment notices | Contract, and legitimate interests |
| Which version of our terms you accepted, and when | To show what was agreed | Legal obligation and legitimate interests |
| Your subscriptions, plans, prices, terms and the history of every change, with when, who and why | To bill correctly and show you what happened on your account | Contract |
| Counts and amounts each product sends for billing, such as a number of orders or practitioners | To charge the right plan and usage | Contract |
| The steps of sign-up you completed, with dates and any campaign tags on the link you followed | To see where sign-up is hard and which channels bring businesses to us | Legitimate interests |
| Emails we send you and their delivery status | To make sure important account and payment emails arrive | Legitimate interests |
We do not sell your data or use it for advertising.
Payments and Paddle
Paddle is our reseller and merchant of record. When you subscribe, Paddle collects your payment details, billing address and tax details directly, takes your payment and sends your invoices. Paddle is a separate controller for that data, under its own privacy notice. We receive from Paddle your customer and subscription references, what was paid and when, and whether a payment failed. We never receive your full card number.
Who we share it with
Service providers who help us run the website and the account site, under contracts that require them to protect your data:
- Cloudflare, which hosts this website and routes and protects both sites with its web application firewall.
- Hetzner Online, on servers in Helsinki, Finland, and Laravel Cloud (Laravel Holdings), on servers in London, which host the account site.
- Postmark (ActiveCampaign), which delivers our account and payment emails.
- Fasthosts Internet Limited, in the UK, which holds the hello@ and billing@ mailboxes and the emails you send us.
- Plausible Analytics, hosted in the EU, which produces our website statistics without cookies and without identifying anyone.
Some of them may process data outside the UK, under safeguards approved for international transfers. We share your account details with the product you subscribe to, so it can open your account there, and we may share data where the law requires it.
How long we keep it
| What | How long |
|---|---|
| Early access applications that are never approved | 12 months |
| Sign-ups where the email address was never confirmed | 7 days |
| An account with no subscription | Closed after 30 days, with a warning on day 23 |
| Account, subscription and billing records, and the history of changes | While the account is open, then 6 years after it closes, for tax and accounting records |
| Emails you send us | Up to 2 years after our last contact, unless they form part of your account records |
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent, by emailing hello@cloudbusiness.software. Some account records must be kept while you have a subscription, or for as long as the law requires. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Changes to this notice
We publish each version of this notice with its date on this page, and email account owners about any change that affects how we use their data.