Privacy policy

This privacy policy explains how Cloudfleet GmbH (“Cloudfleet”, “we”, “us”) processes personal data when you visit cloudfleet.ai, use the Cloudfleet Console, API or CLI, contact us, sign a contract with us, take part in our Partner Program, or do business with us. It provides the information required by Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller and contact

The controller is:

Cloudfleet GmbH
Kolonnenstraße 8
10827 Berlin
Germany
E-mail: [email protected]

Further company details are in the imprint. We have not appointed a data protection officer, as we are not required to under Article 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG). Send all privacy requests to [email protected].

2. Scope: controller and processor roles

Cloudfleet acts in two roles.

As a processor for our customers. Our customers run workloads on Cloudfleet Kubernetes Engine (CFKE) and store container images in Cloudfleet Container Registry (CFCR). Personal data inside customer clusters and registries, including Kubernetes objects, container images, and the identities recorded in Kubernetes API audit logs, is processed on behalf of the customer under our Data Processing Agreement (DPA). This also applies when we access a customer cluster during a support session the customer has authorised. The customer is the controller of that data. If your data is stored in a Cloudfleet customer’s cluster, contact that customer to exercise your rights.

As a controller. This policy covers the processing for which Cloudfleet itself is responsible. It includes the processing listed in § 2.7 of the DPA: account administration, authentication, contract management, billing and usage measurement, service communications, security logging, fraud and abuse prevention, operation and improvement of the Services including product analytics, feedback and support communications, and processing to meet our legal obligations.

3. What we process, why, and on which legal basis

3.1 Visiting our website

When you visit cloudfleet.ai, your browser sends technical data to our hosting provider: IP address, date and time of the request, requested URL, referring URL, browser type and version, and operating system. We process this data to deliver the website and to protect it against attacks and abuse.

• Legal basis: our legitimate interest in a secure, working website (Article 6 (1) (f) GDPR) and § 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
• Retention: request logs are kept for up to one year.

3.2 Contact, demo and quote requests

When you fill in a form on our website or e-mail us, we process your name, e-mail address, company, job title, phone number if provided, and your message. We use it to answer your request, schedule demos and prepare offers. We store it in our CRM, together with notes on our conversations. Forms are protected by Cloudflare Turnstile, which checks that the request comes from a human and not a bot.

• Legal basis: steps prior to entering into a contract (Article 6 (1) (b) GDPR). Where you contact us on behalf of your employer, our legitimate interest in communicating with business contacts (Article 6 (1) (f) GDPR). Bot protection: our legitimate interest in preventing spam and abuse (Article 6 (1) (f) GDPR).
• Sources: you, or the partner who registered your company with us (section 3.16). Our CRM adds company information, such as country, industry and headcount, from its enrichment service and public sources.
• Retention: for customers, for the duration of the customer relationship; CRM records are deleted when the organisation is closed. Other CRM records are deleted at the latest one year after the last contact.

3.3 Account registration and authentication

When you create a Cloudfleet account or are invited to an organisation, we process your name, e-mail address, organisation, role, authentication data (password hash, multi-factor authentication settings, API key metadata), and, if you sign in through an external identity provider, the identity attributes it sends. We use this to create and administer your account and to authenticate you.

• Legal basis: performance of the contract with you or your organisation (Article 6 (1) (b) GDPR). For users added by their employer, our legitimate interest and our customer’s interest in providing the account (Article 6 (1) (f) GDPR).
• Retention: for as long as the account exists. When an organisation is closed, we delete account data, except records we must retain under section 3.5.

3.4 Contract execution and electronic signatures

We sign the Data Processing Agreement, order forms and other contracts electronically with DocuSeal. For each signatory, the signature service records name, e-mail address, IP address, timestamps and an audit trail of the signing process.

• Legal basis: performance of the contract (Article 6 (1) (b) GDPR) where the customer is a natural person. For persons signing on behalf of an organisation, our legitimate interest in concluding contracts with verifiable signatures (Article 6 (1) (f) GDPR).
• Retention: for the term of the contract and afterwards for the statutory limitation period and retention periods under section 3.5.

3.5 Billing, payments and collections

To bill for the Services, we measure the usage of each organisation and process billing contact details, billing address, VAT ID, invoices, payment history and payment method details. Card and bank details are entered directly with our payment provider Stripe; we do not store full card numbers. If a payment fails, we send reminders and may suspend Services as described in our Terms of Service. If an invoice remains unpaid, we may pass the claim to a debt collection provider or enforce it in court.

• Legal basis: performance of the contract (Article 6 (1) (b) GDPR). Retention of accounting records: our legal obligations (Article 6 (1) (c) GDPR) under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO). Collections: our legitimate interest in enforcing our claims (Article 6 (1) (f) GDPR).
• Retention: for the term of the contract. Accounting records, invoices and commercial correspondence are then kept for six to ten years, depending on the record type, as required by HGB and AO.

3.6 Service communications

We send e-mails about your account and the Services: sign-up confirmation, invitations, password resets, invoices, payment reminders, security notices, incident and maintenance notices, and notices of changes to our terms or the list of sub-processors. These e-mails are part of the Services and you cannot unsubscribe from them while you have an account.

We also send lifecycle e-mails based on how your organisation uses the Services, for example setup guidance after sign-up or a notice about unused resources. You can unsubscribe from lifecycle e-mails through the link in every e-mail.

• Legal basis: performance of the contract (Article 6 (1) (b) GDPR) and our legitimate interest in informing users of their organisation’s account and helping them use the Services (Article 6 (1) (f) GDPR).
• Retention: delivery logs are deleted by our e-mail provider under its retention schedule.

3.7 Security, fraud and abuse prevention

When you use the Console, API or CLI, our systems log requests and actions, IP addresses, user agents, device and network data, and authentication events. We use these logs to secure the Services, detect and investigate unauthorised access, prevent fraud, payment abuse and misuse of our infrastructure, and enforce our Acceptable Use Policy. Where we suspect abuse, we review the information we already hold about the organisation and publicly available information, such as company registers and sanctions lists, and may contact the organisation.

• Legal basis: our legitimate interest in the security of the Services and in preventing fraud and abuse (Article 6 (1) (f) GDPR). Sanctions screening: our legal obligations under EU sanctions law (Article 6 (1) (c) GDPR).
• Retention: infrastructure logs are kept for 30 days. Records of a specific security incident or abuse case are kept until the case is closed and any related claims are time-barred.

3.8 Support and feedback

When you open a support ticket in the Console or e-mail [email protected], we process your name, e-mail address, organisation, the content of your messages and any attachments. When you give feedback, for example through a survey or in a conversation, we process it to improve the Services.

• Legal basis: performance of the contract (Article 6 (1) (b) GDPR). Feedback: our legitimate interest in improving the Services (Article 6 (1) (f) GDPR).
• Retention: for up to one year, so we can refer to earlier requests. Tickets are deleted earlier when the organisation is closed.

3.9 Product analytics and error tracking

With your consent, we use PostHog in the Console and on our website to understand how features are used and to detect and fix errors. PostHog records page views, clicks, feature usage, technical error reports and device and browser data, linked to a pseudonymous identifier and, in the Console, to your user account.

• Legal basis: your consent (Article 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw it at any time through the “Cookie settings” link in the website footer.
• Retention: event data is kept for up to one year and then deleted.

We also store product usage data from our own systems, such as organisations, clusters and usage metrics, in our data warehouse on Google Cloud (BigQuery). We analyse it to understand how the Services are used, to select the lifecycle e-mails in section 3.6, and to keep the account information in our CRM current. PostHog and Google Analytics data enters the warehouse only where you have consented to it.

• Legal basis: our legitimate interest in understanding and improving the Services and in informing customers about their use (Article 6 (1) (f) GDPR); for consent-based data, your consent (Article 6 (1) (a) GDPR).
• Retention: for as long as the organisation exists. When it is closed, its usage data is deleted or anonymised.

3.10 Website analytics and advertising

With your consent, we use Google Analytics to measure website traffic and the performance of our campaigns, and conversion and remarketing tags from Google Ads, LinkedIn and Reddit to measure the results of our ads and show ads to people who visited our website. These tools set cookies or similar identifiers and process your IP address, device and browser data, pages visited, and interactions with our ads. Our own consent tool, loaded through Google Tag Manager, blocks these tags until you consent.

• Legal basis: your consent (Article 6 (1) (a) GDPR and § 25 (1) TDDDG). You can withdraw it at any time through the “Cookie settings” link in the website footer.
• Retention: Google Analytics data is kept for up to 14 months. Google, LinkedIn and Reddit retain the data they collect as independent controllers under their own privacy policies.

3.11 Marketing e-mails

We send product news and event invitations to people who have subscribed. We also send information about similar products and services to existing customers at the e-mail address they gave us when buying our Services. You can unsubscribe at any time through the link in every e-mail or by writing to [email protected].

• Legal basis: your consent (Article 6 (1) (a) GDPR). Existing customers: our legitimate interest in direct marketing (Article 6 (1) (f) GDPR) and § 7 (3) of the German Act Against Unfair Competition (UWG).
• Retention: until you unsubscribe. We then keep your e-mail address on a suppression list so we do not contact you again.

3.12 Social media

We run company pages on LinkedIn and Reddit. When you interact with these pages, the platform operator processes your data under its own privacy policy. For page statistics that LinkedIn provides to us, LinkedIn Ireland Unlimited Company and Cloudfleet are joint controllers (Article 26 GDPR) under LinkedIn’s Page Insights Joint Controller Addendum. Exercise your rights regarding this data with LinkedIn directly.

• Legal basis: our legitimate interest in communicating with our audience on these platforms (Article 6 (1) (f) GDPR).

3.13 Job applications

When you apply for a position, we process your application documents, contact details, and the information you share in interviews to decide on your application.

• Legal basis: steps prior to entering into an employment contract (Article 6 (1) (b) GDPR and § 26 BDSG).
• Retention: up to six months after the application process ends, unless you agree to a longer period or we hire you.

3.14 Legal obligations and legal claims

We process personal data where the law requires it, for example to respond to court orders or requests from authorities, and where it is needed to establish, exercise or defend legal claims.

• Legal basis: our legal obligations (Article 6 (1) (c) GDPR) and our legitimate interest in enforcing and defending our rights (Article 6 (1) (f) GDPR).

3.15 Corporate transactions

If we are involved in a merger, acquisition or sale of all or part of our business, we may disclose personal data to the parties involved and their advisers, under confidentiality obligations and to the extent needed to evaluate and complete the transaction.

• Legal basis: our legitimate interest in carrying out the transaction (Article 6 (1) (f) GDPR).

3.16 Partner Program

When you join the Cloudfleet Partner Program or act for a partner, we process your name, e-mail address, company, role, the partner’s VAT ID, tax status and bank details, deal registrations, rewards, and self-billed invoices. We use this to run the Program, review deal registrations, calculate and pay rewards, issue self-billed invoices, and screen partners against EU sanctions lists before payments.

Partners register prospective customers with us. For these, we receive the company name and the name, e-mail address and role of contact persons from the partner, and store them in our CRM under section 3.2.

• Legal basis: performance of the Partner Terms (Article 6 (1) (b) GDPR); for the partner’s employees, our legitimate interest in working with the partner (Article 6 (1) (f) GDPR). Self-billed invoices and sanctions screening: our legal obligations (Article 6 (1) (c) GDPR). Data about prospective customers: our legitimate interest in handling deals that partners refer to us (Article 6 (1) (f) GDPR).
• Sources: you, or for prospective customers, the partner that registered the deal.
• Retention: for the duration of the partnership. Self-billed invoices and payment records are kept under section 3.5. Data about prospective customers follows the CRM retention in section 3.2.

4. Whether you must provide personal data

You are not required by law to provide personal data. Some data is needed to conclude or perform a contract: without an e-mail address we cannot create an account, and without billing details we cannot provide paid Services. Providing data for analytics and marketing is voluntary.

5. Recipients

Within Cloudfleet, only the staff who need personal data for the purposes above have access to it. We share personal data with the following service providers. Where a provider acts as our processor, it processes data only on our instructions under a data processing agreement. Where a provider is marked as an independent controller, it also processes data for its own purposes under its own privacy policy.

We also disclose personal data, where needed for the purposes above, to:

• tax advisers and auditors, to keep our books and meet our tax obligations;
• banks, to receive and refund payments;
• debt collection providers, their local partners, lawyers and courts, to recover unpaid invoices;
• lawyers and other professional advisers, who are bound by professional secrecy;
• authorities and courts, where the law requires it;
• parties to a corporate transaction under section 3.15.

We do not sell personal data.

6. Transfers to third countries

Some recipients are located in, or can be accessed from, countries outside the European Economic Area (EEA). We transfer personal data to these countries only where:

• the European Commission has found that the country, or for the USA the certified recipient under the EU-US Data Privacy Framework, ensures an adequate level of protection (Article 45 GDPR), as for the United Kingdom; or
• we have agreed the Standard Contractual Clauses adopted by the European Commission with the recipient (Article 46 (2) (c) GDPR), or the recipient applies approved Binding Corporate Rules (Article 47 GDPR).

The transfer mechanism for each provider is listed in section 5. You can request a copy of the safeguards at [email protected].

7. Retention

We keep personal data only for as long as needed for the purpose for which we collected it, as set out for each purpose in section 3. When the purpose ends, we delete the data or anonymise it, unless we must keep it to meet a legal retention obligation or to establish, exercise or defend legal claims. In that case, we restrict processing to that purpose and delete the data when the obligation or the limitation period ends.

To close an organisation and delete its data, an administrator opens a support ticket in the Console after deleting all clusters and container images. Organisations with paid usage are closed once the last invoice is paid. Closing the organisation deletes the user accounts, support tickets, the Stripe customer record and the CRM records of the organisation, except the records we must keep under section 3.5.

8. Your rights

You have the following rights regarding your personal data:

• Access (Article 15 GDPR): confirmation of whether we process your data and a copy of it, including the recipients to whom we have disclosed it.
• Rectification (Article 16 GDPR) of inaccurate or incomplete data.
• Erasure (Article 17 GDPR), unless we must keep the data, for example under a legal retention obligation.
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR) for data you provided to us, processed on the basis of consent or a contract.
• Withdrawal of consent (Article 7 (3) GDPR) at any time, with effect for the future. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. For cookies and similar technologies, use the “Cookie settings” link in the website footer.
• Complaint to a supervisory authority (Article 77 GDPR). The authority responsible for Cloudfleet is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin. You can also complain to the authority in your country of residence or place of work.

Right to object (Article 21 GDPR). Where we process your data on the basis of our legitimate interests (Article 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons; we then stop using your data for that purpose.

To exercise your rights, e-mail [email protected]. We may ask you to confirm your identity before acting on a request. We grant these rights to everyone, regardless of where you live.

9. Automated decision-making

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing, including profiling (Article 22 GDPR). When we review an account for fraud or abuse, a member of our team makes the decision.

10. Data of minors

Our Services are not directed at children. We do not knowingly process personal data of persons under 16. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.

11. Data security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, multi-factor authentication and least-privilege access for our staff, and logging of administrative access. The security and data protection page describes these measures in detail.

12. Changes to this policy

We update this policy when our processing changes or the law requires it. This version is dated 19 October 2026. If a change materially affects processing based on your consent, we ask for your consent again. We inform customers of material changes by e-mail or in the Console.