Version 1.2, effective 2026-09-04
Privacy Policy
How Cloudtract uses and protects personal data: what we collect, why, who receives it, how long we keep it, and the rights you can exercise.
1. Who we are
Kaminari B.V., trading as Cloudtract, is responsible for the personal data described in this statement when we act as a controller. Our registered address is Oudeschans 72a, 1011 LE Amsterdam, The Netherlands, our Dutch Chamber of Commerce number is 63670887, and our VAT number is NL855345767B02.
Questions or privacy requests can be sent to hello@cloudtract.ai. Our data protection officer or privacy lead is [NAME/ROLE OR "not formally appointed"].
2. When this statement applies
This statement applies when you visit cloudtract.ai, create or use a Cloudtract account, administer a workspace, contact support, receive our business communications, or interact with our public social-media pages.
A business customer normally decides why personal data inside its uploaded contracts, emails, invoices and related records is processed. For that Customer Content, the customer is the controller and Cloudtract acts as its processor. Our DPA governs that processing. If you are mentioned in Customer Content, please contact the relevant customer first; we will help that customer respond where required.
This statement does not cover third-party websites or services that you choose to connect to Cloudtract. Their own privacy statements apply.
3. The personal data we use
Depending on how you use Cloudtract, we may process:
Account and profile data: name, work email, password or authentication identifiers, language, time zone and preferences.
Business and workspace data: employer, job title, corporate group, legal entity, role, permissions, invitations and audit history.
Customer Content: contracts, subscriptions, invoices, emails, attachments, extracted facts, comments, tasks, decisions and AI conversations supplied through the Service.
Integration data: connected account identifiers, permissions, delivery destinations, token metadata and provider event records. We do not display secret tokens to users.
Billing data: billing contact, company details, VAT number, plan, invoices, payment status and limited payment-method information. A payment provider normally handles full card details.
Usage and device data: IP address, browser, device, operating system, timestamps, feature activity, error and performance data, session and security events.
Communications: support requests, feedback, survey responses and records of our correspondence.
Marketing and cookie data: subscription choices, campaign interactions and consent choices, where applicable.
4. Where the data comes from
We receive data directly from you, from another authorised user in your organisation, from connected services that you choose to use, from our payment and identity providers, and automatically when you use the website or Service.
Cloudtract may also retrieve public business information and current supplier terms from official websites to support a customer-requested comparison. We label public-source information separately where the product supports that distinction.
5. Why we use personal data
| Purpose | Typical data | Legal basis | Retention guide |
|---|---|---|---|
| Provide accounts and the Service | Profile, workspace, usage, Customer Content | Contract; legitimate interests; processor instructions | Account term plus deletion period; Customer Content per DPA |
| Secure and troubleshoot Cloudtract | Login, device, logs, audit and support data | Legitimate interests; legal obligations | Security logs normally [14-90 days]; audit records as needed |
| Billing and administration | Company, contact, plan, invoice and payment status | Contract; legal obligation | Core tax records 7 years |
| Improve features and reliability | De-identified or limited usage, error and feedback data | Legitimate interests | Normally [12-24 months] |
| Send service messages | Account, role, email, alert preferences | Contract; legitimate interests | While relevant to the account or request |
| Send marketing | Business contact and engagement data | Consent where required; otherwise legitimate interests | Until opt-out or [24 months] after last meaningful contact |
| Meet legal claims and duties | Relevant account, billing, security and communication data | Legal obligation; legitimate interests | For the applicable legal or limitation period |
Where we rely on legitimate interests, those interests include operating a secure B2B service, responding to users, improving reliability, preventing misuse and communicating with business customers. You may object; we will assess your request against our legal grounds and your rights.
6. How Cloudtract uses AI
Cloudtract may use AI and OCR to classify documents, extract and summarise terms, identify possible dates and risks, compare information, answer questions and prepare drafts. The result may be wrong or incomplete, so important information should be checked against the source.
We aim to send only the information needed for the task to an approved provider. We contractually restrict providers from using Customer Content to train general-purpose models where the service allows it. Cloudtract will not use Customer Content to train our own or a third party's general-purpose AI model without a separate, explicit written opt-in from the customer.
Cloudtract does not use fully automated decision-making that produces legal or similarly significant effects about individuals. The Service supports human decisions and does not autonomously cancel a contract, send a legal notice, approve a payment or make another binding decision.
7. Who receives personal data
We share personal data only when needed with authorised users in the relevant customer workspace; vendors that provide hosting, storage, authentication, AI/OCR, email, notifications, analytics, billing, support and security; professional advisers and auditors; authorities where law requires it; and a buyer or successor in a genuine corporate transaction subject to appropriate confidentiality.
Our current subprocessor list, including purpose and processing location, is available at [SUBPROCESSOR URL]. Customer administrators may also enable integrations such as Slack, Microsoft Teams or SMS. Data sent through a customer-enabled integration is also handled under that provider's terms.
Cloudtract does not sell personal data. We do not share Customer Content for behavioural advertising.
8. International transfers
Our preferred setup uses European hosting, but the production region and each material provider must be verified before launch. Some providers may process limited personal data outside the European Economic Area.
Where personal data is transferred outside the EEA, we use an adequacy decision where available or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with additional measures where needed. Details are available from hello@cloudtract.ai.
9. Cookies and similar technology
We use strictly necessary cookies and local storage to provide login, security, language and core functions. These do not require consent where the law treats them as necessary for a service you requested.
We will ask for consent before using non-essential analytics, personalisation or advertising cookies. You can accept, refuse or change those choices through [COOKIE SETTINGS LINK]. Refusing non-essential cookies will not block the core Service.
The live cookie banner and cookie list must identify the actual technology, provider, purpose and lifetime. This statement should not be treated as a substitute for that live list.
10. Emails and notifications
We send service messages needed to operate your account, such as security notices, billing updates, invitations and alerts you configured. You cannot opt out of messages that are essential to the Service, but you can control optional alert channels and frequency in your preferences.
We may send relevant product news to existing business customers where permitted by law. You can opt out at any time using the link in the email or by contacting us. We ask for consent where the law requires it.
11. How long we keep data
We keep personal data only for as long as needed for the purpose described, the customer agreement, security, legal claims and legal retention duties.
When a workspace ends, Customer Content remains exportable for 30 days and is then scheduled for deletion from active systems, subject to the DPA, legal holds and the customer's instructions. Residual encrypted backups may remain for up to [BACKUP RETENTION PERIOD] before automatic removal.
Dutch businesses generally need to keep core tax and accounting records for at least seven years. We may therefore retain invoices and related billing records for that period. Other periods in the table above must be confirmed against the production configuration before publication.
12. Security
We use technical and organisational measures designed for the sensitivity of the data, such as access controls, tenant and entity permissions, encryption where supported, private file storage, logging, backups, vulnerability management and controlled support access.
No system is completely secure. If you believe your account or data may be at risk, contact hello@cloudtract.ai immediately. We will handle personal-data breaches in line with the GDPR and our DPA obligations.
13. Your privacy rights
Depending on the law and the circumstances, you may ask us to:
give you access to your personal data and a copy of it;
correct inaccurate or incomplete data;
delete data or restrict how it is used;
provide data in a portable format;
stop processing based on legitimate interests, including direct marketing; and
withdraw consent at any time, without affecting earlier lawful processing.
Send a request to hello@cloudtract.ai. We may need to verify your identity and authority. We normally respond within one month, although the GDPR allows an extension for complex or numerous requests. If the request concerns Customer Content controlled by your employer or another Cloudtract customer, we may refer it to that customer and support their response.
14. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live, work or believe an infringement occurred.
Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl
15. Business users and children
Cloudtract is a business service and is not directed to children. Users must be at least 18 years old or otherwise legally able to act for their organisation.
16. Changes to this statement
We may update this statement when our Service, providers or legal duties change. We will post the new version and update the date above. If a change materially affects how we use personal data, we will give reasonable notice in the Service or by email.