Privacy Policy
How CloudTally collects, uses, stores and protects personal data.
Last updated: 2026-09-13
1. Who we are and our roles
The data controller is Agapios sp. z o.o., Milenijna 43/2, 03-130 Warszawa, Poland, VAT ID PL5242975067, KRS 0001041436 (CloudTally, we or us).
This Policy covers the CloudTally website, application and authentication service. CloudTally is controller for marketing, accounts, authentication, billing, security, support and legal compliance. It is processor for personal data a Customer supplies or selects for the Service, including members, notification recipients and personal data in Hetzner project data. For the same User, CloudTally may be controller for the User's account and processor for that User's membership in a Customer organisation. The Data Processing Agreement governs processor activities.
2. Personal data we process
Website, waitlist and communications
We process waitlist email addresses; names, email addresses, messages and correspondence submitted through email or the contact form; related page, locale and campaign information; and IP addresses, request times, browser information, requested pages and response details.
The marketing website does not use analytics or advertising trackers.
Accounts and organisations
For Users and organisations, we process names, email addresses, verification and identity-provider identifiers, avatars where supplied, sessions, roles, invitations, preferences and relevant timestamps.
Hetzner connections and Service data
A Customer supplies a project-scoped Hetzner Cloud API token. We encrypt the token and use it to retrieve server, volume, load balancer, network, image, public IP address, pricing, action, usage and metric information. We never use the token to modify the Customer's Hetzner resources.
Infrastructure data is mostly technical. Resource names, labels, descriptions, public IP addresses or related metadata may nevertheless be personal data where they identify a person.
We also process budgets, forecasts, recommendations, notifications, synchronisation status and User activity needed for the Service.
Billing and security
For paid subscriptions, we process company and billing details, email, country, VAT information, subscription and payment status, amounts, invoices and credit notes.
We process IP addresses, timestamps, request and error details, security events, audit records and technical identifiers to authenticate Users, prevent abuse, investigate faults and protect the Service.
3. Why we process personal data
| Processing | Purpose | Legal basis |
|---|---|---|
| Waitlist | Send requested launch updates and manage opt-out | Consent, Art. 6(1)(a) GDPR |
| Enquiries and support | Respond and keep a support record | Legitimate interests, Art. 6(1)(f) GDPR |
| Accounts and organisations | Provide and administer the B2B Service | Performance of the contract, Art. 6(1)(b) GDPR, where you are the Customer; legitimate interests, Art. 6(1)(f) GDPR, where you act for an organisation |
| Billing and payments | Administer subscriptions and collect fees | Performance of the contract, Art. 6(1)(b) GDPR, where you are the Customer; legitimate interests, Art. 6(1)(f) GDPR, where you act for an organisation |
| VAT, invoices and accounting | Meet tax and accounting duties | Legal obligation, Art. 6(1)(c) GDPR |
| Security and fraud prevention | Protect Users, Customers and the Service | Legitimate interests, Art. 6(1)(f) GDPR |
| Legal claims | Establish, exercise or defend claims | Legitimate interests, Art. 6(1)(f) GDPR |
Where CloudTally acts as processor, the Customer determines the legal basis and CloudTally follows the Customer's documented instructions under the DPA.
4. Sources and required information
We receive personal data from individuals, Customers, identity providers, devices and browsers, Mollie, FakturaXL, VAT-validation services and Customer-authorised Hetzner projects. Account and authentication information is required for the application, billing information for paid subscriptions and a read-only Hetzner token for a connected project.
5. Recipients and transfers
We use hosting, security, storage, email and invoicing processors, including Cloudflare, Hetzner, Scaleway, SEOHost and FakturaXL. The subprocessors used for Customer Personal Data are listed in the DPA.
Mollie is an independent controller for payments. EU VAT details may be sent to the European Commission's VIES service. We may also disclose data where required by law or for legal claims.
The primary application, database and object storage are located in the European Union.
Cloudflare may process data through its global network, including the United States. The EU-US Data Privacy Framework is active, and Cloudflare states that its certification covers transfers from the EEA to the United States. Cloudflare also uses Standard Contractual Clauses as an additional or fallback safeguard.
Any other transfer outside the EEA will use an adequacy decision, Standard Contractual Clauses or another lawful mechanism. We do not sell personal data or share it with advertising networks.
6. Retention and deletion
We retain personal data only as long as needed for the purposes above:
| Data | Retention |
|---|---|
| Waitlist | Until consent is withdrawn or the waitlist purpose ends |
| Enquiries and support | Two years after the last communication |
| Account, organisation and Customer Personal Data | While the account or organisation is active, followed by a 30-day restoration period and then permanent deletion from active systems |
| Invoices, VAT and accounting records | Five years after the end of the relevant tax year |
| Application, request and security logs | 30 days |
Cancellation or trial expiry may move an organisation to the Free plan rather than delete it. If deletion is requested through the Service, the organisation remains recoverable for 30 days and is then permanently deleted from active systems, except for records that law requires us to retain.
Backup copies expire through the normal backup cycle and are not used for ordinary processing. If a backup is restored, applicable deletion requests are reapplied.
7. Cookies and browser storage
The website and application use only essential cookies and browser storage. These technologies support authentication, security and interface preferences; they are not used for advertising or analytics. See the Cookie Statement for details.
8. Automated processing
Automated costs, forecasts and recommendations are advisory and do not make decisions about a person with legal or similarly significant effects.
9. Security
We use measures appropriate to the Service and the risks, including encrypted transport, encryption of credentials and backups, access controls, organisation-level isolation, restricted network access, read-only Hetzner credentials, security logging and recovery processes.
No service is completely secure. Customers must protect their accounts, devices and cloud credentials.
10. Your rights
Subject to the GDPR, you may have rights to access, correct, erase or restrict your personal data, receive portable data, object to processing based on legitimate interests and withdraw consent at any time.
Contact [email protected] to exercise a right. We respond within one month unless the GDPR permits a longer period. Where CloudTally acts as processor, we will refer the request to or assist the relevant Customer.
You may complain to a competent supervisory authority. CloudTally's Polish authority is the President of the Personal Data Protection Office, Urząd Ochrony Danych Osobowych, uodo.gov.pl.
11. Contact and changes
We have not appointed a Data Protection Officer because our current processing does not involve large-scale regular monitoring or large-scale processing of special-category data. Privacy questions and requests may be sent to:
Agapios sp. z o.o.
Milenijna 43/2, 03-130 Warszawa, Poland
[email protected]
We may update this Policy when the Service, our providers or the law changes. The revision date above identifies the current version.