3000cloud Privacy Policy

Effective: October 16, 2026

This Privacy Policy explains what data the operator of 3000cloud ("3000cloud", "we", "us") collects when you visit our websites or use the 3000cloud services (the "Services"), why we collect it, and how it is used. By using the Services you consent to the processing described here. It should be read together with our Terms of Service.

1. Information we obtain

Account data (you provide via sign-in): your email address and, when your identity provider supplies it, your display name and a stable account identifier. You may sign in with Google, a Microsoft work or school account, an Organization's own single sign-on provider (OIDC or SAML), or a one-time email link. For Google sign-in we also read the Google Workspace domain that manages your account, if any; for Microsoft sign-in we also read your directory tenant identifier, account type and the tenant's verified domains, to confirm that you may join or create an Organization for those domains. We do not receive your passwords.

Organization data: if you create or join an Organization we store your membership, role, per-person app limit and the Organization's domains, sign-in settings and activity record (who changed sharing, members, domains, policy or billing, and when). Organization owners and administrators can see members' email addresses, roles, app counts and that activity record.

Visitors to private applications: when someone signs in to open an application whose owner requires sign-in, we check their email against the owner's allowlist or Organization membership, and pass their email address, display name and account identifier to that application with each request. If they ask for access, we store the request (email, name, time) and show it to the application's owner, who may also be emailed about it. Each time such a visitor completes a sign-in, we also record a sign-in entry — their email address, display name, the sign-in method, whether they were let in, the time, their IP address and the country derived from it at our network edge — and show it to the people who manage that application (its owner, or the Organization members allowed to manage it), so they can see who signed in. These entries are deleted automatically after 90 days, or earlier when the application is deleted.

Agreement records: when you accept our Terms of Service we record your email, the timestamp, your IP address, and an approximate location (country/region) derived from that IP address at our network edge. We keep this as evidence of acceptance.

Usage and log data (collected automatically): API requests and platform events associated with your account (endpoints called, application names, deploy identifiers, timestamps, status codes, IP addresses), technical logs from the infrastructure that runs your applications, and resource-usage metrics (CPU, memory, storage, network). Our infrastructure providers (see Section 3) may also process connection metadata as part of delivering traffic.

Application content ("Service Data"): the applications, files, and data that you (or software agents acting for you) deploy to the Services. We process Service Data on your behalf and at your direction, as a processor/host. You are responsible for the personal data of your own users inside your applications. We do not review Service Data except as needed to operate the platform, investigate abuse or security incidents, or comply with law.

Billing data: Stripe processes subscription payments and stores payment card details. We store the Stripe customer identifier associated with your account and read subscription information to verify access; we do not store full payment card details.

We do not knowingly collect government identifiers or precise geolocation.

2. How we use information

• To provide the Services: authenticate you, run and route traffic to your applications, show you logs and status, and let authorized agents act on your account.
• Security and abuse prevention: audit trails of account and platform activity, investigating violations of the Terms, protecting other customers and the platform.
• Operational notifications: emails about your account or the platform (for example, sign-up confirmations or service notices). Operator alerts about new sign-ups and deployments include your email, name (if provided), and — for Terms acceptance — the IP and approximate location described above.
• Service improvement: aggregate, de-identified statistics about platform usage.
• Legal compliance: where required by applicable law or valid legal process.

We do not sell your personal data, and we do not use it for third-party advertising.

3. Sharing and disclosure

We share personal data only with service providers that help us operate the platform, and only as needed:

• Cloudflare, Inc. — edge network, DNS, request routing, token storage, email forwarding/sending, and the IP-to-country/region lookup used for agreement records.
• OVHcloud US — the servers that run customer applications and platform services.
• Stripe, Inc. — subscription payments, invoices, payment methods, and the Customer Portal. We send your account email and account identifier to associate your subscription with your account.
• Google LLC — sign-in (OAuth); Google shares your email/name with us and processes the sign-in under its own privacy policy.
• Microsoft Corporation — sign-in with Microsoft work or school accounts (Microsoft Entra ID); Microsoft shares your email, name, tenant identifier and the tenant's verified domains with us and processes the sign-in under its own privacy policy.
• Your Organization's identity provider — if your Organization configures its own OIDC or SAML sign-in, that provider authenticates you and sends us your email address under your Organization's arrangements with it.

We may also disclose information to comply with legal obligations, to protect and defend our rights or the safety of the platform and its users, or in connection with a merger, acquisition, or sale of assets (in which case this policy's protections continue to apply to previously collected data).

4. Data location and retention

Data is stored and processed in the United States. We retain: account and agreement records for as long as your account exists (and as needed afterward for legal and audit purposes); operational logs for limited periods appropriate to security and troubleshooting; visitor sign-in entries for 90 days (see Section 1); Service Data until you or we delete the associated application (deletion is permanent — see the Terms). You can delete your applications at any time through the Services.

5. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email alerts@3000cloud.com from the address associated with your account; we will verify the request and respond within a reasonable period (and within any period required by applicable law). We will not discriminate against you for exercising your rights. Residents of California, the EEA/UK, and other jurisdictions may have additional statutory rights; we honor valid requests under those laws.

6. Security

We use technical and organizational measures appropriate to a small early-stage service: encryption in transit at the network edge, encrypted traffic between our servers, per-application network isolation, scoped credentials, and audit logging. As our Terms note, no security or isolation measure is absolute — please do not deploy data whose exposure would cause serious harm, and keep your own backups.

7. Children

The Services are not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

8. Cookies and similar technologies

Our websites use only functional storage: session tokens for the admin interface and your browser's local storage for signed-in conveniences. We do not use third-party advertising or analytics cookies. Google sign-in may set its own cookies under Google's policies.

9. Links to other sites

Applications hosted on *.3000cloud.app belong to their respective customers, not to us; their content and privacy practices are governed by whoever deployed them. Links from our sites to third-party sites are provided for convenience; their practices are their own.

10. Changes to this policy

We may update this Privacy Policy by posting a new version at 3000cloud.com/privacy with a new effective date, and will make reasonable efforts to flag material changes. Continued use of the Services after the effective date constitutes acceptance.

Contact: alerts@3000cloud.com