Privacy Policy
This Privacy Policy explains how CloudSync Technologies LLC (“CloudSync“, “we“, “us“) collects, uses, shares and protects personal data when you visit cloudsync.ae, use our cloud software (including CloudSync One, CampusTrack, Scholÿn, SyncSchool360 and related apps — the “Software“) or receive our IT services. It is written to meet the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, for users in India, the Digital Personal Data Protection Act, 2023, and other privacy laws where they apply.
1. Who is responsible for your data
- Data our customers put into the Software — for example their customers, employees, students or suppliers — is controlled by that customer organisation. CloudSync processes it only on the customer’s instructions to provide the Software. If you are a user or data subject of one of our customers, please contact that organisation first; we will help them respond.
- Data about our own customers, website visitors and people who contact us — CloudSync is the controller.
2. What we collect
| Category | Examples |
|---|---|
| Account and contact data | Name, work e-mail, phone number, job title, organisation, role and preferred language. |
| Sign-in and security data | Sign-in method (password, Microsoft, Google), date and time, IP address, browser and device type, success or failure of each attempt. |
| Customer content | Information customers store in the Software, such as customer and contact records, deals, invoices and financial records, documents, tickets, and e-mails sent from or captured to records. |
| Communications data | Messages you send us; delivery status of e-mails and notices we send on a customer’s behalf; opens and clicks where the customer has switched tracking on. |
| Consent records | When and how a person agreed to, or withdrew from, receiving marketing messages. |
| Device alert data | If you turn on browser or mobile alerts: the technical subscription your browser or device provides. |
| Product-specific data | Where a customer enables such features: attendance and location data (for example check-in location), and face-recognition data used for attendance verification, processed only on the customer’s instructions and with the notices and consents the customer is responsible for. |
| Website and technical data | Pages visited, server logs and error reports needed to run and secure the website and Software. |
3. Sign in with Microsoft or Google
If your organisation enables it, you can sign in with your Microsoft work or school account or your Google account. We
request only the basic scopes openid, email and profile, and receive:
- your name and e-mail address;
- a fixed account identifier issued by Microsoft or Google, which we use to recognise you at your next sign-in;
- for Microsoft, the identifier of your organisation’s directory; for Google, your Google Workspace domain where applicable.
We use this information only to sign you in, to link the sign-in to your account in the Software, and to keep a record of sign-ins for security. We do not access your mailbox, calendar, files or contacts, we do not receive your Microsoft or Google password, and we do not keep the access tokens Microsoft or Google issue after sign-in completes. We do not sell this information or use it for advertising.
CloudSync’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a linked Microsoft or Google account at any time from My sign-in in the Software, and remove CloudSync’s access from your Microsoft or Google account settings.
4. How we use data and our legal bases
- To provide the Services — hosting, running and supporting the Software under our contract with the customer.
- To keep accounts and the Services secure — authentication, preventing fraud and abuse, and investigating incidents (our legitimate interests and legal obligations).
- To communicate — service notices, invoices, support replies and, with consent, product news.
- To meet legal obligations — for example tax and accounting records.
- To improve the Services — using aggregated or de-identified usage information.
We do not sell personal data, and we do not use Customer Data to train general-purpose AI models.
5. Who we share data with
We use carefully selected service providers (“sub-processors”) that process data only on our instructions:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, databases, file storage, e-mail delivery, SMS delivery (when enabled), monitoring and backups. |
| Microsoft and Google | Sign-in, when you choose to sign in with them. |
| Browser and device push services (for example Google, Apple, Microsoft, Mozilla) | Delivering alerts to devices where you have turned alerts on. |
| Meta (WhatsApp), through Amazon Web Services | WhatsApp notices, only when a customer enables them and a person opts in. |
| Google (Gemini) | AI features, only when a customer uses them; data is sent only for the requested task. |
We may also disclose data when required by law, to protect rights and safety, or as part of a merger or acquisition under confidentiality obligations.
6. Where data is stored and transferred
Our Software is hosted on Amazon Web Services in the Asia Pacific (Mumbai) region, India. This means personal data from the United Arab Emirates and elsewhere is transferred to and stored in India. We protect such transfers with contractual commitments and the security measures described below, and apply them in line with the applicable law. Some sub-processors listed above may process data in other countries under equivalent safeguards.
7. How long we keep data
| Data | Kept for |
|---|---|
| Customer content | The subscription, then 90 days to allow export, then deleted (except records the law requires us to keep). |
| Bodies of e-mails sent or captured through the Software | 180 days by default (each customer can set a different period); the delivery record is kept without the body. |
| Read in-app notifications | 180 days. |
| Sign-in records | 365 days. |
| Consent records for marketing | As long as needed to prove consent or honour an opt-out. |
| Invoices and accounting records | As long as tax and accounting law requires. |
8. How we protect data
We use encryption in transit (HTTPS/TLS) and encrypted storage, separate each customer’s data from others, restrict access by role and on a need-to-know basis, record administrative actions in audit logs, and monitor our systems. No system is completely secure; if a personal data breach affects you, we will notify the customer and, where required, the relevant authorities and individuals.
9. Your rights
Depending on the law that applies to you, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, withdraw consent at any time, and complain to a data protection authority. To exercise a right, e-mail support@cloudsync.ae. If the data is held in the Software for one of our customers, we will pass your request to that customer and support them in responding. We will respond within the time the law allows and may need to verify your identity first.
10. Marketing messages
We and our customers send marketing e-mail through the Software only to people who have given their consent, and every marketing message includes a one-click unsubscribe link and a link to manage preferences. Opting out does not affect service messages you need, such as security or billing notices.
11. Cookies and similar technologies
We use cookies and browser storage that are necessary to sign you in, keep your session secure and remember your settings. We do not use advertising cookies in the Software. If we add optional analytics on our website, we will ask for your consent where the law requires.
12. Children and students
Our Services are designed for organisations. Where a school uses our education products, the school is the controller of pupil and parent data, decides what is collected, and is responsible for the necessary notices and consents, including parental consent where required. We process that data only on the school’s instructions.
13. Changes to this policy
We may update this Privacy Policy. We will post the new version here with a new “last updated” date and, for material changes, notify customers in advance.
14. Contact us
CloudSync Technologies LLC
Dubai, United Arab Emirates
Privacy and data protection enquiries (including our data protection officer / grievance officer):
support@cloudsync.ae
