Privacy Policy

Octabyte ("we") runs the Cloudgate console at cloudgate.octabyte.app (the Hosted instance) and this website, cloudgate.octabyte.io.

For your account, billing and this website, we decide how personal data is used, so we are the controller. For personal data inside your Organization's Projects, such as data your apps hold or your logs, your Organization decides and we are its processor. Our Data Processing Addendum covers that role.

This policy covers the Hosted instance, the Cloudgate command-line tool and MCP endpoint when used with it, the emails we send, and this website.

It does not cover a self-hosted Cloudgate install: whoever runs that install controls its data, and Cloudgate sends us nothing from it. It does not cover the apps you deploy, which have their own policies.

Your account

• Your name, email address and password. The password is stored as a hash, never as you typed it.
• Two-step verification settings, and, if your Organization uses single sign-on, the details your identity provider sends.
• For each signed-in session: your IP address, your browser's user agent and the session's times. You can see and end your sessions in the console.

Your Organization

• Organization names, Members and their roles, grants and invitations, Agents, personal keys and agent keys.
• The audit log: who did what and when, whether it succeeded, and the IP address of the request.

Billing

• Stripe collects your card, billing address and any tax ID. We do not see or store your full card number.
• We store the Stripe references for your customer record and subscription, your plan and its state.
• To allow one Free trial per person and per card, we keep the email addresses and card fingerprints that have had a trial. A card fingerprint identifies a card without revealing its number.

What you set up

• Server addresses and the SSH keys Cloudgate makes for them, cloud account credentials, git provider connections, notification channels, Project configs, environment variables and secrets.
• Secrets, keys and credentials are encrypted at rest, and the console and API show only whether a secret is set, never its value.

What your Services produce

• Deployment logs are kept for 90 days on the machine that ran the build.
• Runtime logs are read from your Servers and cloud accounts when you open them.
• Access logs stay on your Servers and are read over SSH when you ask; they are never copied into Cloudgate.
• Traces are kept in a store on your own Server.
• Token spend: the Gateway records, for each call to an AI model, the model, the Agent that called, the token counts and the times. It never stores prompts or answers. Each call's record is kept for 90 days, then only daily totals remain.

When you buy a Server

The console suggests a nearby location from your browser's time zone. That is worked out in your browser and never sent to us.

When you contact us

Your messages and the details you give us.

Almost nothing. cloudgate.octabyte.io is a static website.

• It sets no cookies and runs no analytics, advertising or tracking.
• It loads no third-party scripts. Its fonts and scripts are served from this website.
• If you choose light or dark with the theme switch, your choice is saved in your browser's local storage as cg-theme. It never leaves your device. See the cookie notice.
• The website is served by GitHub Pages. Like any web host, GitHub receives your IP address and request details to deliver the pages, under GitHub's privacy statement.

• To provide the Service you signed up for (contract): your account, sign-in, Organizations, Deployments, billing and support.
• To keep the Service secure and prevent fraud (legitimate interests): sessions, the audit log, rate limits, one trial per person and per card, and handling abuse reports.
• To meet our legal duties (legal obligation): invoices, tax and accounting records, and answering lawful requests.
• To improve the Service (legitimate interests): reading your feedback and support requests.

We do not sell personal data, share it for advertising, or use it to profile you. We do not send marketing emails today. If we start, we will ask first or let you opt out, as the law requires.

We send only emails about your account and the Service. You cannot opt out of these while you have an account, because they carry information you need:

• email confirmation, password resets and invitations to an Organization;
• invoices, failed payments, the start of a Free trial and a reminder 7 days before it ends;
• warnings before an Organization lapses or is deleted, and notice of Bought Server price changes;
• abuse reports about your Organization that need your answer.

Notifications you set up yourself, such as alerts to email, Slack or a webhook, go where you point them.

• Service providers (subprocessors) who process data for us under contract: payments, email delivery, the infrastructure the Hosted instance runs on, and the provider of Bought Servers. They are listed on our subprocessors page.
• Services you connect. When you connect a Server, a cloud account, a git provider, a notification channel or an AI provider, Cloudgate sends them what is needed to do what you ask. Their own terms and policies apply.
• The law. We disclose data when the law requires it, or to protect people, the Service or our rights. Where we may, we tell you first.
• A change of owner. If Octabyte's business is sold or merged, data may pass to the new owner under this policy.

Our staff who run the Hosted instance see an Organization's account details, such as its plan and state, but not what is inside its Projects. To help inside a Project, they need you to invite them as a Member.

We and our subprocessors may process personal data outside the country where you live, including in the United States. When personal data leaves the UK or the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses (with the UK Addendum where needed), or another safeguard the law allows.

The workloads you deploy run where your Servers and cloud accounts are. You choose that.

• Your account while it exists. To delete your account, email support@octabyte.io.
• A signed-in session lasts three days and is extended while you use it.
• Deployment logs and per-call token records: 90 days.
• An Organization's data until you delete the Organization, or 30 days after its plan lapses. Deleting an Organization removes its secrets, keys, cloud credentials, configs and logs.
• The audit log is kept after an Organization or account is deleted, so the record of who did what survives. It holds the actor's name, email address and IP address.
• Free trial history (email addresses and card fingerprints) is kept after deletion, to allow one trial each.
• Billing records as long as tax and accounting law requires.

• The Hosted instance is served over HTTPS only, and its session cookie is never sent over plain HTTP.
• Secrets, SSH keys, tokens, cloud credentials and database passwords are encrypted at rest with AES-256-GCM.
• Passwords are hashed. Two-step verification and single sign-on are available.
• Secrets are masked out of what the API returns and out of every result an Agent receives, logs included.
• Roles and grants limit what each Member and Agent can reach, and the audit log records every change and every Agent call.
• Our server logs leave out cookies and credentials.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will tell you and the authorities as the law requires.

Depending on where you live, you have rights over your personal data. You can use many of them in the console: you can update your profile, end sessions, move a Project config into your own git repository, and delete your Organization. For anything else, email support@octabyte.io. We may ask you to confirm who you are.

UK and EEA (UK GDPR and GDPR)

You can ask to access, correct, delete or move your data, ask us to restrict or stop using it, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. We answer within one month. You can also complain to your data protection authority; in the UK that is the Information Commissioner's Office.

California and other US states

You can ask what personal data we hold and how we use it, and ask us to correct or delete it. We do not sell or share personal data for targeted advertising, so there is nothing to opt out of. We will not treat you differently for using these rights. We answer within 45 days.

Data in your Organization's Projects

If you are a user of an app one of our customers runs, contact that customer. We will help them answer you.

Cloudgate is for businesses and developers. It is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child has given us data, email support@octabyte.io and we will delete it.

We will update this policy when what we do changes. The date at the top shows the latest version. If a change matters to you, we will tell you by email or in the console before it applies.

Questions or requests about privacy: support@octabyte.io.