Privacy Policy

2.1 Account data

When you register for and use CloudyBird, we collect and process the following personal data:

• Email address (for login and communication)
• Password (stored encrypted, not in plain text)
• First and last name
• Profile picture (optional)
• User settings and preferences

2.2 Usage data

When you access the platform, we process technically necessary data:

• IP address and times of access (protection against misuse, e.g. limiting login attempts)
• Device information (browser, operating system)
• Error reports without content, on our own server

We do not use any analytics or statistics tools.

2.3 Content data (on behalf of our customers)

Content recorded in CloudyBird – e.g. tasks, comments, messages, working hours, absences, personnel files, documents and files (including text recognition), customers, quotes and invoices – is processed by us exclusively on behalf of and on the instructions of the respective customer. The customer determines the purpose, scope and storage period; the basis is the data processing agreement with the customer.

2.4 Calls and meetings

In calls in the chat and in meeting rooms, audio, camera image and screen sharing are transmitted directly between the participants' devices (WebRTC, peer-to-peer) and are end-to-end encrypted (DTLS-SRTP). Microphone and camera access is only requested in the preview or when joining. Calls and meetings are neither recorded nor transcribed; the in-meeting chat, reactions and the waiting room are not stored.

Our server brokers the connection set-up. In doing so, it stores which members took part in a call and when (for chat calls as an entry in the chat history), as well as your organisation's meeting rooms. If no direct connection can be established, e.g. behind corporate firewalls, our self-operated relay server (TURN, at Scaleway in the EU) forwards the encrypted data packets. For this purpose it processes IP addresses and connection data, but cannot decrypt the content and does not store it. The direct connection makes your IP address visible to the other participants.

Guests in meetings take part via a link without an account. For this we process the name entered (visible to the other participants) and the IP address (connection set-up, protection against misuse) and set a technically necessary cookie for the guest session (12 hours at most, readable only by our server). Guest names are not stored – the history shows only the number of guests. The form is protected against automated requests.

Noise suppression and backgrounds (blur, background image) are computed exclusively by your device in the browser; audio and camera image are not transmitted to us or to third parties for this purpose. Your own background images remain in your browser's storage and are not uploaded.

2.5 Payment data

For paid subscriptions, payment data is processed by the payment service provider Mollie. We do not store complete credit card details or other sensitive payment information on our servers. To match payments, we process technical payment references (e.g. payment and subscription IDs) as well as billing-related metadata.

2.6 Contact and support requests

If you write to us using the contact form on the website, via "Help & feedback" in the app or by email to our support address, we store your email address, your name and your company (where provided), the topic you chose, your message and our replies in order to handle and answer your request. For requests from the app, this also includes your organisation, its plan and your roles and, if you choose, the page you had open and the app version (option "Include technical details"). Of email attachments, we only store the file names.

The legal basis is Art. 6(1)(b) GDPR where the request concerns an existing or prospective contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests). There is no double opt-in and no confirmation email; we do not use the details for advertising.

5.1 Hosting provider

The platform is operated by Scaleway in data centres in Amsterdam (the Netherlands); encrypted backups are kept in Paris (France). Scaleway is a European provider without a parent company outside the EU and acts as a processor pursuant to Art. 28 GDPR. A data processing agreement (DPA) is in place. The database, files, search index and application run exclusively there.

Scaleway SAS
8 rue de la Ville l'Evêque
75008 Paris, France (EU)

5.2 Payment service provider

We use Mollie to process payments. Mollie processes payment data as an independent controller. We only transmit the information required for payment processing (e.g. email address, subscription details). To verify payment status, we also process notifications from the Mollie webhook.

Mollie B.V.
Keizersgracht 126
1015 CW Amsterdam, the Netherlands

Further information on data processing by Mollie can be found in Mollie's privacy policy.

5.3 Sending emails

We send system emails (e.g. sign-in codes, password resets, notifications) via Lettermint (the Netherlands, EU) as a processor pursuant to Art. 28 GDPR. The recipient address, subject and content of the respective email are processed.

If an organisation sets up incoming invoices by email, Lettermint receives emails sent to the organisation's inbound address, checks them for spam and passes them on to us. The sender, recipient, subject, content and attachments of these emails are processed. We only import attached e-invoices (XRechnung, ZUGFeRD) into the organisation's incoming invoices; we do not store the rest of the email.

We also send replies to contact and support requests (section 2.6) via Lettermint; Lettermint receives emails sent to our support address and replies to our support emails, checks them for spam and passes them on to us.

5.4 Signing in with Google or Microsoft (optional)

If you choose “Continue with Google”, your browser transmits the sign-in to Google (Google Ireland Limited, Dublin, Ireland). We receive your name, email address and an identifier of your Google account. A transfer to the USA by Google is possible (see section 6). Only when you click “Continue with Google” does your browser load a script from Google and display the Google sign-in; in doing so, Google receives your IP address and technical browser data (Art. 6(1)(a) GDPR, § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) – your consent through the click). Without this click, no connection to Google takes place.

If you choose “Sign in with Microsoft” or “Continue with Microsoft”, your browser redirects you to the Microsoft sign-in page (Microsoft Ireland Operations Limited, Dublin, Ireland), where you sign in with your work, school or personal Microsoft account. Microsoft receives your IP address, technical browser data and your login details in accordance with Microsoft's own privacy terms. From Microsoft we receive your name, your email address, the information whether Microsoft has verified the address, and the identifiers of your account and of your directory (organisation); only the account identifier is stored, to link it to your access (Art. 6(1)(b) GDPR – sign-in at your request). A transfer to the USA by Microsoft is possible (see section 6). Without your click on the button, no connection to Microsoft takes place.

5.5 Push notifications (optional)

If you activate push notifications, they are delivered via the push service of your browser or operating system manufacturer. The content is end-to-end encrypted; the service only sees a device identifier, your IP address and the time.

5.6 Embedded videos (optional)

In onboarding content and texts, customers can link videos from YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Vimeo. The player is only loaded when you click “Load video”; only then does your browser load content from the respective provider, which receives your IP address in the process. CloudyBird does not load images from external addresses – they are only displayed as a link.

5.7 AI assistants (optional)

Users can connect their own AI assistants (e.g. Claude or ChatGPT) to CloudyBird. The assistant then accesses the shared areas with the user's permissions; the data goes to the provider of the assistant chosen by the user. Administrators can restrict this in the settings. For each access we log the connection, user, function and result – without content – and delete the log after 90 days.

8.1 Right of access (Art. 15 GDPR)

You have the right to obtain information about the personal data we store about you.

8.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate data or the completion of incomplete data.

8.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided there are no statutory retention obligations or legitimate interests to the contrary.

8.4 Restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your personal data.

8.5 Data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

8.6 Right to object (Art. 21 GDPR)

You have the right to object to the processing of your personal data if the processing is based on legitimate interests.

8.7 Withdrawal of consent

Where processing is based on consent, you have the right to withdraw it at any time. This does not affect the lawfulness of processing carried out before the withdrawal.

8.8 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

9.1 Sign-in

For signing in, we set two technically necessary cookies (session and session renewal) that only our server can read (HttpOnly), a short-lived security cookie during the Google Drive import, and, for guests in meetings, a cookie for the guest session (12 hours at most, see 2.4). Legal basis: § 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR.

9.2 User settings

In your browser's local storage (LocalStorage/SessionStorage) we store: profile and organisation data for display, the session expiry time, a short-lived selection token when choosing an organisation after signing in, language, theme, settings for the sidebar, columns and calendar, open chat windows and, during registration, your email address. This data does not leave your device and is necessary for the function you have requested (§ 25(2) no. 2 TDDDG).

9.3 No tracking cookies

We currently do not use cookies for tracking or analytics purposes. No third-party cookies (e.g. Google Analytics) are set.