Privacy policy

Last updated: 1 November 2026. This policy explains what personal data Cloudpilar Limited collects through this website, why we collect it, how long we keep it, and what rights you have under UK GDPR.

Who we are

Cloudpilar Limited, a company registered in England and Wales (company number 15273802), 23 Derwent Road, Bristol BS5 7SJ, United Kingdom. We are the data controller for personal data collected through this website. You can reach us at admin@cloudpilar.com.

What we collect and why

Enquiries

If you submit the contact form we collect your name, email address, and any organisation, phone number, area of interest, budget range and message you choose to provide. We also record the IP address you sent it from and the page you used. We use enquiry details solely to respond to your enquiry and, where relevant, to provide services you have asked about.

Your CloudPilar account

If you create an account, we collect your name, your email address, the date you registered and a sign-in name we generate for you. Your password is stored only in scrambled (hashed) form, so nobody at CloudPilar can read it.

We use these details to:

• create your account with the password you choose, and email you a link to confirm that the address is yours. You confirm it by opening the link within 24 hours and entering your password. Accounts whose address is never confirmed are deleted after 7 days;
• sign you in and out, and keep you signed in while you use the site;
• send you a password-reset link when you ask for one. A reset link works for 24 hours;
• show you your account pages, where you can change your name, password or email address. A new email address is used only after you confirm it from a link we send to it, and we tell your previous address about the change.

When you confirm your email address, our team receives an email with your name and email address, so we know a new account has been created. You also confirm that you are 18 or over and have read this policy. We do not send marketing emails to account holders.

The affiliate programme

If you apply to join the affiliate programme, we collect your name, email address, country, preferred payout currency, your website or main channel (optional) and how you plan to promote our apps. You also confirm that you are 18 or over, that you accept the programme terms and that you have read this policy; we record which version of the terms you accepted and when you confirmed each. You need a CloudPilar account with a confirmed email address to apply, and your application uses that address.

We use these details to:

• review your application. A member of our team reviews every application and decides whether to approve or decline it; we are notified of new applications by email;
• email you our decision, and tell you if your account is later suspended;
• run your affiliate account: your referral links, your dashboard and your profile.

In your affiliate profile you may add a payout method and a short note. We never ask for bank details there.

To stop duplicate and fraudulent accounts, we keep a pseudonymised form of your email address and of the network address you applied from with your affiliate account.

We keep a record of the decisions our team makes about your affiliate account, such as approval, including who made them, when, and any reason given, so that they can be checked later.

If your affiliate account is closed, for example when you ask us to delete your account, we clear your website, promotion details, payout note and the pseudonymised codes, and delete the records of your sign-in networks and devices. We keep the record of the decisions made and of the terms you accepted for 24 months, then delete them. Declined applications are deleted 12 months after our decision.

Referral links

When someone follows an affiliate’s referral link, we record the visit on our server: a random reference number, the app and affiliate concerned, the date and time, the type of device (for example “mobile”), the website the visitor came from, and pseudonymised forms of the visitor’s network address and browser type. We do not store IP addresses or browser details themselves, and affiliates never see anything that identifies the people who click their links.

We use these records to show affiliates how often their links are used, to filter out automated and repeated clicks, and to detect misuse of the programme, such as affiliates clicking their own links. To help with that last check, when an affiliate signs in we place a security cookie in their browser and keep a pseudonymised record of the networks they sign in from.

A referral cookie can also remember a referral on the visitor’s later visits, but only with their consent. We do not currently ask for that consent, so this cookie is not used.

Browsing the website and the Apps Marketplace

You can browse the website and our Apps Marketplace without an account. We do not use analytics, advertising or social media tracking on this website. Searches and filters you use in the marketplace form part of the page address, which appears in our host’s server logs (see “Security” below).

The download buttons on an app’s page take you to the App Store, Google Play or the Chrome Web Store. Some pass through a short redirect on our site first; apart from our host’s server logs, we keep no record of these redirects. Once you leave our site, the store’s own privacy policy applies.

Payments, commissions, payouts and refunds

This website does not take payments, and it does not currently receive or keep any purchase, commission, payout or refund records. Our apps are bought through the App Store, Google Play, the Chrome Web Store or the app’s own checkout, under that app’s own privacy policy. No app currently pays affiliate commission, and no payment provider receives personal data from this website. If that changes, we will update this policy before it does.

Security

Our host records standard server logs including IP address and browser type, for security and troubleshooting.

While you are signed in, WordPress keeps a record of each signed-in session on your account, including the IP address and browser of the device used, so that sessions can be checked and ended. This is the one place where we keep your IP address itself rather than a pseudonymised form.

To stop spam sign-ups, password guessing and floods of password-reset or application emails, we briefly keep a pseudonymised count of sign-up, sign-in, password-reset and affiliate-application attempts from each network address, and of applications from each email address. The registration and application forms also contain a hidden field and a timer that catch automated submissions; these hold no personal data.

What “pseudonymised” means here

Where this policy says “pseudonymised”, we store a keyed, one-way code made from the original detail, such as an IP address, instead of the detail itself. We can tell when the same code appears again, but we cannot turn it back into the original. It is still personal data, and we protect it as such.

Our lawful bases

What we do	Lawful basis under UK GDPR
Responding to enquiries	Legitimate interests: responding to someone who has contacted us about our services. Where a contract follows, performance of that contract
Creating and running your account, confirming your email address, signing you in and resetting your password	Contract: providing the account you asked for
Reviewing affiliate applications and running affiliate accounts, including the emails about them	Contract: taking steps you asked for before entering, and then performing, the programme agreement
Recording referral clicks, filtering automated clicks, and checking for affiliates’ own clicks (including the affiliate security cookie and sign-in networks)	Legitimate interests: running the programme fairly and preventing fraud
Keeping records of our team’s decisions	Legitimate interests: being able to check and explain our decisions
Telling our team about new accounts and affiliate applications	Legitimate interests: knowing who has joined and reviewing applications promptly
Server logs, signed-in session records, and limits on sign-up, sign-in, password-reset and application attempts	Legitimate interests: keeping the website and your account secure
The referral cookie (not currently used)	Consent
Responding to requests to exercise your rights	Legal obligation

Who we share it with

We do not sell your data. We share it only with service providers who host this website and deliver our email, and only to the extent needed to operate the service. All are bound by contract to protect it. They are:

• Hostinger International Ltd, which hosts this website and its database (including the account, affiliate and enquiry data above) on servers in France, keeps the server logs, and sends the emails the website generates, such as password and affiliate emails;
• SiteGround, which hosts our email on servers in the United Kingdom, including messages sent through the contact form and our notifications of new accounts and affiliate applications.

We never share a customer’s or visitor’s personal details with affiliates.

Our website and its database are hosted in France, in the European Economic Area. UK law recognises the European Economic Area as providing an adequate level of protection for personal data (UK adequacy regulations), so these transfers need no further safeguard. Our email stays in the United Kingdom.

How long we keep it

Data	How long we keep it	Deleted automatically?
Enquiries	24 months from your last contact with us, after which they are deleted. Where an enquiry becomes a client relationship, records are kept for the period required by our contractual and tax obligations	Yes, daily, unless we have marked the enquiry to keep for a client relationship or a legal reason
Your account, including the date you registered	Until you ask us to close it, when we delete your account	No — deleted by us on request
Signed-in session records (IP address and browser)	While the session lasts: until you sign out, or for up to 2 days (14 days with “Remember me”)	Yes, daily once the session has ended
Password-reset links	Work for 24 hours	Yes, daily once expired
Links to confirm an email address	Work for 24 hours and only once. A coded copy, which cannot be used again, stays with your account	With your account
Accounts whose email address is never confirmed	7 days	Yes, daily
Declined affiliate applications	12 months from our decision	Yes, daily (see exceptions below)
Closed affiliate accounts and the records of our team’s decisions	24 months from closure	Yes, daily (see exceptions below)
Pseudonymised email and application network address kept with an affiliate account	While the affiliate account exists; cleared when it is closed	Yes, on closure
Affiliates’ pseudonymised sign-in networks	90 days	Yes, daily
Affiliate security cookie and its coded copy on our server	400 days	Yes, daily for our copy; your browser deletes the cookie
Referral click records	395 days. Daily click totals, which contain no personal data, are kept	Yes, daily
Pseudonymised attempt counts for security limits	15 minutes to 24 hours, depending on the limit	Yes, daily once expired
Emails our team receives about new accounts and affiliate applications	90 days	No — deleted by us under our mailbox procedure
Server logs	As set by our host	By our host

Exceptions: we keep affiliate records beyond these periods only where we need them for a contract, for accounting (for example, records of commission or payouts, which do not exist at present), to deal with a dispute or legal claim, or because the law requires it. We delete them once that need has ended.

Your rights

You have the right to access, correct, erase, restrict or object to our processing of your personal data, and the right to data portability. You can change your password and email address yourself on your account page. To exercise any of these rights, including asking for a copy of your data or for your account to be closed, email admin@cloudpilar.com. We will reply within one month. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Children

You must be 18 or over to create an account or to join the affiliate programme, and you confirm this when you register or apply. If we learn that we hold an account for someone under 18, we will delete it.

Automated decisions

We do not make decisions that have legal or similarly significant effects on you by automated means alone. Our team reviews every affiliate application. Automatic checks, such as flagging possible self-clicks, only mark items for a person to look at.

Cookies

See our cookie policy for details of the cookies this site uses.

Changes to this policy

When we change how we use personal data, we will update this page and the date at the top. If a change affects you significantly, we will tell you by email before it takes effect.