What we collect

This site is run by cloudbud (Greenbox Farms B.V., KvK 90200764, VAT NL865239885B01), the controller of the personal data described here. You can reach us at hello@cloudbud.co. We have no data protection officer; write to that address about anything on this page.

No cookies, no tracking across sites

We set no cookies and store no identifier in your browser. We do not use Google Analytics, advertising pixels or any third-party tracker. Nothing you do here is sold or shared with an advertising network.

The only things this site writes to your browser are your answers to our two consent questions (analytics on this site, and reading time on a document we shared with you), once you give them: yes or no, the date, and which version of the question. There is no identifier in them, and after six months we ask again.

Analytics

With your consent we count page views and a small number of clicks (which product someone opened, which store badge or outside link was clicked, whether the contact call-to-action was used) so we can see how the site is used. This is measured first-party, on our own infrastructure.

Each count sends the page's path, any campaign tags in its address (utm_source, utm_medium, utm_campaign) and the address of the site that linked you here, without its path. To tell one visit from another without storing who you are, our server derives a key from a random salt, your IP address and your browser's user-agent string. A new salt is made each day and deleted within two days of that day ending; after that, its keys cannot be recalculated or linked to any other day. Your IP address is never stored. We keep a broad device class and the country your request came from.

Individual counts are deleted after 90 days. We keep only daily totals after that.

We count only if you agree (GDPR Art. 6(1)(a)). We ask once, with a banner at the bottom of the page; until you answer, nothing is counted. You can withdraw at any time below; withdrawing stops counting from then on and does not affect what was counted before. If your browser sends Global Privacy Control or Do Not Track, we take that as a no and do not ask. Our server also discards any count that arrives with either signal, or without consent to the current version of the question.

Because a day's key cannot be traced to anyone once its salt is deleted, we cannot find, show or delete your past counts on request (GDPR Art. 11). Withdrawing your consent stops all future ones.

Your choices

When you ask for a quote or contact us

If you send the quote form we receive what you typed (your name, e-mail, company, a link, your message and your answers), with the country your request came from, a broad device class and the site that linked you to the form. We use it to answer you and to prepare a proposal you asked for (GDPR Art. 6(1)(b)). Your name and e-mail are needed to reply; without them we cannot.

We keep a request while we are discussing it with you. If it becomes a project, it stays with that project's records for as long as the law requires us to keep them. Otherwise we delete it once the conversation is over, or sooner if you ask.

To stop abuse, we count how many requests come from one connection each day, using a key derived from your IP address that changes daily; the count is deleted after two days. The form's last step is protected by Cloudflare Turnstile, which loads only on that step and checks that a person is sending the form. It reads your IP address and signals from your browser, and its frame may store a value in your browser. Cloudflare processes this for us, and also uses the signals itself to improve its bot detection (see Cloudflare's Turnstile privacy policy). We rely on our legitimate interest in keeping the form free of automated abuse (GDPR Art. 6(1)(f)). If the check stops you, e-mail us instead.

If you e-mail us or book a call, that data sits with our e-mail provider and with Calendly under their own terms, and we keep it as described above.

When you apply for a job

An application holds what you give us (your name, e-mail and CV, and if you add them, your phone number, where you are based, LinkedIn and portfolio links, experience, availability, motivation and salary expectation), with the country your request came from, a broad device class and the site that linked you to the form. Only the people hiring for the role see it. We use it to consider you for that role, a step you asked us to take before a possible contract (GDPR Art. 6(1)(b)). Your name, e-mail and CV are needed to consider you.

We delete your application and your CV four weeks after the posting closes, or sooner if you ask. The same abuse limit and Cloudflare Turnstile check as the quote form apply.

Shared documents

We sometimes send a private link to a document or a deck. The link records when it was opened, so we know whether what we sent arrived; that is our legitimate interest (GDPR Art. 6(1)(f)). How long each page was on screen, and your device type, are recorded only if you say yes when the document asks (GDPR Art. 6(1)(a)); you can change that answer on the document at any time.

The document is served by our API on Google Cloud, whose request logs keep your IP address and browser string for up to 30 days, for security and troubleshooting. These records stay until we delete the link, which we do on request. Links can be withdrawn and expire.

Serving the site

Every request to this site passes through Cloudflare, which delivers the pages and protects them from attacks. Cloudflare processes your IP address and request details for that, briefly and on our behalf. If it treats a request as suspicious it may ask your browser to pass a check and then set a security cookie (cf_clearance) for that; ordinary visits get no cookie. We rely on our legitimate interest in a site that is available and secure (GDPR Art. 6(1)(f)).

Who processes data, and where

• Cloudflare, Inc.: delivery, security and Turnstile. Its network is worldwide; transfers outside the EU rely on the EU-US Data Privacy Framework and the Commission's standard contractual clauses.
• Google Cloud and Firebase (Google LLC): our database, file storage and API. The data is stored in the European Union; request logs are kept in Google's global logging service. Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
• Our e-mail provider and Calendly, only if you use those channels.

They process data on our instructions, except where this page says otherwise (Cloudflare's own use of Turnstile signals). We do not sell personal data, and no decision about you is made by automated means alone; Turnstile only decides whether a form submission looks automated, and you can always e-mail us instead.

Your rights

Under the GDPR you may ask what we hold about you and get a copy, ask us to correct or delete it, ask us to restrict how we use it, and receive data you gave us in a portable form. You may withdraw consent at any time, without affecting what was done before. You can also complain to a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

Your right to object. Where we rely on our legitimate interest (recording that a shared link was opened, the Turnstile check, serving and securing the site) you may object at any time, on grounds relating to your situation, and we will stop unless we have compelling reasons that override yours.

Write to hello@cloudbud.co. If you have never written to us or applied for a job, we almost certainly hold nothing that identifies you.

Changes

If this policy changes we update the date at the top. If what we ask your consent for changes, we ask again. We do not notify past visitors, because we have no way to contact them. That is rather the point.