Privacy Policy

This Privacy Policy describes how Curry Support, LLC, an Indiana limited liability company that operates Cloud Point Data (“Cloud Point Data,” “we,” “us,” or “our”), handles personal information in connection with our websites and the Cloud Point Data service (the “Service”). Please read it alongside our Terms of Service.

1. Our two roles: business/controller vs. service provider/processor

Cloud Point Data serves businesses. Our privacy responsibilities depend on whose information is involved:

• When we act as a business/controller. For personal information about our website visitors, prospects, and the individuals who sign up for and administer accounts (for example, account owners and administrators), we determine how and why the information is processed. This Policy governs that information.
• When we act as a service provider/processor. For the employee and workforce records that an Organization (our customer) enters into the Service (“Employee Data”), the Organization is the controller. We process that information only to provide the Service on the Organization’s behalf and under its instructions and its own privacy notices. If you are an employee of one of our customers and have questions about your records, please contact your employer, who controls that data. We will support our customers in responding to such requests.

2. Information we collect

a. Information you provide (account and business users)

• Account information: name, business email address, password (stored only as a salted hash), Organization name, and role.
• Billing information: subscription plan, billing history, and a token/reference to your payment method. Full card numbers are collected and stored by our payment processor (Stripe), not by us.
• Support and communications: messages, support tickets, and any files or screenshots you attach, plus your correspondence with us.

b. Customer/Employee Data (processed on our customers’ behalf)

Organizations use the Service to store records about their workforce, which may include employee names and identifiers, department or location, attendance and disciplinary “point” records, write-ups and their reasons, point balances and history, and files or images uploaded as evidence. We process this information as a service provider on the Organization’s behalf.

c. Information collected automatically

• Log and device data: IP address, browser type, pages viewed, timestamps, referring pages, and similar diagnostic data.
• Cookies and similar technologies: strictly necessary cookies to keep you signed in and to protect against cross-site request forgery, plus limited data to remember preferences (such as theme). See Section 8 and our Cookie Notice.

We do not use third-party advertising cookies, and we do not sell advertising in the Service.

3. How we use information

As a business/controller, we use personal information to:

• provide, operate, maintain, and secure the Service and create and administer accounts;
• process payments, subscriptions, trials, promotions, and usage-based billing;
• provide customer support and respond to your requests;
• send administrative and transactional messages (for example, confirmations, security alerts, billing notices, and service changes);
• monitor, troubleshoot, analyze, and improve the Service, including developing new features;
• detect, prevent, and address fraud, abuse, security incidents, and technical issues; and
• comply with legal obligations and enforce our Terms.

We process Employee Data only as needed to provide the Service to the relevant Organization and per its instructions, not for our own independent purposes.

4. Why we are permitted to process information

Depending on the context, we process personal information because it is necessary to perform our contract with you, because we have a legitimate business interest (such as securing and improving the Service) that is not overridden by your rights, because you have consented, or because we must comply with a legal obligation.

5. How we share information

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We disclose personal information only as follows:

• Service providers / subprocessors. We use vetted vendors to host and run the Service (for example, cloud hosting, database, file storage, email delivery, and payment processing). They may process personal information only to provide services to us and under confidentiality and data-protection obligations. A current list is in our Legal Center.
• Within your Organization. Customer and Employee Data is accessible to the Authorized Users your Organization permits, according to the roles and permissions your Organization configures.
• Legal and safety. We may disclose information if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Cloud Point Data, our customers, or others, or to investigate fraud or security issues.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
• With your direction or consent. We share information as you otherwise direct or authorize.

6. Data retention and deletion

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Customer and Employee Data is retained for the duration of your subscription. Consistent with our Terms:

• Within the Service, certain records (such as write-ups) may be preserved as history (for example, voided rather than deleted) so long as your account is active, to keep an accurate, auditable record for the Organization.
• After cancellation, termination, or a lapsed free trial, and after any grace or notice period we provide, your Customer Data — including uploaded files — may be permanently deleted or purged in the ordinary course. Please export any data you wish to keep before that occurs.
• We may retain limited records (such as billing history and logs) as required for legal, tax, security, or accounting purposes.

7. How we protect information

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encryption of data in transit (HTTPS), hashed passwords, tenant isolation so each Organization’s data is scoped to that Organization, role-based access controls, audit logging of sensitive actions, and content-security protections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and for configuring appropriate access within your Organization.

8. Cookies and tracking

We use only the cookies and similar technologies necessary to operate the Service securely (for example, session and anti-forgery cookies) and to remember basic preferences. We do not use third-party advertising or cross-site tracking cookies. Because we rely on strictly necessary cookies, disabling them may prevent the Service from functioning. For more detail, see the Cookie Notice in our Legal Center.

9. Your U.S. state privacy rights (including California)

Depending on your state of residence (for example, California under the CCPA/CPRA, and similar laws in other states), you may have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising — note that we do not sell or share personal information in this way; and
• Non-discrimination for exercising your rights.

Categories collected. In the past twelve months, we have collected identifiers (such as name and email), commercial information (such as subscription and billing records), internet or network activity (such as log data), and the content you provide (such as support messages and, for customers, the Customer Data you upload). We disclose these categories to service providers as described in Section 5. We do not sell or share personal information, and we do not knowingly collect personal information from children.

How to exercise rights. Account and website users may submit requests to privacy@cloudpointdata.com. We will verify your request (for example, by confirming control of the account email) before responding, and you may use an authorized agent where permitted. If your request concerns employee records held by an employer that uses the Service, please contact that employer, which controls the data; we will assist our customer as their service provider.

10. Children’s privacy

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information directly from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

11. Location of processing

We operate from the United States, and the Service and its providers are generally located in the United States. If you access the Service from outside the United States, you understand that your information may be processed in the United States, where privacy laws may differ from those in your location.

12. Third-party links and services

The Service and our websites may link to or interoperate with third-party services (such as our payment processor). Their handling of your information is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice in the Service or by email. Your continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.

14. Contact us

If you have questions or requests regarding this Policy or your personal information, contact us at:

• Privacy requests: privacy@cloudpointdata.com
• General and legal: legal@cloudpointdata.com
• Or use the in-app support tools.

---

This document is provided for general informational purposes and does not constitute legal advice. You should have your own qualified counsel review this Policy before relying on it for your business.