Privacy Policy

1. Scope and our role

Cloud Partners operates cloudhub.lk and CloudHub products that link to this Policy, including procurement solutions, Muster and Cloudyy. This Policy also covers personal information we handle for related implementation, support, custom development and cloud subscription services. Future products must link to this Policy and disclose their actual data practices before launch.

We determine how to use information for our own enquiries, business contacts, billing, service administration and security activities where we act as a controller. For records processed on an organisation's behalf, that organisation normally determines the purposes and instructions and we act as its processor. An organisation may itself act for another controller; the applicable agreement records the relevant roles.

Your employer or customer organisation may provide its own privacy notice. Third-party platforms have separate notices for their own processing. Product-specific notices provide additional detail and should be read with this Policy. A privacy notice informs you about processing; reading it is not blanket consent to every data use.

2. Information and its sources

We receive information from you, authorised users and administrators, customer organisations, integrated service providers and the devices used to access our services. Account and contact information can include name, work email, telephone, organisation, job, profile photo, permissions and identity or account verification information.

Business information can include billing contacts, invoicing details, tax identifiers, subscription and transaction records, enquiries, support correspondence and documents you choose to provide. Payment providers process payment details for their own functions; our services can receive transaction references and payment status.

Technical information can include IP addresses, browser and device details, timestamps, authentication and session activity, API usage, errors and audit events. Cookies and local storage support authentication, preferences and enabled features. We do not request that you send passwords or unnecessary identity documents to public support channels.

3. Procurement and document automation

Procurement services can process employee and supplier contacts, requisitions, quotations, approvals, orders, receipts, invoices, vendor banking or tax details, payment records, attachments and audit history. Access depends on the customer's organisational structure and permissions.

Cloudyy processes document templates, HTML, structured data and other content submitted for document generation, together with account, API, usage, billing and transaction information. Saved templates and their variables can be retained in the account. A deletion of a saved template does not automatically delete separate usage or billing records.

Only submit content you are authorised to provide. Document content can contain personal or confidential information. Product configuration and integrations determine whether content is saved, transmitted to another service or delivered to a recipient. A temporary rendering operation should not be assumed to mean that every associated record has been deleted.

4. Muster workplace and mobile data

Muster can process attendance and breaks, shifts, leave, remote-work requests, employee records, projects, tasks, performance, onboarding, benefits, HR support and payroll. Depending on enabled features, records may include compensation, banking details, statutory or identity information, emergency contacts and documents containing health or other sensitive information.

With device permission and the organisation's configuration, Muster can collect precise coordinates, accuracy, timestamps, resolved addresses and device information for attendance, geofences and field operations. Enabled mobile tracking can send location while a user is checked in, including in the background with background permission. Authorised organisational users may view location maps, routes, visits and related summaries.

You can change location permissions in your device settings and check out when a work session ends. Revoking device permission can stop further collection by that device but does not erase past records. Restricting permissions may prevent related features from working. Your organisation must explain and establish the lawful basis for workplace monitoring.

Camera access supports QR attendance and user-selected photos. Connected terminals can supply employee identifiers, attendance events and device records. Biometric enrolment or templates held on a terminal are governed by the organisation and terminal provider; the reviewed Muster integration processes attendance events. Any future collection of fingerprint or face templates by Cloud Partners requires separate disclosure and applicable safeguards.

Enabled notifications use contact details and device push tokens. If an organisation enables Google Wallet employee passes, selected employee identity, photo, job, department and pass details are sent to Google to create and update the pass.

5. Google sign in and optional AI

For the reviewed Muster Google sign-in flow, the permissions are openid, email and profile. Google supplies an account identifier, email and verification information and may supply name and profile photo to authenticate and link an authorised account. This flow does not grant access to Gmail messages, Drive files, contacts or calendars. Other products must disclose their actual Google permissions and purposes at the point of connection.

Information received from Google APIs is handled under the Google API Services User Data Policy, including Limited Use requirements where applicable. Google API information is not sold, used for targeted advertising or used to train general-purpose AI models. Human access and onward disclosure must remain within the applicable Google requirements.

You may revoke a product's Google access through your Google Account connections. Revocation does not automatically remove workplace records, delete a CloudHub account or terminate an existing session. Sign out and contact your organisation or us for a related closure or deletion request.

Where optional AI is enabled, prompts, responses and conversation history can be processed. Muster sends the question and selected workplace context, including relevant user identity and role information, to Google Vertex AI to generate a response. Conversation history is stored in Muster. Access and organisation settings determine the context supplied. Do not enter unnecessary sensitive information.

AI processing must be disclosed for the enabled product, including the provider, purposes and any relevant retention arrangements. Review generated outputs; AI must not be the sole basis for consequential employment, payroll or legal decisions. A new AI provider or material new data use requires an updated notice and appropriate processing arrangements.

6. Purposes and lawful processing

We use information to provide and administer services, authenticate authorised users, process customer instructions, generate documents, operate approvals and reporting, deliver notifications, manage orders and billing, provide support and protect the service. We also handle lawful recordkeeping, disputes and required disclosures.

For our controller activities, applicable grounds may include performance of a contract with the individual, legal obligations, legitimate interests where permitted and appropriately balanced, or consent where required. An organisation's contract with us does not automatically provide a contractual ground for every use of an employee's data.

Customers determine the lawful grounds for records processed on their instructions, including any additional conditions for health, biometric or other sensitive information. We do not treat permission to use a device feature as consent to unrelated processing. Where processing relies on consent, you can withdraw it; withdrawal does not invalidate prior lawful processing.

Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025, applies according to its scope and commencement provisions. Other laws, including GDPR or California privacy law, apply only where their legal scope and applicability requirements are met. An overseas individual's location alone does not establish every obligation under those laws.

7. Recipients and service providers

Customer records are available to the customer's authorised users and administrators according to their permissions. Our authorised personnel may access information as necessary to deliver, support or secure the service, subject to appropriate confidentiality and access restrictions.

Relevant providers may include Google Cloud for hosting, databases and storage; Zoho and Zoho Catalyst for configured cloud applications and procurement services; Google for sign-in, maps, Vertex AI and enabled Wallet passes; configured email providers; Expo and platform notification services; and payment providers such as PayPal where enabled. Only the providers used by the product receive information needed for their function.

Maps and address lookups may send coordinates or search terms to Google. Where OpenStreetMap tiles are used, the map provider can receive the viewer's IP address and requested map area. A product's provider list or contractual processing schedule should identify its specific providers and locations.

We may disclose information where required by valid legal process, to address misuse or protect legal rights, or in a business transfer with appropriate safeguards and any required notice or consent. We do not sell personal information or share it for targeted advertising. Customer-directed exports and integrations send information to the recipients the customer authorises.

8. International processing and security

Cloud hosting, integrations and support can involve processing outside Sri Lanka. Muster's documented primary hosting is Google Cloud in Singapore. This does not mean every provider or every CloudHub product processes all information solely in Singapore. Other products and providers use their configured regions and service locations.

Where applicable law requires safeguards for international processing, these must be addressed through the relevant contracts and legally available transfer mechanisms before the transfer. Use of a well-known cloud provider or a region label does not itself establish compliance or an adequacy decision.

Controls are selected for the service and its risks and can include authenticated access, permission checks, encrypted HTTPS connections, password protection and audit records. Operational controls, storage encryption and backup arrangements depend on the deployed service. No system is completely secure. The Security Policy explains the responsibilities and limits of our public security statements.

9. Retention account closure and deletion

Retention depends on the record type, service purpose, customer instructions, legal recordkeeping and the applicable agreement. Billing records may need to remain after a subscription ends; workplace, procurement and payroll records can have different requirements. There is no single retention period for all CloudHub information.

Customers should agree a retention and return or deletion schedule for their records. Subject to the Terms and any different written arrangement, they may request available return or export within 30 calendar days after termination. Account deactivation or deletion of an individual item does not automatically erase records held for the organisation.

Deletion from active systems can occur before expiry of backup and log retention. Residual copies are restricted to the purposes that justify their retention and expire under the applicable schedule, subject to legal preservation requirements. If retained backups are restored, applicable deletion instructions must be reapplied. We do not promise that all copies are permanently erased within 30 days.

Contact us for the retention arrangements applicable to your product or request. We can explain why a record must be retained, subject to restrictions on disclosure required by law or security.

10. Rights requests and contact routes

Depending on applicable law and its operative provisions, you may have rights to access, correct or delete information, withdraw consent, object, restrict processing, receive portable data or seek review of specified automated decisions. These rights have legal conditions and exceptions. You may raise concerns with a competent data-protection authority where its powers apply.

For employer or customer-controlled records, contact the organisation's administrator or HR team first. You may also email hello@cloudpartners.biz with the subject "Privacy request", your organisation, account email, relevant product and requested action. We will route the request according to our role, verify identity proportionately and assist the customer where appropriate.

We handle requests within applicable legal deadlines and explain lawful limitations. Do not send passwords, bank credentials or unnecessary identity documents. This contact is our privacy enquiry route; naming it does not imply that a statutory Data Protection Officer has been appointed.

11. Cookies communications children and changes

Essential cookies and local storage support sessions, security, interface preferences and mobile operation, including queued offline activity where enabled. Blocking them can affect functionality. Muster's reviewed public notice states that it does not use advertising cookies; this statement is not a blanket description of every future product.

Any non-essential analytics, advertising or similar tracking must be disclosed for the relevant site or product and use consent or other controls where legally required. Where consent is required, rejection and withdrawal must be available; browser settings alone do not replace the required choice. Embedded content and external resources may communicate with their providers.

Service messages may be needed to operate your account. Optional marketing communications should provide an unsubscribe route and use the required processing basis. Our business services are not directed to children; organisations must ensure any records concerning minors are lawful and appropriate.

We may update this Policy as services and processing change. We will publish the revision date and communicate material changes through an appropriate channel. A materially new purpose requires the relevant notice and lawful basis before processing begins. Future products do not receive permission to collect undisclosed data under this Policy.

12. Contact