Privacy Policy

Clouds and Light Limited is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our LightPane cloud infrastructure visibility service.

1. Data Controller

Clouds and Light Limited is the data controller responsible for your personal data. We are a Limited Company registered in the United Kingdom and are registered with the UK Information Commissioner's Office (ICO).

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect and process the following types of personal data when you use our Service:

2.1 Account Information

• Name: Your full name and preferred name
• Email Addresses: Your primary email address (which we verify) and an alternate contact email address if provided
• Password: Your encrypted account password

2.2 Cloud Account Integration Information

• Cloud Account Identifiers: AWS Account IDs, GCP Project IDs, Azure Subscription IDs, and similar identifiers for other supported cloud providers
• Cross-Account Role Configuration: The identifiers for read-only IAM roles (AWS), service accounts (GCP), or service principals (Azure) that you create for our service to access your cloud environment
• Cloud Regions: The cloud regions where you host your services
• Cloud Resource Data: Read-only metadata from cloud services you have linked, including resource configurations, metadata tags, and service details

Important: Our service uses read-only access mechanisms to query your cloud environment. We have no ability to make changes to your cloud environment. We can only read resource details for the purpose of providing cloud infrastructure visibility. Access logs for our service's access to your cloud environment are generated and stored in your own cloud account.

2.3 Usage and Activity Data

• Pages and views accessed
• Access keys created and their usage patterns
• Cloud services discovered and displayed
• Website interaction metrics and usage patterns

2.4 Technical Data

• IP Addresses: Your internet protocol address for security and system administration
• Cookies: Essential session cookies required for website functionality (see Section 8)
• Log Data: Browser type, access times, pages viewed, and other diagnostic data

3. How We Use Your Information

We use your personal data for the following purposes:

3.1 Account Management and Authentication

• Creating and managing your user account
• Authenticating your identity when you log in
• Verifying your email address
• Providing secure access to the platform

3.2 Service Delivery

• Discovering and displaying cloud infrastructure information from your linked cloud accounts
• Managing access keys and their associated constraints
• Rendering cloud data in embedded panes on web pages
• Customising the Service based on your account configuration and preferences

3.3 Communications

• Responding to your support requests and inquiries
• Sending important service announcements or security updates
• Sending product updates and notifications (only if you have opted in to receive them)

3.4 Platform Improvement and Analytics

• Analysing usage patterns to improve our services
• Identifying and fixing technical issues
• Developing new features and functionality
• Ensuring platform security and preventing abuse

3.5 Legal Obligations

• Complying with legal requirements and regulations
• Enforcing our Terms and Conditions
• Protecting our rights and the rights of our users

4. Legal Basis for Processing

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you have registered for
• Consent: Where you have given explicit consent (e.g., opting in to product update emails)
• Legitimate Interests: For platform improvements, security, and analytics, where it does not override your rights
• Legal Obligation: Where required by law

5. Data Sharing and Third Parties

5.1 Cloud Infrastructure Services

We use Amazon Web Services (AWS) infrastructure to host and operate our platform. Your data is stored on AWS servers located in the United Kingdom. AWS provides the underlying infrastructure but does not access or process your personal data except as necessary to provide cloud hosting services.

When you grant us read-only access to your cloud accounts (AWS, GCP, Azure, or other supported providers), we access your cloud environment solely to discover and display infrastructure information. This access is logged in your own cloud account.

5.2 Domain and Website Infrastructure

Our services are provided through the domains cloudsandlight.com, lightpane.cloud, lightpane.io, and their associated subdomains and infrastructure services. Cookies set by our service are limited to these domains.

5.3 Third-Party Analytics and Cookies

We do not currently use third-party analytics services (such as Google Analytics). We do not set third-party cookies beyond those set by our own domains and AWS infrastructure services.

5.4 Payment Processors

Payment processing is being added to the Service. We will update this section once we have integrated a payments provider, including details of what payment data is collected and how it is processed.

5.5 Legal Disclosures

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

6. Data Storage and Retention

6.1 Data Storage Location

All personal data is stored on AWS servers located in the United Kingdom. Your data does not leave the UK unless you explicitly request data export.

6.2 Data Retention

We retain your personal data while your account remains active. This allows us to maintain your account configuration, cloud account links, access keys, and service settings for as long as you use the Service.

You may request deletion of your data at any time by contacting us (see Section 10). Upon deletion request, we will permanently delete your personal data, though we may retain certain information where required by law or for legitimate business purposes (e.g., preventing fraud or abuse).

6.3 Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of passwords and sensitive data
• Secure HTTPS connections for all data transmission
• Access controls and authentication mechanisms
• SHA-256 hashing of access key tokens (raw tokens are never stored)
• Regular security assessments and monitoring
• AWS infrastructure security features and compliance certifications

7. International Data Transfers

Your personal data is stored and processed within the United Kingdom and is not transferred outside the UK. If we need to transfer data internationally in the future, we will implement appropriate safeguards and update this Privacy Policy accordingly.

8. Cookies

We use cookies to provide essential functionality on our website. Cookies are small text files stored on your device that help us recognise you and maintain your session.

8.1 Essential Cookies Only

We only use essential session cookies that are strictly necessary for the website to function. These cookies:

• Maintain your logged-in session
• Remember your preferences during your visit
• Ensure security and prevent fraud

We do not use analytics cookies, advertising cookies, or any other non-essential tracking technologies. The cookies we set are limited to our domains: cloudsandlight.com, lightpane.cloud, and their subdomains.

8.2 Managing Cookies

Because we only use essential cookies required for the website to function, disabling cookies may prevent you from using certain features of the Service, including logging in and accessing your account.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you.

9.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data.

9.3 Right to Erasure (Right to be Forgotten)

You have the right to request that we delete your personal data in certain circumstances.

9.4 Right to Data Portability

You have the right to request that we export your personal data in a structured, commonly used, and machine-readable format.

9.5 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

9.6 Right to Object

You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis.

9.7 Right to Withdraw Consent

Where we process your data based on consent (e.g., marketing emails), you have the right to withdraw your consent at any time.

10. How to Exercise Your Rights

To exercise any of your rights under UK GDPR, please contact us at:

We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.

If you are not satisfied with how we handle your data or respond to your requests, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

ICO Website: https://ico.org.uk/
ICO Helpline: 0303 123 1113

11. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at support@cloudsandlight.com so we can delete the information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Updating the "Last Updated" date at the top of this page
• Posting a notice on our website
• Sending an email notification (if you have opted in to notifications)

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

13. Contact Information

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:

Clouds and Light Limited
United Kingdom
ICO Registration: ZB995225
Email: support@cloudsandlight.com

14. Acceptance of This Policy

By using the Clouds and Light Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal data as described in this Privacy Policy.