Privacy Policy

Effective 15 October 2026

This policy explains how OnCloud ("OnCloud", "we", "us") collects, uses and protects personal data when you use the OnCloud platform at app.oncloud.om, its APIs, its plugins (such as the OnCloud WordPress plugin) and this website (together, the "Service").

1. Our role and yours
2. What we collect
3. How we use it
4. AI features
5. Who we share it with
6. Where data is stored
7. How long we keep it
8. Security
9. Your rights
10. Cookies and local storage
11. Children
12. Changes and contact

1. Our role and yours

• Workspace data. A business or organisation that opens an OnCloud workspace ("Customer") decides what data goes into it: contacts, products, files, messages, calendar items and the like. For that data the Customer is the controller and OnCloud processes it on the Customer's instructions. If you are a contact or member of a Customer's workspace, please direct requests about that data to the Customer first.
• Account and platform data. For your OnCloud account, billing, security logs and this website, OnCloud is the controller.

2. What we collect

• Account data: name, email address, password (stored only as a one-way hash), language and theme choices, two-factor settings, and the workspaces and roles you belong to.
• Sign-in with Google or Microsoft: if you choose it, we receive your name, email address and an account identifier from that provider. We do not receive your password, and we do not read your mailbox, files or calendar through sign-in.
• Workspace content: whatever you and your team add to the Service.
• Connected services: when a workspace connects a plugin (for example a WordPress site or an AI provider key), we store the connection settings and secrets in encrypted form, and exchange the data the plugin needs (for example products, stock and site settings).
• Billing data: plan, add-ons, AI credit purchases, invoices and payment status. Card details are handled by our payment processor; we do not store full card numbers.
• Usage and security data: IP address, device and browser type, sign-in times, actions recorded in the audit trail, and error logs.
• Communications: messages you send us and support requests.

3. How we use it

• to provide, secure and support the Service, including sign-in, permissions and audit trails;
• to run the features a workspace turns on, such as syncing a store, sending notifications or answering AI requests;
• to bill for plans, add-ons and AI credits;
• to detect, prevent and investigate abuse, fraud and security incidents;
• to send service messages (for example invitations, verification codes and important changes). We send marketing messages only where you have agreed, and you can opt out at any time;
• to comply with the law.

We do not sell personal data, and we do not use workspace content to train AI models.

4. AI features

• When a member uses an AI feature, the request and the workspace content needed to answer it are sent to the AI provider the workspace uses. Depending on the workspace's choice this is OnCloud AI (through providers such as Anthropic and Google), the workspace's own provider key ("bring your own key"), or a local model run by OnCloud for that workspace.
• We use providers under commercial terms that do not allow them to train their models on this data.
• The assistant can only read what the member using it is allowed to see, and it proposes changes for a person to approve; it does not act on its own.
• We keep AI conversations and usage records in the workspace so members can see them and so credits can be measured.

5. Who we share it with

• Service providers that help us run the Service, under contracts that limit their use of the data: cloud hosting and databases, email delivery, payment processing, AI providers (for AI features) and error monitoring.
• Services a workspace connects, such as its WordPress store or its Google or Microsoft account, only as the workspace configures.
• Within a workspace, according to the roles and permissions its administrators set.
• Legal reasons: when required by law or a valid order from a competent authority, or to protect the rights and safety of users and OnCloud.
• Business transfers: if OnCloud is reorganised or acquired, under the same protections as this policy.

6. Where data is stored

The Service is hosted on cloud infrastructure, currently in Singapore. Using the Service may therefore involve transferring personal data outside the Sultanate of Oman. We apply safeguards to those transfers as required by applicable law, including Oman's Personal Data Protection Law (Royal Decree 6/2022). Customers with specific residency needs can contact us.

7. How long we keep it

• Workspace content is kept while the workspace is active. Deleted items stay in the workspace's trash for a limited period before permanent deletion. After a workspace is closed, its data is deleted after a grace period, unless the law requires us to keep it.
• Account data is kept while your account exists, and security and billing records for as long as the law requires.

8. Security

We use encryption in transit, encrypted storage for secrets, hashed passwords, optional two-factor authentication, role-based permissions, separation between workspaces, and audit trails. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

9. Your rights

Subject to applicable law, you may ask to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent you have given. Many of these you can do yourself in your account settings. For workspace data, contact the workspace's administrator; we will help them respond. To make a request to us, email [email protected]. You may also complain to the competent data protection authority in Oman.

10. Cookies and local storage

We use only what the Service needs to work: keeping you signed in, remembering your language and theme, and protecting against forgery. We do not use advertising cookies. This website does not use tracking cookies.

11. Children

The Service is for businesses and is not directed at children under 18. We do not knowingly collect their personal data.

12. Changes and contact

We will post changes to this policy on this page and update the date above. For significant changes we will also notify workspace administrators.

Contact: [email protected] · OnCloud, Muscat, Sultanate of Oman.