Privacy Policy

Last Updated: October 26, 2026

This Privacy Policy describes how CloudGrid, operated by Atomic Innovation Labs LTD (“we,” “our,” “CloudGrid,” or “us”), collects, uses, and protects information when you use the CloudGrid Platform (“Platform”), our public websites, including cloudgrid.io (the “Website”), and related services (together, the “Services”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information, the rights available to individuals, and how those rights may be exercised. Where applicable law requires consent for a particular processing activity, we will request that consent separately. This Policy applies whether or not you have a CloudGrid account, and it covers visitors who browse our public Website without registering.

PART I: Privacy Policy

1. Information We Collect

1.1 Account and Profile Information

When you register, we collect:

Name and email address
Username, profile settings, and preferences
Authentication credentials (stored in encrypted form)
Billing and payment information (processed by our payment provider)
For organization accounts: the organization's name, registration and tax details, and the name, role, email address, and phone number of its contact person and billing contact

1.2 Builder and Build Data

As a production environment Platform, we process data generated through the builds you create and deploy, including:

Configuration and structure of your AI agents, apps, landing pages, and documents
Inputs submitted to and outputs generated by your builds
Execution logs, performance metrics, and error reports
Data submitted by end users interacting with your deployed builds

1.3 Technical and Usage Data

We automatically collect technical information when you use the Services, including from visitors to our public Website who do not have an account:

IP address and approximate geolocation
Browser type, device type, and operating system
Pages visited, features used, session duration, and clickstream data
Cookies and similar tracking technologies (see Part II of this Policy)
Resource usage measured for each Grid, such as AI token consumption, storage, Runtime Hours, and compute

1.4 Data We Process on Behalf of Customers

When a Builder or organization uses CloudGrid to process personal information through its builds, including apps and agents, the Builder or organization generally determines the purposes and means of that processing and acts as the data controller, or equivalent responsible entity under applicable law (such as the owner of the database under Israeli law).

CloudGrid generally acts as a data processor or service provider in relation to such information and processes it on the customer's documented instructions, subject to applicable law and any applicable Data Processing Addendum.

CloudGrid acts as an independent controller for personal information it processes for its own account administration, billing, security, legal compliance, and other independently determined purposes described in this Policy.

End users who wish to exercise privacy rights concerning a Builder's build should contact that Builder. CloudGrid will provide reasonable assistance to the Builder as required by applicable law.

1.5 Feedback and Research

When you send us feedback, comments, suggestions, or bug reports, or take part in a survey or interview, we collect what you choose to share, together with your contact details. If we record an interview, we will tell you and ask for your consent first.

1.6 Invitations and Mailing List

When you request an invitation through the invite form on our Website, we collect your name, email address, and any other details the form asks for. We use this information to respond to your request and to send you information about your invitation or access to the Services. We send promotional emails, newsletters, and product marketing only where permitted by applicable law, including with your consent where required. You can unsubscribe from marketing emails at any time using the link in those emails or by writing to privacy@cloudgrid.io. Unsubscribing does not stop necessary account, billing, security, or service communications.

1.7 Support Chat

When you use the support chat, we collect your messages and any files or screenshots you share, the AI Helper's replies, the name of any human representative who joins, timestamps, and technical data such as your browser and device type. If you are signed in, the conversation is linked to your account. A human representative who joins can see the whole conversation, including the part with the AI Helper.

1.8 Required and Optional Information

Unless otherwise stated, you are not legally required to provide personal information to CloudGrid. However, certain information, including account registration details, authentication information, and billing information where applicable, is necessary to provide the Services. If you choose not to provide required information, we may be unable to create or maintain your account, process payments, or provide particular features. Information requested for optional surveys, marketing communications, or research activities is voluntary.

2. How We Use Your Information

We use collected information to:

Provide, maintain, and operate the Services
Authenticate accounts and prevent unauthorized access
Process and execute your builds and AI workflows
Send account-related communications and security alerts, and, where you have agreed or the law otherwise allows, product updates and marketing messages
Analyze usage patterns to improve the Platform and develop new features
Detect, investigate, and prevent fraud, abuse, and security incidents
Comply with legal obligations and enforce our Terms of Service
Respond to your support requests and inquiries
Measure resource usage to calculate fees and apply the Fair Usage Allowance described in our Terms of Service
Contact you about your experience, including requests for feedback, surveys, and interviews, which you may decline
Provide support through the support chat, including answers generated by the AI Helper, and, if you are signed in and a conversation ends before your issue is resolved, email you a link to continue it

AI training. CloudGrid does not use your Content, including application code, uploaded files, databases, prompts, and generated outputs, to train AI models or to develop unrelated products without your prior express authorization. CloudGrid may analyze aggregated or de-identified operational information to maintain, secure, and improve the Services, provided that such information does not reveal personal information or confidential customer Content. Where third-party AI providers process your Content, CloudGrid will apply the applicable contractual restrictions concerning retention and model training. Support chat conversations are not used to train AI models.

3. Legal Bases for Processing (GDPR and Israeli Privacy Protection Law)

For users in the European Economic Area (EEA), United Kingdom, and other regions where GDPR applies, we process your personal data under the following legal bases:

Contract: Processing necessary to provide the Services you requested
Legitimate Interests: Improving the Platform, detecting fraud, and securing the Services
Consent: Sending marketing communications and certain optional features (withdrawable at any time)
Legal Obligation: Compliance with applicable laws and regulatory requirements

Where the Israeli Protection of Privacy Law, 5741-1981, as amended, including by Amendment No. 13 (the "PPL"), applies, we collect and process personal information in accordance with the requirements of that law, including its requirements concerning consent, notice, permitted purposes, use of information, and data security. Where consent is legally required, we will obtain it in accordance with applicable law. We do not treat a GDPR legal basis as independently authorizing processing under Israeli law.

4. Sharing of Information

We do not sell your personal data. We may share information in the following circumstances:

4.1 Service Providers

We share data with trusted third-party providers who assist with hosting, infrastructure, analytics, email delivery, payments, and security. These providers are contractually bound to process data only on our behalf and in accordance with applicable data protection law. When you use AI-powered features, relevant inputs, instructions, files, contextual information, and generated outputs may be transmitted to third-party AI model providers as necessary to process your requests. The providers used may depend on the feature, the model selected, and the applicable service configuration, and CloudGrid maintains information about them and their processing arrangements. Where CloudGrid acts as a processor, these disclosures are subject to the applicable Data Processing Addendum and authorized sub-processing arrangements. Any use of information by providers for their own purposes will be disclosed where required by law. Our current analytics providers are Google LLC (Google Analytics), which runs on our public Website, and Mixpanel, Inc. (Mixpanel), which runs on our public Website and in the Services, including the Platform, the command-line tool and the MCP server. Google's handling of this data is governed by Google's Privacy Policy at https://policies.google.com/privacy, and Mixpanel's by Mixpanel's Privacy Policy at https://mixpanel.com/legal/privacy-policy. We send emails through Resend, operated by Plus Five Five, Inc., which processes recipients' email addresses and message content on our behalf. Our support chat is operated by CloudGrid. The AI Helper's replies are generated using Claude, an AI model provided by Anthropic, PBC, which processes support conversations on our behalf. Business customers can request a list of our sub-processors at privacy@cloudgrid.io.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if necessary to protect the rights, property, or safety of us, our users, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify affected users before their data becomes subject to a different privacy policy.

4.4 Organizations

If your account is provided or managed by an organization, such as your employer, that organization owns the Grids created under its organization account and the Content in them. Its administrators can access that Content, manage your access, and keep or reassign your Grids and Content after you leave. The organization's own privacy practices govern how it uses that information.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Services. Build data is retained per your account configuration. You may request deletion at any time (see Section 7). Certain data may be retained longer where required by law or for fraud prevention, dispute resolution, or enforcing our agreements. Where the PPL and its regulations apply, we retain personal information only for as long as necessary for the purposes described in this Policy or as required by Israeli law, and thereafter delete or anonymize it to the extent practicable.

Specific retention periods depend on the purpose of processing, applicable legal requirements, and operational necessity. Account information is generally retained while the account is active and for a limited period afterward where necessary for legal compliance, dispute resolution, or security. Billing and transaction records are retained for the periods required by applicable tax and accounting laws. Operational logs and security records are retained according to documented retention schedules. Content is retained and deleted in accordance with the Terms of Service, your account settings, and any applicable Organization Agreement or Data Processing Addendum. Information held in backups may remain for a limited time after deletion from active systems and is deleted or overwritten according to our backup retention cycles, subject to legal obligations.

If your account is managed by an organization, requests to delete Content in the organization's Grids are handled by that organization. When an Organization Agreement ends, the organization's Content remains available for export for 30 days and is then deleted within a further 30 days, unless the law requires us to keep it longer. During the launch period described in our Launch Offer Terms, Content may be lost or reset because of the early stage of the Services. When the launch period ends, the Content of users who do not choose a paid plan remains available for export for at least 30 days after paid use starts. We keep support chat transcripts for 12 months after the conversation ends, unless we need them longer to resolve a dispute or meet a legal obligation.

6. International Data Transfers

CloudGrid and its authorized service providers may process personal information in Israel, the United States, and other countries where CloudGrid or its providers operate. Where international transfers are subject to the GDPR, the UK GDPR, Israeli privacy law, or other applicable data protection requirements, CloudGrid implements a legally valid transfer mechanism and any required supplementary safeguards. Depending on the circumstances, these may include adequacy decisions, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, the UK International Data Transfer Addendum, or other legally recognized arrangements. Transfers of personal information outside Israel are also made in accordance with the Protection of Privacy (Transfer of Data Abroad) Regulations, 5761-2001. Information about the safeguards that apply to a particular transfer may be requested at privacy@cloudgrid.io.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate or incomplete data
Erasure: Request deletion of your personal data
Portability: Receive your data in a structured, machine-readable format
Restriction: Request that we limit how we process your data
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent for consent-based processing at any time

To exercise any of these rights, contact us at privacy@cloudgrid.io and we will respond within the timeframe required by applicable law (typically 30 days).

We may request information reasonably necessary to verify your identity and authority before fulfilling a privacy rights request, and will not request more than is reasonably necessary for that purpose. Where CloudGrid processes information solely on behalf of a customer, we may refer the request to that customer or assist the customer in responding. We may deny or limit a request where permitted or required by applicable law and will explain the reason where legally required. Where applicable law provides a right to appeal our decision or to complain to a supervisory authority, we will tell you how to do so.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights:

Right to know what personal information we collect, use, disclose, or share
Right to delete your personal information, subject to certain exceptions
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information (we do not sell personal information)
Right to limit use of sensitive personal information
Right to non-discrimination for exercising your privacy rights

To submit a verifiable consumer request, contact us at privacy@cloudgrid.io.

9. Israeli Privacy Rights (Protection of Privacy Law)

If you are located in Israel, or if we otherwise process personal information about you as the owner of a database subject to the PPL, the following applies in addition to the rights described elsewhere in this Policy. For the purposes of the PPL, CloudGrid acts as the owner of the database with respect to personal information it processes for its own purposes, and may act as a holder of a database on behalf of its customers where it processes personal information under their instructions.

Subject to the PPL, you may: (i) review the personal information we hold about you; (ii) request that we correct, complete, clarify, or delete personal information that is incorrect, incomplete, unclear, or out of date; and (iii) where we use your personal information for direct mailing or a direct-mailing service as defined in the PPL, request that your information be removed from the databases used for that purpose.

We transfer personal information outside Israel only in accordance with the PPL and the regulations governing the transfer of data abroad, and we maintain the data-security measures required under the PPL and its regulations. Where the PPL requires it, we will appoint a privacy officer. Additional rights may apply to personal information that originates from the European Economic Area and is held in our databases in Israel.

To exercise these rights, contact us at privacy@cloudgrid.io. If you believe we have processed your personal information in violation of the PPL, you may also lodge a complaint with the Israeli Privacy Protection Authority (PPA).

10. Children’s Privacy

The Services are intended for users who meet the minimum age requirements set out in our Terms of Service: at least sixteen (16) years old in the European Economic Area (EEA), and at least thirteen (13) years old elsewhere, or older where local law requires. We do not knowingly collect personal information from anyone below the applicable minimum age. If we become aware of such a collection, we will promptly delete it. Contact us at privacy@cloudgrid.io if you believe we have collected data from someone below the applicable minimum age.

The minimum age requirements for CloudGrid account holders do not determine the eligibility of end users of builds operated independently by Builders. Builders whose builds are directed to children, or who knowingly process children's personal information, are responsible for complying with applicable children's privacy and protection laws, including obtaining parental or guardian consent where required. CloudGrid may restrict or prohibit processing involving children where necessary to comply with applicable law or its policies.

11. Security

We implement industry-standard measures to protect your data, including TLS encryption in transit, encrypted credential storage, role-based access controls, and regular security assessments. No method of transmission or storage is 100% secure; we cannot guarantee absolute security. We maintain administrative, technical, and organizational security measures consistent with the Protection of Privacy (Data Security) Regulations, 5777-2017. We maintain procedures designed to identify, investigate, contain, and remediate security incidents affecting personal information. Where CloudGrid acts as a processor, it will notify the relevant customer of a confirmed personal data breach without undue delay after becoming aware of it, in accordance with the applicable Data Processing Addendum, and will provide reasonably available information to help the customer assess the incident and meet its own notification obligations. Where CloudGrid acts as a controller, it will notify affected individuals and competent authorities, including the Israeli Privacy Protection Authority (PPA), where required by applicable law. To investigate bugs and support requests, authorized CloudGrid personnel may access the relevant Content, configuration, and logs, subject to confidentiality obligations and access controls.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our Services, data processing activities, legal requirements, or business operations. We will make the revised Policy available with an updated "Last Updated" date and provide additional notice of material changes, such as by email, where appropriate or legally required. Where our agreement with an organization provides for advance notice of changes to this Policy, we will give that notice. Where a change requires new or additional consent under applicable law, we will obtain that consent before undertaking the relevant processing activity.

13. Contact and Data Controller

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

Address:

CloudGrid operated by Atomic Innovation Labs LTD.

45 Moshe Vilensky Street

Tel-Aviv

Israel

Email: privacy@cloudgrid.io

Website: https://cloudgrid.io

If you are in the EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority. For the purposes of the PPL, Atomic Innovation Labs LTD is the owner of the database with respect to the personal information described in this Policy. You may contact us at privacy@cloudgrid.io.

PART II: Cookie Policy

This section explains how we use cookies and similar tracking technologies when you visit or use the Services.

14. What Are Cookies?

Cookies are small text files placed on your device when you visit a website or use an application. They allow the Platform to recognize your device on subsequent visits and remember your preferences and activity. We also use similar technologies such as web beacons, pixels, local storage, and session storage, referred to collectively as “cookies” throughout this section. Our emails may contain small tracking images (pixels) and tracked links that tell us whether an email was opened and which links were clicked. You can block tracking images by turning off automatic image loading in your email client.

15. Types of Cookies We Use

15.1 Strictly Necessary Cookies

Essential for the Services to function. These cannot be disabled and include cookies that:

Authenticate your session and keep you logged in
Maintain security and prevent fraud
Remember your cookie consent preferences
Record your analytics choice, yes or no, on cloudgrid.io and its subdomains for 13 months (the "CloudGrid analytics consent" cookie), so we ask you once and not on every site
Enable core Platform features such as build execution and Grid management
Keep your support chat conversation open as you move between pages

Legal basis: No consent required: these are strictly necessary to provide the Services you requested.

15.2 Performance and Analytics Cookies

Help us understand how users interact with the Services. They collect:

Pages visited and features used
Time spent on different parts of the Platform
Error messages and technical performance data
General usage patterns and trends

We use Google Analytics 4, provided by Google LLC, on our public Website. Google Analytics sets two cookies, which by default remain on your device for up to 2 years. It records the page path you visit, the referring page, your browser and device type, your approximate location, and a randomly generated visitor identifier stored in the cookie. Google does not store your full IP address; IP anonymization is applied by default and cannot be disabled. Data collected by Google Analytics is transferred to Google in the United States (see Section 6). Google Analytics runs on our public Website only and does not run on internal preview environments. For more information, see Google’s Privacy Policy at https://policies.google.com/privacy.

We also use Mixpanel, provided by Mixpanel, Inc., as our product analytics processor. It runs on our public Website and in the Services, including the Platform, the command-line tool and the MCP server. Mixpanel records the pages and features you use and the actions you take (for example signing up, creating a Grid or plugging in an app), your browser and device type, your approximate location (city and country, from your IP address), and a randomly generated identifier. If you are signed in, this is linked to your account identifier. We do not send Mixpanel the contents of your apps, your files, your secrets, or what you type into forms. On our Website, Mixpanel records a share of visits to draw heatmaps, with everything you type hidden. In the Platform, screen recordings hide all text and inputs and never run on secrets, configuration, vault or administration pages. Mixpanel sets a cookie that remains on your device for up to 1 year. Mixpanel processes this data on our behalf under a data processing agreement, and the data is transferred to the United States (see Section 6).

Legal basis and your choice: In the EEA, the United Kingdom and Switzerland, and wherever we cannot tell which country you are in, we ask for your consent before any analytics runs, and nothing is recorded until you say yes. We ask once: your answer is kept on your account and in the cookie above, and applies on our Website, in the Platform, and in the command-line tool and MCP server. Everywhere else, where applicable law allows, we use analytics on the basis of our legitimate interest in understanding and improving the Services, and you can opt out at any time (see Section 17). Google Analytics on our Website follows the same choice.

15.3 Functional Cookies

Enable enhanced functionality and personalization, including:

Language and display settings
Dashboard layout and configuration choices
Notification preferences

Legal basis: Consent or legitimate interests, depending on the nature of the functionality.

15.4 Third-Party Cookies

Some Services features may use cookies set by third-party providers such as Google Analytics (Google LLC) and Mixpanel (Mixpanel, Inc.). We do not control these cookies and recommend reviewing the relevant third parties’ privacy policies. For Google Analytics, see Google’s Privacy Policy at https://policies.google.com/privacy. For Mixpanel, see Mixpanel's Privacy Policy at https://mixpanel.com/legal/privacy-policy.

16. Cookie Duration

Cookies are either session cookies (expire when you close your browser) or persistent cookies (remain on your device for a set period). Strictly necessary cookies typically last for the duration of your session. Analytics cookies, including the Google Analytics and Mixpanel cookies, may persist for up to 2 years and up to 1 year, respectively.

CloudGrid maintains information about the cookies and similar technologies used in the Services, including their provider, purpose, category, and retention period. The technologies used may vary depending on the part of the Services, account configuration, and features accessed. Where required by applicable law, you will be given sufficient information to make an informed choice before non-essential technologies are activated.

17. Managing Your Cookie Preferences

17.1 Cookie Consent

In the EEA, the United Kingdom and Switzerland, we ask whether you agree to analytics cookies the first time you visit our Website or sign in to the Platform, whichever comes first. If you have answered in one place, we do not ask again in the other. Elsewhere we do not ask: analytics runs unless you opt out. When the analytics setting is on, you consent to the use of non-essential cookies for the purposes described in this Cookie Policy. When it is off, non-essential cookies, including the analytics cookies used by Google Analytics and Mixpanel, are disabled. Where consent is required by applicable law, non-essential cookies remain disabled until you actively turn them on. Strictly necessary cookies remain active regardless of your choice, because they are required for the operation, security, and essential functionality of the Services. You can change your preference at any time through the cookie settings link on our Website.

17.2 Browser Settings

Most browsers allow you to view, delete, and block cookies through their settings. Disabling cookies may affect the functionality of the Services.

17.3 Opt-Out Tools

To opt out of Google Analytics specifically, you can install the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout. In the EEA and the UK, the primary way to prevent non-essential analytics cookies is to decline them when a cookie consent banner is presented. The Network Advertising Initiative (NAI) and Digital Advertising Alliance (DAA) opt-out tools apply to advertising cookies and do not control Google Analytics measurement. To opt out of Mixpanel, wherever you are: turn off Analytics in your profile settings in the Platform, which applies to your account on every device; choose Reject through the cookie settings link on our Website; or turn on Global Privacy Control in your browser.

17.4 Do Not Track

Some browsers send privacy preference signals, such as Do Not Track ("DNT") and Global Privacy Control ("GPC"). CloudGrid does not currently respond to DNT signals. We treat GPC as a request to opt out of analytics: when your browser sends it, we do not run analytics in your browser, and if you are signed in and have not made a choice, we record your account as opted out. You can also manage non-essential cookies through the cookie settings link on our Website.

18. Cookies in Builder Deployments

If you are a Builder deploying builds on the Platform:

Your deployed builds may independently set or use cookies on your end users’ devices
You are solely responsible for ensuring your builds’ cookie use complies with applicable laws, including obtaining necessary consents from your end users
You must provide your end users with clear information about any cookies your builds use
We are not responsible for the cookie practices of your builds

19. Cookie Policy Contact

For any questions or queries about our cookies policy, please do not hesitate to contact us via our support system https://cloudgrid.io, or via Email: privacy@cloudgrid.io