1. INTRODUCTION

Aerospect Ltd, trading as CloudChute ("we," "our"), is committed to protecting your privacy. This Privacy Policy explains how we handle your data when you use the CloudChute application. Aerospect Ltd acts as the "Data Controller" for the personal data collected.

2. DATA WE COLLECT

We adhere to a principle of data minimisation.

Data We Collect:

• Account Basics: Name and Email Address.
• License Metadata: Status (Active/Expired) and application version.

Data We Cannot Access: We are architected for privacy ("Zero Knowledge"). We never view, store, or possess:

• The contents of your backup files.
• Your private encryption keys.
• Your full credit card numbers.

3. HOW WE USE YOUR DATA AND LEGAL BASIS

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We rely on the following legal grounds for processing:

• Performance of Contract: To create your account, verify your license, and process billing (via Stripe).
• Legitimate Interests: To improve the Software via version logging and ensure security.
• Legal Obligation: To comply with tax and accounting laws.

Specific uses include:

• Billing (via Stripe): Your Name and Email are used to manage your subscription and send billing receipts.
• Authentication: Your Email is used to verify your license status.
• Google Drive Integration: CloudChute requires access to your Google Drive solely to upload, download, and manage backup files created by CloudChute.

4. GOOGLE USER DATA & LIMITED USE DISCLOSURE

CloudChute uses Google OAuth to access your Google Drive. In compliance with the Google API Services User Data Policy, we affirm the following:

• Limited Scope: CloudChute only requests access to the specific drive.appdata scope required to store backup files in a dedicated, hidden folder. We do not request access to your general Google Drive files (e.g., your Docs, Photos, or existing folders).
• No Transfer: We do not transfer your data to any third party (except for the direct upload to your own Google Drive account).
• No human access: We do not read or access your Google Drive data. Our systems are designed to process your information programmatically, without human intervention.
• No Advertising: We do not use your Google Drive data for advertising purposes.
• Compliance: CloudChute's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. FINANCIAL DATA (STRIPE)

All financial transactions are handled by Stripe. We do not store financial data on our servers. Stripe processes your payment method securely. Stripe's use of your data is governed by their Privacy Policy.

6. SECURITY AND INTERNATIONAL TRANSFERS

• Transmission: All data transferred between CloudChute, Google Drive, and our infrastructure is protected using TLS/SSL encryption.
• At Rest: If you enable CloudChute's encryption feature, your files are encrypted using industry-standard cryptography (e.g., AES-256) before they leave your device. We do not possess the keys to decrypt this data. Your account metadata (e.g., your name and email) is securely stored via Amazon Web Services (AWS) in the London Region (eu-west-2) and is protected by AWS Server-Side Encryption.
• International Transfers: While your data is stored physically in the UK, our service providers (Google, Stripe, and AWS) are multinational organisations with parent companies based outside the UK/EEA. When limited data (such as billing or account metadata) is processed by these entities, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adherence to the UK-US Data Bridge framework.

7. DATA RETENTION AND DELETION

• Account Data: We retain your billing email as long as you are a customer and for a period required by tax laws thereafter (typically 6 years for transaction records).
• Backup Data: Your backup data resides on your Google Drive. If you cancel your subscription or delete CloudChute, your data remains on Google Drive until you manually delete it via Google Drive settings.

8. YOUR RIGHTS

Under UK data protection law, you have rights including:

• Your right of access: You have the right to ask us for copies of your personal information.
• Your right to rectification: You have the right to ask us to rectify personal information you think is inaccurate.
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.

To exercise these rights, contact us at [Show Email].

9. CONTACT AND COMPLAINTS

If you have questions about this Privacy Policy, please contact us at [Show Email].

If you have concerns about our use of your personal data, you can make a complaint to us at the email above. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk