1. INTRODUCTION

Aerospect Ltd, trading as CloudChute ("we," "our"), is committed to protecting your privacy. This Privacy Policy explains how we handle your data when you use the CloudChute application. Aerospect Ltd acts as the "Data Controller" for the personal data collected.

2. DATA WE COLLECT

We adhere to a principle of data minimisation.

Data We Collect:

• Account Basics: Name and Email Address.
• License Metadata: Status (Active/Expired) and application version.

Data We Cannot Access: We are architected for privacy ("Zero Knowledge"). We never view, store, or possess:

• The contents of your backup files.
• Your private encryption keys.
• Your full credit card numbers.

3. HOW WE USE YOUR DATA AND LEGAL BASIS

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We rely on the following legal grounds for processing:

• Performance of Contract: To create your account, verify your license, and process billing (via Stripe).
• Legitimate Interests: To improve the Software via version logging and ensure security.
• Legal Obligation: To comply with tax and accounting laws.

Specific uses include:

• Billing (via Stripe): Your Name and Email are used to manage your subscription and send billing receipts.
• Authentication: Your Email is used to verify your license status.
• Storage Provider Integration: CloudChute requires access to your storage provider solely to upload, download, and manage backup files created by CloudChute.

4. CLOUD PROVIDER DATA AND LIMITED USE DISCLOSURE

CloudChute uses official OAuth authentication to connect to your Google, Dropbox, or Box account. We strictly adhere to each provider's security and data policies, including the Google API Services User Data Policy.

• Limited Scope: We only request the minimum permissions necessary to manage your backups. We do not request access to your general files, photos, emails, or existing folders outside of the dedicated CloudChute vault.
• No Human Access: We never read, view, or access your data. All file transfers are handled programmatically by the Software on your Mac. No human intervention is possible.
• No Transfer: Your data is never transferred to us or any third party. It moves directly from your Mac to your own cloud storage account.
• No Advertising: We do not use your data for advertising, profiling, or any purpose other than providing backup services.
• Regulatory Compliance: CloudChute's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. We apply these same rigorous standards to data handled via Dropbox and Box APIs.

5. FINANCIAL DATA (STRIPE)

All financial transactions are handled by Stripe. We do not store financial data on our servers. Stripe processes your payment method securely. Stripe's use of your data is governed by their Privacy Policy.

6. SECURITY AND INTERNATIONAL TRANSFERS

• Transmission: All data transferred between CloudChute, Google Drive, Dropbox, or Box, and our storage provider's infrastructure is protected using TLS/SSL encryption.
• At Rest: If you enable CloudChute's encryption feature, your files are encrypted using industry-standard cryptography (e.g., AES-256) before they leave your device. We do not possess the keys to decrypt this data. Your account metadata (e.g., your name and email) is securely stored via Amazon Web Services (AWS) in the London Region (eu-west-2) and is protected by AWS Server-Side Encryption.
• International Transfers: While your data is stored physically in the UK, our service providers (Google, Dropbox, Box, Stripe, and AWS) are multinational organisations with parent companies based outside the UK/EEA. When limited data (such as billing or account metadata) is processed by these entities, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adherence to the UK-US Data Bridge framework.

7. DATA RETENTION AND DELETION

• Account Data: We retain your billing email as long as you are a customer and for a period required by tax laws thereafter (typically 6 years for transaction records).
• Backup Data: Your backup data resides on your storage provider. If you cancel your subscription or delete CloudChute, your data remains on your storage provider until you manually delete it via your storage provider's settings.

8. YOUR RIGHTS

Under UK data protection law, you have rights including:

• Your right of access: You have the right to ask us for copies of your personal information.
• Your right to rectification: You have the right to ask us to rectify personal information you think is inaccurate.
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.

To exercise these rights, contact us at [Show Email].

9. CONTACT AND COMPLAINTS

If you have questions about this Privacy Policy, please contact us at [Show Email].

If you have concerns about our use of your personal data, you can make a complaint to us at the email above. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk