Privacy Policy

This Privacy Policy explains how Spooled Cloud ("we", "our", or "us") collects, uses, stores, and protects your information when you use our job queue and background job services (the "Service"). We are committed to protecting your privacy and handling your data responsibly.

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address: For account authentication, notifications, and support
• Organization name: Optional, for team accounts
• Password: Hashed using bcrypt—we never store plain text passwords

Billing Information

For paid subscriptions, we collect:

• Payment method: Processed and stored by Stripe, our payment provider
• Billing address: Required for invoicing and tax compliance
• Transaction history: Records of payments for your account

Note: We never have access to your full credit card number. Stripe handles all payment processing in compliance with PCI-DSS.

Job Data

When you use the Service to process jobs, we store:

• Job payloads: The data you submit for processing
• Webhook data: Data received from third-party webhook sources
• Job metadata: Status, timestamps, retry counts, queue names
• Idempotency keys: Used to prevent duplicate processing

Job payloads are stored in PostgreSQL on infrastructure we operate and are automatically deleted according to your plan's retention policy.

Usage Data

We automatically collect:

• API access logs: IP addresses, endpoints called, response codes, timestamps
• Error logs: For debugging and service improvement
• Performance metrics: Latency, throughput, and resource utilization
• Dashboard usage: Page views, feature usage (aggregated)

Device Information

When you access the dashboard, we collect:

• Browser type and version
• Operating system
• Screen resolution (for UI optimization)
• Timezone (for displaying timestamps correctly)

2. How We Use Information

We use the information we collect to:

• Provide the Service: Process jobs, manage queues, deliver webhooks, and provide real-time updates
• Authenticate users: Verify identity and protect accounts
• Process payments: Manage subscriptions and billing
• Maintain security: Detect and prevent fraud, abuse, and security threats
• Improve the Service: Analyze usage patterns to enhance performance and features
• Communicate: Send service announcements, security alerts, and respond to support requests
• Comply with law: Meet legal obligations and respond to lawful requests

3. Data Sharing

We do not sell your personal information. We share data only in these circumstances:

Service Providers

We work with trusted third parties who help us operate the Service:

• Cloudflare: Network, TLS, DDoS protection, and CDN; also hosts our website
• Stripe: Payment processing for paid plans
• Email provider: Delivery of account and service emails

These providers are contractually bound to protect your data and use it only for the services they provide to us.

Legal Requirements

We may disclose information when required by:

• Valid court orders or subpoenas
• Law enforcement requests (with proper legal process)
• Government regulatory requirements

We will notify you of such requests unless legally prohibited from doing so.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and provide options before your data is transferred to a new entity.

4. Data Retention

We retain data according to the following schedule:

You can request earlier deletion of your data by contacting us at privacy@spooled.cloud.

5. Data Security

We implement industry-standard security measures:

• Encryption in transit: TLS 1.3 for all API traffic (REST, gRPC, WebSocket), terminated at the Cloudflare edge
• Access controls: organization-scoped API keys with optional per-queue least-privilege scoping
• Key management: API keys hashed before storage
• Data isolation: every query scoped to your organization
• Reviews: Dependency scanning and periodic security reviews
• Monitoring: Operational monitoring and alerting

For more details, see our Security page.

6. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Export: Receive your data in a portable format (JSON)
• Objection: Object to certain processing activities
• Restriction: Request limitation of processing in certain circumstances
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at privacy@spooled.cloud. We will respond within 30 days.

7. Cookies and Tracking

We use two categories of cookies and similar technologies:

• Essential cookies: Authentication (keeping you logged into the dashboard), session state, and security (CSRF protection, fraud prevention). These are strictly necessary for the Service to function and cannot be disabled.
• Analytics cookies (optional, consent-based): Google Analytics 4 and Meta Pixel on this marketing website. These load only after you choose "Accept all" in the consent prompt. If you choose "Essential only", no analytics or marketing tags load, and no tracking cookies are set. You can clear your browser's site data at any time to be asked again.

We do not sell personal information and we do not use analytics inside the authenticated dashboard beyond aggregated feature-usage metrics described above.

8. Sub-processors and Data Transfers

We operate our own application, database (PostgreSQL), and queue (Redis) infrastructure — we do not use a managed cloud database provider. A small number of third-party sub-processors help us run the service, and your data may be processed in the regions where they operate:

• Cloudflare — network, TLS, DDoS protection, CDN, and website hosting
• Stripe — payment processing for paid plans (billing data)
• Our email provider — transactional email (your email address)

9. GDPR Compliance (For EU Users)

For users in the European Economic Area:

• Legal bases: We process data based on contract performance, legitimate interests, and consent
• Data controller: Spooled Cloud is the data controller for account data
• Data processor: We act as a data processor for job payloads you submit
• Contact: For GDPR requests, email privacy@spooled.cloud
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority

10. CCPA Compliance (For California Users)

For California residents:

• Right to know: You can request what personal information we collect and how we use it
• Right to delete: You can request deletion of your personal information
• Right to opt-out: We do not sell personal information
• Non-discrimination: We will not discriminate against you for exercising your rights

11. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us at privacy@spooled.cloud.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via:

• Email to your registered address
• Notice in the dashboard
• Update to the "Last updated" date

Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy and security-related inquiries:

Email: privacy@spooled.cloud

We aim to respond to all privacy inquiries within 30 days.