How We Use Your Information

1 Information We Collect

To provide reliable hosting, managed databases, Kubernetes clusters, and global CDN services, we collect specific categories of data. We only collect what is necessary to operate, secure, and improve our platform.

2 How We Use Your Information

Your data serves specific, defined purposes aligned with our service delivery, security obligations, and continuous platform improvement:

• Service Provision & Management: Provisioning VPS instances, configuring load balancers, managing database replicas, and routing traffic through our 50+ global data centers.
• Security & Threat Mitigation: Monitoring network traffic for DDoS patterns, validating API access tokens, enforcing firewall rules, and detecting anomalous behavior to protect your infrastructure.
• Billing & Financial Processing: Generating invoices, processing payments, applying tax compliance rules, and managing subscription lifecycle events.
• Technical Support & Troubleshooting: Diagnosing performance issues, analyzing error logs, coordinating incident response, and providing proactive maintenance alerts.
• Platform Optimization: Aggregating anonymized usage metrics to improve load balancing algorithms, expand edge node capacity, and refine auto-scaling thresholds.
• Communication: Sending critical system notices, maintenance windows, security advisories, and responding to support inquiries.

3 Information Sharing & Disclosure

CloudNexus does not sell, rent, or trade your personal information to third parties. We share data only under the following circumstances:

• Trusted Service Providers: We engage vetted partners for email delivery, payment processing, analytics, and backup storage. All processors are bound by strict data processing agreements (DPAs) and undergo regular security audits.
• Legal Compliance: We may disclose information when required by law, subpoena, court order, or government regulation, or to protect the rights, property, and safety of CloudNexus, our customers, and the public.
• Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred as part of the transaction. We will notify customers of any change in ownership or control.
• With Your Consent: Any data sharing outside these parameters will only occur with your explicit, informed consent.

4 Data Security & Infrastructure Protection

We implement industry-leading safeguards to protect your information against unauthorized access, alteration, disclosure, or destruction:

• End-to-end TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest
• Zero-trust network architecture with multi-factor authentication (MFA) enforced across administrative interfaces
• Continuous automated vulnerability scanning, penetration testing, and SOC 2 Type II compliance
• Geographically distributed, redundant storage with automatic failover and immutable backup retention

5 Data Retention & Deletion

We retain your information only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

• Active Account Data: Retained for the duration of your service agreement and 12 months post-termination for billing and dispute resolution.
• Infrastructure Logs: Retained for 90 days by default, extendable to 1 year for enterprise compliance tiers.
• Support Communications: Retained for 24 months after ticket closure.

You may request account deletion at any time via the customer portal. Upon deletion, all personally identifiable information (PII) will be securely erased within 30 days, subject to legal retention requirements.

6 Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access & Portability: Request a copy of your data in a machine-readable format
• Correction: Update or rectify inaccurate information through your account dashboard
• Deletion: Request erasure of your data where no longer legally required
• Restriction/Opposition: Limit processing or object to certain analytical uses
• Withdraw Consent: Opt out of marketing communications or non-essential data processing at any time

To exercise these rights, please contact our Data Protection Officer at dpo@cloudnexus.io. We will respond to valid requests within 30 days.

7 International Data Transfers

CloudNexus operates globally. Your data may be processed in countries outside your region of residence, including the United States, European Union, Singapore, and Brazil. When transferring data across borders, we ensure compliance with GDPR, CCPA, and other applicable frameworks through Standard Contractual Clauses (SCCs), data localization options for enterprise clients, and rigorous third-party compliance certifications.

8 Updates to This Policy

We periodically review and update this policy to reflect changes in technology, service offerings, legal requirements, or business practices. Material changes will be communicated via email, system notifications, or prominent website announcements. Continued use of our services after updates constitutes acceptance of the revised terms.