Privacy Policy
Last updated:
CloudVolution Cía. Ltda. ("we", "us") operates Brandefend, a managed brand-protection and anti-phishing service. This policy explains what personal data we process, why, for how long, who helps us, and the rights you have. It is written for an international audience: depending on where you are, laws such as the GDPR and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and other U.S. state laws, Brazil's LGPD, and Ecuador's Organic Law on Personal Data Protection (LOPDP) may give you additional rights.
1. Who we are
- Controller: CloudVolution Cía. Ltda., La Pradera, Quito, Ecuador.
- Product: Brandefend.
- Privacy contact: [email protected] (subject line "Privacy request").
2. Two roles: controller and processor
We process personal data in two different capacities, and the rules differ:
- As controller, for our own purposes: this website, sales conversations, customer accounts on the portal, security of our systems, billing, and legal compliance. This policy covers that processing.
- As processor (service provider), on behalf of our customers, when we run the service they hired: for example, the in-session detection reports generated on a customer's own login page, or the monitoring of executives a customer has authorized in writing. In these cases the customer is the controller, our data processing agreement (DPA) with that customer governs the processing, and requests should go to the customer first. We will help them answer.
3. What we collect
3.1 When you visit the website
- Technical data: IP address, browser and device information, and request logs, processed by our hosting and content-delivery providers to deliver and protect the site.
- Aggregated analytics: we use a cookieless analytics service that counts page views without identifying or tracking you across sites.
- Analytics with your consent: only if you accept analytics cookies in our cookie banner, Google Analytics (loaded through Google Tag Manager) measures how the website is used: pages visited, approximate location, device and browser, and a pseudonymous identifier. You can withdraw that consent at any time from "Cookie settings" at the bottom of every page (Cookie Policy).
- Language preference: a cookie that remembers the language you chose (see the Cookie Policy).
3.2 When you request a demo or contact us
Your name, work email, company, role, country, and the message you write. A bot-protection check runs on the form.
3.3 When you use the customer portal
Name, work email, role, a hash of your password (never the password itself), your two-factor authentication secret (encrypted), hashes of your recovery codes, language and time-zone preferences, session records (a hash of your IP address and your browser's user agent), sign-in attempts, and an audit log of the actions you take in the portal. If your organization adds you as an alert recipient, we keep that email address for sending alerts and monthly reports.
3.4 When we deliver the service to our customers (as processor)
- In-session detection: the snippet a customer installs on its own login page reports the page address and the referring address when the page loads somewhere unexpected or is reached from an unfamiliar site, together with the browser's user agent and the time. We do not store the visitor's IP address: we keep only a keyed one-way fingerprint of IP and user agent, used to count distinct reporters and to resist forged reports.
- Evidence of fraudulent sites: screenshots, page content, and technical records of sites or profiles that impersonate a customer. These may incidentally contain personal data published by the fraudster or entered by victims; we keep them only as evidence, protect them with a cryptographic hash, and use them only to stop the fraud.
- Digital exposure: findings from public sources about a customer's internet-facing systems and public code or text that mentions it. Secrets, passwords, and personal data found there are masked at ingestion and stored only in masked form.
- Executive protection: names and public profiles of executives the customer has authorized in writing, to detect impersonation. We do not search for private individuals in general.
- Takedown notices: the business contact details of registrars, hosting providers, and platforms we notify about a fraudulent site.
We do not buy personal data, we do not use leaked credential databases that contain passwords in clear text, and we do not use personal data from the service to build marketing profiles.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (where the law requires one) |
|---|---|
| Answering a demo request or inquiry | Steps at your request before a contract; legitimate interest in responding to business inquiries |
| Providing the portal and the service | Performance of our contract with your organization |
| Securing accounts and systems, preventing abuse, keeping audit logs | Legitimate interest in security and integrity; legal obligations |
| Detecting and taking down fraud that targets our customers | Performance of the customer contract; legitimate interest of the customer and of the public in preventing fraud |
| Measuring website use with Google Analytics | Your consent, which you can withdraw at any time |
| Billing, accounting, and tax | Legal obligation; performance of contract |
| Establishing or defending legal claims, preserving evidence | Legitimate interest; legal obligation |
Where processing is necessary to provide a service you or your organization requested, we do not rely on consent. We do not send marketing emails without the consent the law requires.
5. Automated assessment and human review
The service uses automated analysis, including an artificial-intelligence model, to sort candidate threats. No alert, browser-block report, or takedown request is sent without validation by a human analyst. These assessments concern websites, profiles, and apps, not decisions about individuals that produce legal or similarly significant effects.
6. Who we share it with
We share personal data only as needed to run the website and the service:
- Service providers (processors/sub-processors) that host, deliver, secure, or support the service. They include providers for hosting, content delivery and bot protection, email, and, only with your consent, website analytics (Google). We bind them by contract to process data only on our instructions and to protect it. You can ask us for the current list.
- Parties that stop fraud: browser and industry blocklists, registrars, hosting providers, platforms, and national computer emergency response teams receive the address of the fraudulent site and the evidence needed to act on it.
- Authorities, when the law requires it, and professional advisers bound by confidentiality.
- A successor, if our business or this service is transferred, under the same protections.
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
7. International transfers
Brandefend is an international service. Our main infrastructure is hosted in Germany; some providers process data in other countries, including the United States. Where the law requires it, we rely on adequacy decisions, standard contractual clauses, or other recognized safeguards. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
- Demo requests and inquiries: up to 12 months after the last contact, unless they lead to a contract.
- Portal accounts: while the account is active and up to 12 months after it is closed, for security and support.
- Security and audit logs: up to 24 months.
- In-session detection reports: up to 12 months.
- Detections and evidence of fraudulent sites: for the duration of the customer's contract and up to 24 months afterwards, because they may be needed to support legal action.
- Billing records: as long as tax and accounting law requires.
Backups are overwritten on a rolling schedule. We may keep data longer when a dispute, an investigation, or a legal hold requires it.
9. Security
We protect personal data with access controls, mandatory two-factor authentication for the portal, encryption in transit, encryption of sensitive secrets at rest, separation of each customer's data, audit logging, and continuous monitoring. No system is perfectly secure; if we learn of a breach that affects you, we will notify you and the authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- know what personal data we process and get a copy of it;
- correct inaccurate data;
- delete data, when we no longer need it or have no legal reason to keep it;
- object to or restrict certain processing;
- receive your data in a portable format;
- withdraw consent, where processing relies on consent;
- opt out of the sale or sharing of personal information (we do neither);
- not be discriminated against for exercising your rights;
- complain to a data protection authority.
To exercise a right, email [email protected] with the subject "Privacy request". We will confirm your identity before acting and answer within the period the applicable law sets (typically 30 days, extendable where permitted). You may use an authorized agent where the law allows it. If your request concerns data we process for one of our customers, we will forward it to that customer and assist them.
11. Children
The website and the service are for businesses. They are not directed to children, and we do not knowingly collect personal data from children.
12. Region-specific information
- EEA and United Kingdom: you may lodge a complaint with the supervisory authority where you live or work. Where we process your data on the basis of legitimate interest, you may ask us for our balancing assessment.
- California and other U.S. states: in the last 12 months we collected the categories described in section 3 (identifiers, professional information, internet activity, and security records) for the business purposes in section 4. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. We honor Global Privacy Control signals as an opt-out, although we do not sell or share data.
- Brazil (LGPD): you have the rights listed in Article 18 of the LGPD, including confirmation of processing and information about the entities we share data with.
- Ecuador (LOPDP): you may exercise your rights of access, rectification, deletion, objection, portability, and suspension before us, and file a claim with the Superintendencia de Protección de Datos Personales.
13. Changes
When we change this policy, we update the date at the top. If a change is significant, we will tell portal users before it takes effect.
14. Contact
CloudVolution Cía. Ltda., La Pradera, Quito, Ecuador — [email protected]