Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Mostly Cloudy Ltd ("we", "us", "our") collects, uses, and protects personal data when you use our platform at mostlycloudy.co.uk.

1. Who we are (data controller)

Mostly Cloudy Ltd, a company registered in England and Wales (company no. PLACEHOLDER). Registered address: PLACEHOLDER. ICO registration: PLACEHOLDER. For privacy questions, contact privacy@mostlycloudy.co.uk.

2. What we collect

• Account data — name, email, phone, business name, business domain.
• Authentication data — hashed passwords (we never store plaintext), session tokens, password-reset tokens.
• Billing data — handled by Stripe; we store only a Stripe customer ID, last-4 of card, plan, and subscription status. We never see or store full card numbers.
• Operational data — domain registrations, mailbox provisioning records, audit logs of administrative actions, support tickets, and bookings you create on the platform.
• Technical data — IP address, browser user-agent, request timestamps. Used for security and debugging only.

3. Why we use your data (lawful bases)

• Contract — to provide the service you've subscribed to (Article 6(1)(b) UK GDPR).
• Legitimate interests — to keep the service secure, prevent fraud, and improve the product.
• Legal obligation — to retain billing/tax records for 6 years as required by HMRC.
• Consent — only where explicitly given (e.g. marketing emails, optional integrations).

4. Who we share with (sub-processors)

We use the following third-party services to deliver Mostly Cloudy. Each is bound by its own data-processing agreement:

• Stripe Payments Europe Ltd — payment processing.
• Tucows / OpenSRS — domain registration and hosted email.
• DigitalOcean LLC — application hosting and database (EU region).
• Sentry — error monitoring (functional cookies only).

We do not sell your data and we do not share it with advertisers.

5. International transfers

Some sub-processors (Stripe, Sentry, Tucows) are based outside the UK/EEA. Where data is transferred internationally, we rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

6. Retention

We keep account data for the duration of your subscription and for 30 days after cancellation, after which it is permanently deleted. Billing records are retained for 6 years (HMRC requirement). Audit logs are retained for 12 months.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion ("right to erasure") — subject to billing-record retention obligations.
• Restrict or object to processing.
• Data portability — receive your data in a machine-readable format.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these, email privacy@mostlycloudy.co.uk. We respond within 30 days.

8. Cookies

We set one cookie — session — which is strictly necessary to keep you logged in. We do not use marketing or analytics cookies.

9. Security

Passwords are bcrypt-hashed (never stored plaintext). All transport is TLS 1.2+. Database access is restricted to the application and a small number of named engineers. We notify affected users within 72 hours of any confirmed personal-data breach.

10. Changes

We will update this policy as the service evolves. Material changes will be notified by email and announced on this page at least 14 days before they take effect.

Questions? Email privacy@mostlycloudy.co.uk or write to us at the registered address above.