Data Protection & GDPR at Cloudbase

Cloudbase is a digital logbook and social app for skydivers. We take the privacy of everyone whose data passes through Cloudbase seriously, including people who are not Cloudbase users themselves. This page explains, in plain language, what personal data we handle, the legal bases we rely on, and the rights you have. It sits alongside our full Privacy Policy.

Who we are

Cloudbase is operated by Cloudbase App Ltd, a company registered in England and Wales (company number 17143982). We are the data controller for the personal data described here unless stated otherwise. For any data protection question or request, contact us at hello@getcloudbase.com.

The data we hold, and why

We rely on the following lawful bases under the UK GDPR:

• Account details (name, email, profile) — to provide your account — contract.
• Jump data, GPS tracks, gear and progression — to provide the logbook and the features you use — contract and legitimate interest.
• Social content (posts, reactions, comments) — to provide the social features you choose to use — contract and consent.
• Device and usage analytics — to keep the app reliable and improve it — legitimate interest.
• Marketing emails — only ever with your explicit consent, which you can withdraw at any time — consent.

Instructor and student records

Some Cloudbase users are skydiving instructors. Like every professional logbook, in skydiving, aviation and scuba alike, Cloudbase lets an instructor record the students they have trained, so they can keep accurate training records and invoice correctly.

Where this involves a student who is not a Cloudbase user, we apply extra care:

• The student's name is visible only to the instructor who trained them, in that instructor's own private logbook. It is never shown on the social feed, public profiles, leaderboards, share cards, or any other public page.
• We rely on legitimate interest as the lawful basis: an instructor's need to keep an accurate record of their own professional activity, balanced against the limited and private nature of the data.
• We hold it only for as long as it is needed for that purpose.
• We will remove a student's name on request. If you are a student, or anyone else who is not a Cloudbase user, and you believe we hold information about you, email hello@getcloudbase.com and we will action it.

Where your data is stored

Your core data — your account, jumps, logbook, GPS tracks and uploads — is stored in the European Union: our primary database and cache run in Railway's EU-West region, file storage is in Cloudflare R2 (Western Europe), and our error monitoring (Sentry) is hosted in the EU (Germany). A small number of service providers process limited data elsewhere, including the United States (for example email delivery and subscription billing). Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the UK Extension to the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. The full list of the providers we use is in our Privacy Policy.

How long we keep it

We keep personal data only for as long as needed for the purposes above, or as required by law, after which it is deleted or anonymised.

Your rights

Under the UK GDPR you have the right to access your data, have inaccurate data corrected, have your data erased, restrict or object to processing, data portability, and to withdraw consent at any time. To exercise any of these, email hello@getcloudbase.com and we will respond within one month.

If you have a concern we have not resolved, you can contact the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.

Security

We protect personal data with encryption in transit and at rest, access controls, and regular review of our security practices.

Cloudbase App Ltd · hello@getcloudbase.com