Privacy Policy

The data controller is ONCLOUD CONSULTING (SCOTLAND) LTD, registered at 8/22 Portland Gardens, Edinburgh, Scotland, EH6 6NJ, United Kingdom. For any privacy question or request, contact support@oncconsco.shop or call +44 7715860428.

• Account data: name, email address and authentication identifiers.
• Subscription and billing data: plan, billing cycle, currency, and payment status. Card details are entered on our payment provider's hosted checkout — we never receive or store full card numbers.
• Tool inputs: the plain-English idea, product answers and any sketches or reference files you upload to generate a blueprint.
• Generated outputs: the architecture diagrams, data models, cost tiers, roadmaps and Blueprint Packs produced for you.
• Support and contact data: messages, topic and email you send via our forms.
• Technical data: IP address, device and browser type, and essential logs needed to run and secure the service.

• Directly from you when you register, subscribe, use the workspace, upload files, or contact us.
• Automatically from your device when you use the site (essential cookies and server logs).
• From our processors — our payment provider confirms payment status; our hosting and email providers process requests and messages on our behalf.

• To provide the service — generate blueprints, exports and walkthroughs (performance of a contract).
• To take payment and manage subscriptions (performance of a contract).
• To provide support and respond to your messages (legitimate interests / contract).
• To secure the service and prevent abuse (legitimate interests).
• To meet legal, tax and accounting obligations (legal obligation).
• To send essential service emails such as receipts and account notices (contract). We do not send marketing without a lawful basis and, where required, your consent.

Your user input, uploaded sketches and generated outputs are processed only to run the blueprint workflow you requested and to make your results available to you. We do not use your inputs, uploads or generated outputs to train AI models. AI generation may be carried out by a third-party AI provider acting as our processor and following our instructions; only the content needed to produce your result is sent, and it is not used to train that provider's models under our configuration.

By default, uploaded reference material and requirement text are cleared from active processing caches 30 days after generation. You can request earlier deletion at any time.

Payments are processed by our third-party payment provider through its own hosted checkout. Full card numbers, CVC and similar sensitive payment credentials are handled by the provider and are never transmitted to or stored on our servers. We receive only limited confirmation data such as payment status, the last four digits, and the subscription reference.

We share personal data only with processors that help us run the service, under contract and only as needed:

• Hosting and infrastructure provider — to run the website and store data.
• Payment provider — to take payment and manage subscriptions.
• Email provider — to deliver receipts, account and support emails.
• AI processing provider — to generate blueprint outputs from your brief.
• Professional advisers and authorities — only where legally required.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

Some processors may be located outside the UK or EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or transfers to jurisdictions recognised as providing adequate protection.

• Account data: for the life of your account and a reasonable period afterwards.
• Billing and tax records: retained as required by law (typically up to 6–7 years).
• Tool inputs and uploads: cleared from active processing caches by default 30 days after generation, unless you save results to your account.
• Support messages: kept only as long as needed to resolve and evidence the matter.

We use encryption in transit, access controls, and server-side handling of secrets. Payment keys and secrets are stored in environment configuration, never in the client. No system is perfectly secure, but we take reasonable measures appropriate to the risk.

• Access a copy of your personal data.
• Rectify inaccurate data.
• Erase data ('right to be forgotten') where applicable.
• Restrict or object to certain processing.
• Data portability for data you provided.
• Withdraw consent where processing is based on consent.

To exercise any right, email support@oncconsco.shop. We respond within one month.

If you are a California resident, you may request to know, access and delete personal information, and to correct inaccurate information. You also have the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA. We will not discriminate against you for exercising your rights.

We do not sell your personal data and do not share it for cross-context behavioural advertising. If this ever changes, we will update this policy and provide a clear opt-out mechanism.

We use only essential cookies required to run the site and keep you signed in. See our Cookie Policy for details. We do not run advertising trackers.

Blueprints are generated automatically from your inputs, but they are informational planning aids and do not produce legal or similarly significant decisions about you. Cloudraft is not intended for children: it must not be used by anyone under 13, and users aged 13–17 require verifiable parental or guardian consent.

Contact us first at support@oncconsco.shopand we will try to resolve your concern. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner's Office (ICO). Governing law for this policy is England and Wales.