CLOUD-VISION LLC · VERSION 2026-10-12

Privacy Policy

Effective 12 October 2026. Cloud-Vision LLC operates Vision Preview. This notice explains how information is handled when you visit, register, submit email tests or review shared proofs. Contact info@cloud-vision.com with privacy questions or requests.

1. Our role and your organisation's role

We determine how to process account, billing, security and service-administration information. Your organisation generally determines the purpose and lawful basis of personal data in the emails and comments it submits; we process that content to provide the requested testing service. Organisation admins manage members and access. If you use an employer's organisation, direct requests about its content to that organisation as well as contacting us. If your processing requires a data-processing agreement or particular international-transfer safeguards, contact us before submitting that data; this notice is not a substitute for a signed agreement.

2. Information we handle

• Accounts and access: name, email, password hash, verification information, memberships, roles, invitations, session/security metadata and your recorded acceptance time and policy version.
• Email tests and editing: submitted HTML, MIME content, headers, sender and recipient information, subject, attachments and linked resources where present; drafts, chosen clients, screenshots, check findings and job timestamps; optional AI QA findings and run metadata; and live-test recipient, HTML, subject and delivery status.
• Collaboration: names, comments, mentions, public-link tokens, version approvals and associated times. A guest's entered name is not verified.
• Billing and usage: organisation contact, plan, render and AI QA usage, subscription identifiers, status, period dates, invoice-related records, support requests and administrative changes. Stripe processes payment information; our application is not intended to store full card numbers or security codes.
• Technical information: request and error logs, IP/network information, device/browser details provided by requests, delivery and capture timing, and anti-abuse information needed to operate and secure the service.

3. Why we use it

We use information to authenticate users; receive and render tests; store and display results; run requested checks, including optional AI Visual QA; send requested Builder live tests to your verified account email; deliver mentions, verification, billing and service notices; enforce shared limits; support customers; investigate failures and abuse; maintain security; and meet accounting or legal obligations. Where applicable, these purposes rely on performance of our contract, legitimate interests in operating a safe service, compliance with law, or consent for activities that require it. Legitimate interests are subject to applicable rights and balancing requirements.

We do not sell test content or use it for targeted advertising. Registration acknowledgement of this policy is not consent to unrelated marketing. You may opt out of marketing communications where offered; essential account, payment and security notices may still be necessary to provide the service.

4. Rendering, external resources and service providers

Providing real-client previews means delivering or opening test content in supported mail environments, including Google/Gmail, Microsoft/Outlook and Apple Mail, on our rendering infrastructure. Providers supporting operation include Heroku and Microsoft Azure for infrastructure, Cloudflare for inbound routing, Bunny for image storage/delivery, Stripe for billing, and configured email delivery providers such as Brevo or SendGrid. Provider involvement varies with the feature and client selected. Authorised staff and contractors may access relevant information for support, maintenance or security.

Optional AI Visual QA. When an authorised organisation member manually starts AI Visual QA for a captured version, we send that version's rendered email screenshots, email-client and appearance labels, and review instructions to OpenAI through its API. Screenshots may contain readable text, images, personal information or confidential material from the email. The AI request does not separately include the source HTML, attachments, account details or comments, but any of that information visible in the screenshots is included. Opening a proof, running ordinary Pre-Checks or viewing a public link does not itself start AI QA. We store the resulting findings and operational metadata to display the review and manage usage. The findings are advisory and may miss or misidentify issues; a person remains responsible for the final review.

Builder live tests. If you select Send Live Test, we send the current editor HTML, including unsaved changes, with the selected version's subject through our configured email delivery provider to your verified account email. That provider and your receiving mailbox provider process the message. This action does not save the editor buffer as a draft or create a captured version.

Rendering emails, loading remote images, or checking public links and sender DNS records can contact servers operated by you or third parties. Those servers can observe requests, including their timing and network address, and may contain tracking mechanisms. Builder images are initially blocked until enabled, but that protection is not a promise that native email clients never load remote content. Do not submit single-use action links or tracking-sensitive content unless you accept the effects of testing.

We may disclose information when lawfully required, to protect rights and safety, or in connection with a business transfer with appropriate protections and notice where required. We do not claim that all providers or data remain in a single country. Data may be processed in the United States and other countries used by our providers and operations. Where applicable law requires specific transfer safeguards, those safeguards must be arranged for the relevant processing.

5. Public links, screenshots and comments

Creating a public review link allows anyone who obtains it to access the shared preview, checks (including completed AI QA findings), names, comments and approval information available on that page without signing in. Mentions notify organisation members by email and include the comment and preview link. Public reviewers may see member display names for tagging, not their private email addresses through that selector. AI QA findings may describe visible email content. Shared comments and AI QA findings are not private team notes.

CDN image URLs may be accessible without login. Removing a hosted page does not recall emailed, downloaded, cached or forwarded copies and may not invalidate direct image URLs. Ask support about content removal from hosted storage. Share only material appropriate for these access characteristics.

6. Storage and retention

Retention depends on purpose and location. The application's source cache for adding clients is limited to up to 30 days and the organisation's storage allowance, so source can be evicted earlier. Expiry there is not a promise that every copy has simultaneously disappeared from rendering mailboxes, devices, provider logs or backups. Sender-check temporary material has separate cleanup rules. Saved screenshots, drafts, completed AI QA findings, comments and approvals may remain available after the source cache expires.

For AI QA, our processing reads the existing screenshots temporarily without saving an additional copy of their image bytes in the AI work record. The original screenshots remain subject to the storage rules above. We ask OpenAI not to store a retrievable API response by using its store:false option. This is not a guarantee of zero provider retention: abuse-monitoring logs, safety review, model-specific processing and applicable account settings may still involve retention, as described in OpenAI's API data controls. We do not promise that deleting a proof immediately erases provider-held copies.

Our live-test send record clears its stored subject and HTML when the send is recorded as sent, failed or cancelled. Delivery and anti-abuse metadata remain for 30 days after the terminal record was last updated, then become eligible for periodic cleanup. This does not erase the delivered message from your mailbox or copies retained by email providers.

We retain account, operational, usage, consent and billing records as needed to provide the service, handle disputes, prevent abuse and comply with legal obligations. Deleting a test does not automatically erase its render or AI QA accounting entry. Subscription cancellation or downgrade to Free does not itself delete your account or content. Contact us for account or content deletion; we will identify information that must be retained and applicable exceptions. Backup and provider-held copies may require additional deletion time. Keep your own copies of essential work; Vision Preview is not an archive.

7. Security and your responsibilities

We use access controls, authentication, password hashing and other technical safeguards, but no online service can guarantee absolute security. Keep credentials and bearer tokens private, restrict organisation membership, rotate compromised folder tokens and report suspected incidents promptly. Do not submit sensitive personal information, live secrets or regulated data without an expressly agreed arrangement. We will respond to incidents and provide notices required by applicable law; the limitation provisions in our Terms do not remove mandatory privacy duties.

8. Browser storage

The application uses browser storage for session tokens, selected organisation, preferences and interface state. Before a Builder live-test request, tab-scoped session storage temporarily holds the request identifier and exact HTML snapshot so an interrupted request can be recovered without starting another send. The application clears this recovery copy after a definitive response or recovery of the active server request; an ambiguous network outcome may leave it available across a reload in that browser session. Infrastructure and payment providers may use cookies or similar technologies for security and their services. Blocking essential storage can prevent sign-in or break functionality. This policy does not treat continued browsing as consent to non-essential tracking; if additional tracking requires consent, it must be disclosed and controlled separately.

9. Your choices and rights

Depending on where you live and which law applies, you may request access, correction, deletion, portability or a copy of your information; restrict or object to certain processing; withdraw consent where processing relies on it; or appeal a denied request. Withdrawing consent does not undo processing already lawfully performed. We may verify identity and authority in a proportionate way before acting. Do not send passwords or payment-card details with your request. Rights may be subject to legal exceptions, including obligations to retain billing records or protect another person's information.

Email info@cloud-vision.com with the subject “Vision Preview privacy request” and identify the relevant account or organisation. We will handle requests within applicable legal time limits and explain any permitted refusal. You may also complain to your competent privacy or consumer-protection regulator. We will not unlawfully discriminate against you for exercising your rights.

10. Children and policy changes

The service is not directed at children under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. We may update this policy to reflect changes in processing or law, publish an updated effective date and provide additional notice or obtain consent where required for material changes. Archived versions remain linked to recorded registration acceptance.

11. Contact