Privacy Statement

The short version: we store the minimum needed to run your builds — encrypted tenant credentials you can revoke at any time, your plans and job history, and your contact details. We do not sell data, ever.

Controller

The Cloud Platform Limited (England and Wales) is the data controller for the Decolla service. Contact us via the contact page.

What we collect and why

• Account and contact data — your email address when you join the waitlist or contact us (to respond and to tell you about the service).
• Tenant connection tokens — when an administrator connects a Microsoft tenant, we store the OAuth tokens encrypted (AES-GCM). They exist solely so Decolla can act on your instructions, and disconnecting invalidates them.
• Build plans and job history — the catalogue selections, client naming values (e.g. your organisation's display name and device prefix) and per-step deployment results, kept so you have an audit trail of what was created.
• Feedback — notes and screenshots you choose to submit through the in-product widget.

What we do NOT collect

No end-user device content, no files, no message data. Decolla creates configuration objects in your tenant; it does not read your users' data. We use no advertising trackers.

Where it lives

Data is processed on Cloudflare infrastructure (Workers, D1, KV, R2). Deployment calls go directly to Microsoft Graph under the permissions you consented to. Those are our two subprocessors.

Retention

Connection tokens: until you disconnect or they expire. Job history and plans: for the life of your account, so the audit trail stays intact. Waitlist/contact data: until you ask us to remove it.

Your rights

Under UK GDPR you can request access, correction, deletion, or portability of your personal data, and you can complain to the ICO (ico.org.uk). Contact us via the contact page and we will act promptly.

Version 1.0 · 9 July 2026