EN · IT

Privacy Policy

Last updated: 13 May 2026

1. Who we are

This website (cloudend.uk) and the SaaS product "Cantieri" (app.cloudend.uk) are operated by Cloudend, a sole trader registered in the United Kingdom. Contact: hello@cloudend.dev

2. Scope

This policy applies to visitors of cloudend.uk and to users of the Cantieri SaaS application. For Cantieri customer data (admin, foremen, workers), Cloudend acts as data processor and the customer organisation acts as data controller. A Data Processing Agreement (DPA) governs the relationship between the parties.

3. Data we collect

On cloudend.uk (this website)

• Server logs (IP address, browser, requested URL) for security and abuse prevention
• No analytics, no cookies, no third-party scripts

In the Cantieri application

• Authentication data (email, hashed password) via Supabase Auth
• Tenant administrative data: company name, contact email
• Worker data entered by the customer: first name, last name, employee code, hashed PIN, optional phone/email/address/emergency contact
• Attendance records: check-in/check-out timestamps, site, user agent of the scan
• Foreman / dashboard user emails created by the customer admin

4. Lawful basis

• Contract (Art. 6(1)(b) GDPR): to deliver the service to paying customers
• Legitimate interest (Art. 6(1)(f) GDPR): server logs for security
• For worker data in Cantieri, the customer organisation is responsible for the lawful basis (typically employment contract under Art. 6(1)(b))

5. Sub-processors

We use the following sub-processors:

• Supabase (Postgres + Auth) - EU region (Frankfurt) - https://supabase.com/privacy
• Cloudflare (CDN, DNS, edge security, Workers) - https://www.cloudflare.com/privacypolicy/
• Vercel (frontend hosting) - https://vercel.com/legal/privacy-policy

6. International transfers

Cloudend operates from the United Kingdom. Customer data is stored on Supabase EU servers (Frankfurt). Cloudflare and Vercel may route traffic globally via their edge network with appropriate Standard Contractual Clauses in place.

7. EU representative (Art. 27 GDPR)

If you are an EU data subject and prefer to contact our EU representative for privacy matters, please email hello@cloudend.dev and we will provide the current designated representative details.

8. Retention

• Server logs: 30 days
• Customer data: until the customer terminates the contract; we delete or export within 30 days of termination on request
• Backups: up to 30 days rolling

9. Your rights

Under UK GDPR / EU GDPR you have the right to access, rectification, erasure, restriction, portability and objection. To exercise these rights please email hello@cloudend.dev. If the request concerns worker data inside a Cantieri tenant, we will forward it to the customer organisation (the data controller).

10. Cookies

cloudend.uk does not use cookies. The Cantieri application uses essential cookies for authentication session management only. No tracking or marketing cookies are used.

11. Changes

We may update this policy. Material changes will be communicated to active customers by email.