How CloudArmy handles personal information, Customer Content, and GDPR rights.

This policy covers the CloudArmy website, applications, Reactor platform, Customer Content, cookies, security practices, international transfers, and privacy rights.

CloudArmy Privacy Policy

Cloud Army Network Inc. ("CloudArmy") is committed to protecting the privacy of all individuals who visit any websites or mobile sites offered by CloudArmy, including cloud.army and all present and future subdomains; use mobile applications that CloudArmy makes available from time to time; or use the Services, including Reactor and other CloudArmy products and services.

To make this policy easier to read, we call the Website, the Applications, and the Platforms together the "Services". Personally Identifiable Information, referred to as PII, means any piece of information that can be used to identify an individual using publicly available information.

It is CloudArmy's policy to respect your privacy and the privacy of all users of the Services. This Privacy Policy has been established to help you understand our commitment to protecting your privacy and PII, and the steps we take to ensure it. By visiting and/or using any of the Services, you agree to be bound by this Privacy Policy. All conditions of the use of your PII only apply after you have unambiguously consented to them.

CloudArmy may change this Privacy Policy from time to time. Laws, regulations, and industry standards evolve, which may make those changes necessary, or we may make changes to our business. We will make an effort to make you aware of these changes, and the most recent privacy policy will always be stored at www.cloud.army/privacy/. If we make changes that materially alter your privacy rights regarding your PII, we will obtain additional consent from you.

If you disagree with changes to this Privacy Policy, you should deactivate your Services account and request that we delete all data belonging to you that is not attached to another customer or required for accounting. Contact your customer administrator if you wish to request the removal of PII under their control.

CloudArmy's Privacy Policy forms part of its wider Terms of Service, available at www.cloud.army/terms/. If you are a CloudArmy Reactor user, you may be subject to a negotiated agreement governing your access to and use of CloudArmy Services and Platforms. Additional terms may apply to other Services purchased. Both the Terms and the Privacy Policy apply to your use of the Services.

CloudArmy Data And Customer Content

The personally identifiable information we collect from our customers and users of the Services is for our own purposes, such as to provide and administer the Services ("CloudArmy Data"), and is only collected with their unambiguous consent. We are the data controller in respect of this information. CloudArmy Data is also referred to as "Customer Information" in our Terms.

If your PII is not needed for billing and is not attached to another organization due to your own actions, you can request to have that information deleted, and CloudArmy will delete it without undue delay.

This Privacy Policy describes how and when CloudArmy collects, uses, and shares CloudArmy Data when you use the Services. CloudArmy receives your information through our Website, Platforms, and Applications.

Whilst most of this Privacy Policy relates to CloudArmy Data, we also provide some information about how our customers choose to collect and use Customer Content through the Services.

The Services allow our customers to connect their accounts through the APIs of Supported Platforms, such as Facebook and Amazon Mechanical Turk, and applications developed by third parties that CloudArmy does not own or control. This Privacy Policy does not cover information or content you can view via the Services on Supported Platforms but which was not posted there using the Services, or information you provide to Third-Party Platforms accessed via the Services.

While we attempt to facilitate access only to Supported Platforms and Third-Party Platforms that share our respect for privacy, we cannot take responsibility for the content or privacy policies of any Supported Platforms or Third-Party Platforms. We encourage you to carefully review the privacy policies of any Supported Platforms or Third-Party Platforms you access via the Services.

GDPR Compliance

CloudArmy values privacy and is committed to handling personal information in accordance with applicable data protection laws, including the European General Data Protection Regulation (GDPR).

CloudArmy acts as a data controller for personal information it collects for its own purposes, such as account administration, customer support, billing, marketing communications, security, analytics, and operation of the Services. For certain EU customers, CloudArmy may also process Customer Content as a data processor on the customer's behalf, as described in this Privacy Policy and any applicable Data Processing Addendum.

CloudArmy minimizes the amount of personal data it collects and protects it through security measures such as encryption, pseudonymization where appropriate, secure authentication practices, and selected third-party vendors and hosting partners with strong physical and technical security standards.

Data We Collect And Protect

CloudArmy collects and protects data across the following categories:

Customer Content used to create test designs and operate studies in the Reactor Portal.
Personal information entered in the Reactor Portal by users who create, administer, or analyze tests.
Results and Customer Content generated from respondents who take tests on the Reactor platform.
Contact information gathered from customers, prospects, forms, support workflows, and marketing communications.
Diagnostic and security data, including IP addresses, device and browser information, activity information, access times, error messages, and related service-maintenance data.

Sensitive And Respondent Data

CloudArmy's Services are not designed to request sensitive personal data, such as criminal records, sexual preferences, religious views, or similar special-category information. CloudArmy's terms restrict customers from including personally identifiable data in Reactor test designs or collecting personally identifiable respondent data through tests run on the Reactor platform.

Because customers control the studies they design and may connect Services to Supported Platforms and Third-Party Platforms, CloudArmy's processing role and obligations may vary by customer agreement, region, and data flow.

Respecting GDPR Rights

CloudArmy has mechanisms and processes in place to allow individuals to exercise applicable data protection rights. You can contact us to obtain a copy of Personal Information held about you, ask us to correct it, and, where relevant, erase it. You may also request data portability for personal data received by consent from you, in a machine-readable format where required by applicable law.

CloudArmy will delete personal data received on the basis of consent within a reasonable period of time when deletion does not conflict with legal obligations, legitimate business purposes, accounting requirements, customer-controlled data, or data attached to another organization due to your own actions.

Cookies

CloudArmy does not store personal data in cookies without explicit consent. Necessary session cookies support core Services, while optional analytics, marketing, and related technologies are governed by consent choices and the cookie information below.

CloudArmy Data We Receive Or Collect

When you first register for a CloudArmy account, and/or when you use the Services, we collect some Personal Information about you when you explicitly give us this information.

Your full name, username, email address, and other contact details.
A unique CloudArmy user ID assigned to you upon registration.
Other optional information as part of your account profile.
Other information submitted by you or your organizational representatives via phone, email, online forms, surveys, in-person meetings, or other methods.
Your billing address and any necessary information to complete financial transactions. When making purchases through the Services, we may also collect your credit card or PayPal information.
User-generated content, such as messages, posts, notes, comments, digital media, or communications exchanged on Supported Platforms.
Information we may receive relating to communications you send us, such as queries or comments concerning our Services or Supported Platforms.

Automatically Collected Information

CloudArmy automatically collects and receives other information from your computer or mobile device, including the activities you perform on our Website, Platforms, and Applications, the type of hardware and software you are using, such as your operating system or browser, and information obtained from cookies.

Each time you visit the Website or otherwise use the Services, we may collect browser and device type, access times, the web page from which you came, the regions from which you navigate the web page, and the web pages you access, as applicable.

How We Use CloudArmy Data

CloudArmy uses CloudArmy Data for the following general purposes:

To identify you when you log in to your account.
To enable us to operate the Services and provide them to you.
To verify your transactions and for purchase confirmation, billing, security, and authentication, including security tokens for communication with configured Third-Party Platforms.
To analyze the Website or other Services and information about visitors and users, including research into user demographics and behavior in order to improve our content and Services.
To contact you about your account and provide customer service support, including responding to comments and questions.
To share aggregate, non-identifiable statistics about users of the Services with prospective partners.
To share aggregate, non-identifiable statistics about users of the Services with our customers and their users.
To keep you informed about the Services, features, surveys, newsletters, offers, contests, and events we think you may find useful or which you have requested from us.
To sell or market CloudArmy products and services to you.
To better understand your needs and the needs of users in the aggregate, diagnose problems, analyze trends, improve the features and usability of the Services, and better understand and market to customers and users.
To keep the Services safe and secure, and to prevent fraudulent use of the Services.

Non-Identifiable Information

We also use non-identifiable information gathered for statistical purposes to keep track of the number of visits to the Services, introduce improvements, and improve usability. We may share this statistical data so partners also understand how often people use the Services and can provide an optimal experience.

Customer Content We Process For Our Customers

CloudArmy is a consumer research platform. By its nature, the Services enable our customers to design experiments and run studies which can be integrated with Third-Party Platforms, such as respondent recruiting services.

Our Services help customers manage studies, define tests, recruit respondents, and analyze the results.

Consent

By using any of the Services, or submitting or collecting any Personal Information via the Services, you consent to the collection, transfer, storage, disclosure, and use of your Personal Information in the manner set out in this Privacy Policy.

In most cases, we will also only collect this information after you have unambiguously consented to the use of said information. If you do not consent to the use of your Personal Information in these ways, please stop using the Services and/or request that we delete your Personal Information from our system.

Your email address and username are required for continued use of our product and cannot be deleted unless you stop using the Services.

Cookies And Related Technologies

CloudArmy uses tracking technology, including cookies, on the Website, in the Applications, and in the Platforms. This may include mobile application identifiers and a unique CloudArmy user ID to help us recognize you across different Services, monitor usage and web traffic routing, and customize and improve the Services.

Our cookies will only collect your personal information should you unambiguously consent to their use. Cookies are small text files placed on your device when you visit a website in order to track use of the site and improve your user experience.

Session Cookies

The Services use session cookies, which improve your user experience by storing certain information from your current visit on your device, such as log-in information. These enable us to remember your log-in session so you can move easily within the Website or other Services. Without these session cookies, we would not be able to provide the Services to you.

These session cookies have limited functionalities and expirations, and you will be required to re-enter your CloudArmy log-in information after a certain period of time has elapsed to protect against others accidentally accessing your account contents and related Personal Information.

Performance And Remarketing Cookies

Partners who help us with authentication and analytics may also put cookies on your device. We use several third-party vendors to help deliver CloudArmy products and services to you. We may share with third-party ad partners a cryptographic hash of a common account identifier, such as a user ID, to help measure services provided to you.

CloudArmy uses Google Analytics to track visitors to the Website anonymously. CloudArmy also uses Facebook Social Integrations to allow users to share and like Website pages, and uses Facebook's API to facilitate authentication and social integrations for recruiting friends to participate in studies and sharing results. After opting in to these features, you may opt out at any time by visiting your Facebook ad settings while logged into Facebook.

CloudArmy uses Google reCAPTCHA Enterprise to protect the Services from bots, fraud, and abuse. reCAPTCHA collects hardware and software information, such as device and application data, browser type, screen resolution, IP address, mouse movements, keystrokes, and interaction patterns, and sends this data to Google for analysis. CloudArmy is the data controller for all data collected through reCAPTCHA. This data is used solely for security and fraud prevention purposes and is not used for personalized advertising.

Related Technologies

CloudArmy may also use related technologies including web beacons, bugs, pixels, and software tokens in order to facilitate your use of the Services. Most notably, the Services use software tokens, stored securely on CloudArmy-controlled servers, to facilitate logging in to and functioning of Supported Platforms and Third-Party Platforms.

Most computer and some mobile web browsers automatically accept cookies, but you can change your browser settings to prevent that or notify you each time a cookie is set. The Network Advertising Initiative has developed a tool that may help you understand which third parties have currently enabled cookies for your browser and opt out of those cookies. By blocking or deleting cookies, you may not be able to take full advantage of the Website, Applications, and Platforms.

If you do not want to receive tracking pixels, you will need to disable HTML images in your email client, which may affect your ability to view images in other emails you receive.

When We May Share Personal Information

Except as provided in this Privacy Policy or the terms you consented to, CloudArmy does not divulge any Personal Information gathered via the Services, including Customer Content, to third parties.

Notwithstanding anything in the Privacy Policy to the contrary, we may share information we have collected about you or Customer Content in the following circumstances:

When you explicitly consent to disclosure of such information to a third party when connecting to a third-party service that asks whether you consent to such sharing.
Where we are legally required to do so, such as in response to court orders or legal process, or to establish, protect, or exercise our legal rights or defend against legal claims or demands.
If we believe it is necessary to investigate, prevent, or take action regarding illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person.
If we believe it is necessary to investigate, prevent, or take action regarding abuse of the Services infrastructure or the Internet in general, such as spam, denial-of-service attacks, or attempts to compromise security.
To a parent company, subsidiaries, joint ventures, or other companies under common control with CloudArmy.
If we are acquired by or merged with another entity, in which case we will require that entity to assume our obligations under this Privacy Policy or inform you that you are covered by a new privacy policy.
If the information is not private, is aggregated, or is otherwise non-Personal Information, such as your public user information.

Service Providers

Subject to obligations consistent with this Privacy Policy, we may disclose information to affiliates, agents, contractors, and service providers in order to facilitate the functioning of the Services or perform tasks integral to the Services, such as processing transactions, fulfilling requests for information, or providing support services.

Information may also be transferred from CloudArmy to third parties in control of Supported Platforms, but only to the extent required for the Services to function properly.

Children

Protecting the safety of children when they use the Internet is very important to us. Our Services should only be accessed by individuals of Minimum Age.

Minimum Age may mean different ages in different countries, depending on where the individual accesses the Services. For reference, Minimum Age means 14 years old for the United States, Canada, Australia, and South Korea; 16 years old in countries covered by the GDPR; and 13 years old for all other countries.

If applicable law requires that you must be older than such ages for CloudArmy to lawfully provide the Services to you, including the collection, storage, and use of your information in accordance with this Privacy Policy, then the Minimum Age is that older age. The Services are not designed or intended for use by children or anyone else under the age of 18.

Retention Of Personal Information

CloudArmy only retains personal information for as long as necessary to provide you with the Services you are subscribed to. If we use personal information to make a decision that directly affects you, we will retain that personal information for at least one year so that you have a reasonable opportunity to request access to it.

In addition, we will retain personal information only as long as necessary to fulfill the identified purposes or a legal or business purpose.

Security

We use industry best practices to keep any information collected and/or transmitted to Supported Platforms or Third-Party Platforms secure. This includes HTTPS with TLS, which encrypts transmitted data, and OAuth 2.0 protocols for authentication and data transfer to Supported Platforms and Third-Party Platforms.

Certain Personal Information, most notably CloudArmy log-in details, is encrypted during transmission using TLS. Passwords are stored only using a salted one-way hash and never as plain text.

CloudArmy uses third-party vendors and hosting partners, such as Amazon, to provide the hardware, software, networking, storage, and related technology required to run the Services. These vendors have been selected for their high standards of physical and technological security, including ISO and SSAE16 certifications.

When payments are processed by credit card, CloudArmy uses third-party vendors that are PCI-DSS compliant. At no point does CloudArmy have access to your credit card information.

Submission of information over the Internet is never entirely secure. We cannot guarantee the security of information you submit via the Services while it is in transit over the Internet, and any such submission is at your own risk, as specifically disclaimed in our Terms.

If you are a logged-in user, it is advisable to log out of your account at the end of every session and not leave a logged-in account unattended, particularly if you use a shared computer or device.

Information Storage And International Transfers

CloudArmy Network Inc., the entity that provides the Services, is a Canadian company with its head office located in British Columbia. For the purposes of EU data protection law, Canada is considered a country that provides adequate protections for Personal Information, as confirmed by the European Commission in Commission Decision 2002/2/EC.

The Services are mainly provided from our offices in Canada. However, by the nature of the Services, data that is viewed, collected, stored, or posted on or through the Services may need to flow from wherever you are located in the world to where Supported Platforms store the same data, in most cases the United States. Whenever such a transfer occurs, CloudArmy uses appropriate safeguards to ensure your data rights are protected.

CloudArmy uses third-party service providers, such as managed hosting providers, card processors, CRM systems, sub-processors of Customer Content, and technology partners, to provide the hardware, software, networking, storage, and other services used to operate the Services. These third-party providers may process or store Customer Content on servers outside the EEA, including in Canada or the United States.

By using any of the Services, or submitting or collecting any Personal Information via the Services, you authorize CloudArmy and its authorized service partners to use and process Customer Content and CloudArmy Data, including Personal Information, in these countries. Privacy protections and the rights of authorities and government agencies to access your Personal Information in some countries may not be equivalent to those in your country.

For Customers With A Principal Location In The EU

If you primarily use the Services within the EU, we will process Customer Content, which may include Personal Information, as a data processor on your behalf. Under EU law, you are considered the data controller of the Customer Content and are responsible for complying with applicable data protection laws in respect of processing Customer Content and the lawful instructions you give us.

To facilitate lawful transfer by you of Customer Content as a data controller through the Services to outside the EEA, CloudArmy offers EU customers a Data Processing Agreement as an addendum to their existing CloudArmy agreement. This incorporates the European Commission's Standard Contractual Clauses (processors) of 2010, also known as model processor clauses or SCC 2010.

The Data Processing Addendum applies only to the extent there is not another legal basis in place to validate the transfer of Personal Information outside the EEA. The Data Processing Addendum and related FAQs are available to customers. If you would like to incorporate the Data Processing Addendum into your existing agreement with CloudArmy, please email us and we will promptly send you CloudArmy's Data Processing Addendum for completion, signature, and return.

Email Preferences

After opting in, you may opt out of marketing communications sent by CloudArmy by managing your email preferences or following the unsubscribe instructions included in each marketing email.

Your Rights

You can contact us to obtain a copy of the Personal Information held about you by us. This may be subject to a fee not exceeding any prescribed fee permitted by applicable law. You can also ask us to correct and, where relevant, erase that information.

Certain Personal Information may need to be retained by CloudArmy for a period of time following cancellation of your account where this is necessary for legitimate business purposes or required or authorized by applicable law. You have a right to change your email preferences at any time.

CloudArmy acts as a conduit between our users and various Supported Platforms and Third-Party Platforms. In several instances, content published via CloudArmy will not be in CloudArmy's custody or control, and content shared by you through Supported Platforms or Third-Party Platforms via the Services may continue to be available to third parties and the public because it is under the control of those platform operators.

Contacting Us

If you have any questions about this Privacy Policy, please contact CloudArmy Legal Services.

CloudArmy Legal Services, 1600 - 925 West Georgia Street, Vancouver, British Columbia, Canada, V6C 3L2.