Privacy Statement

What we hold, why, where it lives, and how you get it removed. The TL;DR is the 30-second read; the numbered sections are the detail.

TL;DR — the short version

We are The Cloud Platform Limited, the England-and-Wales company behind Decolla. We store the minimum needed to run your builds: your email address if you join the waitlist, write to us, or sign in to the cockpit (including the sign-in link we email you); the tenant connection tokens that let Decolla act inside your Microsoft 365 tenant (encrypted, and invalidated the moment you disconnect); your build plans and deployment job history, kept so you have an audit trail of what was created; the estate information you choose to import with the capture agent; the app installers you choose to upload; and any feedback you choose to send from inside the product. Decolla never reads your users' devices, files or messages — it creates configuration objects in your tenant, it does not look at what is in it. Exactly two suppliers touch data: Cloudflare hosts our infrastructure, and Microsoft's Graph API carries out deployments under the permissions you consented to, inside your own tenant. There are no advertising trackers, we do not sell data, and — because Decolla is in early access and unpriced — there is no payment processing at all. You can ask what we hold about you, have it corrected, or have it deleted at any time via the contact page, and if we ever get something wrong you can also go to the Information Commissioner's Office (ICO), the UK regulator. The full Statement below sets out what we collect, why, who we share it with, how long we keep it, and what your rights are — in plain English.

1. Who we are

Decolla is a product of The Cloud Platform Limited, a company registered in England and Wales. We are the data controller for the personal information described in this Statement — that means we decide what to collect, why we collect it, and what we do with it. Where a supplier handles data on our behalf, we say so in section 4.

Decolla runs across three surfaces: decolla.app (the marketing site, waitlist, knowledge base and guides), cockpit.decolla.app (the wizard portal where you plan and deploy) and api.decolla.app (the API). This Statement covers all three, and the downloadable Decolla tools (the capture agent and the USB builder) where they send data to the service.

For any privacy question, reach us via the contact page — a real person reads everything sent there.

2. What we collect, why, and what allows us to

This is the section most people care about, so we have laid it out one entry per data flow, each with the lawful basis we rely on under UK GDPR Article 6. Decolla is a business tool for IT administrators and MSPs: nothing we process is special-category data, and everything we hold exists for one reason — to run your builds and keep an honest record of them.

2.1 Waitlist signup (decolla.app)

What: your email address and the fact and time of your signup, stored in our Cloudflare D1 database. A notification of your signup is routed via Cloudflare Email Routing to our company inbox so we know you are waiting.

Why: to tell you when early access opens and to keep you informed about the service you asked to hear about.

Lawful basis: consent — Article 6(1)(a). You opted in by submitting the form, and you can withdraw at any time via the contact page; we will remove you promptly.

2.2 Contact-form messages

What: the message you write and whatever details you choose to include with it.

Why: to reply to you. That is the only use.

Lawful basis: legitimate interest — Article 6(1)(f) — responding to an enquiry you sent us, balanced firmly in your favour because you initiated the contact and control what you include.

2.3 Cockpit sign-in (cockpit.decolla.app) — new in 1.2

What: the email address you sign in with, the sign-in link we send to that address, and the session that keeps you signed in — together with basic sign-in records (when you signed in) that protect your account. Stored in Cloudflare D1/KV.

Why: so the cockpit knows who you are, keeps your profiles, plans and job history attached to your account, and keeps anyone who does not control your inbox out of it. The emailed sign-in link exists so there is no password for you to manage or for anyone to steal.

Lawful basis: contract — Article 6(1)(b) — an account and a way to sign in to it are necessary to provide the service you asked for.

2.4 Tenant connection tokens (cockpit.decolla.app)

What: when an administrator connects a Microsoft 365 tenant, we store the OAuth tokens issued under the delegated Microsoft consent you granted. They are held AES-GCM-encrypted in Cloudflare KV and exist for exactly one purpose: so Decolla can act on your instructions, as the signed-in administrator, with no standing access of its own.

Two things worth being clear about. First, connecting a tenant deploys nothing — every write requires your explicit per-batch confirmation inside the product, and policies are created unassigned. Second, the tokens are revocable at will: disconnecting the tenant invalidates them.

Lawful basis: contract — Article 6(1)(b) — the tokens are necessary to deliver the service you asked us to perform in your tenant.

2.5 Build plans and deployment job history

What: your catalogue selections, the naming values and parameter choices you enter, and the per-step results returned by Microsoft Graph for each deployment, stored in Cloudflare D1.

Why: so you have an audit trail of exactly what Decolla created in your tenant, when, and with what result. For a tool that writes configuration into production tenants, we consider that record a duty, not a feature.

Lawful basis: contract — Article 6(1)(b) — for planning and executing the builds you instruct; legitimate interest — Article 6(1)(f) — for preserving the audit trail, where the interest (yours and ours: accountability for changes made to your tenant) clearly outweighs any privacy impact of retaining it.

2.6 Capture-agent estate imports — new in 1.2

What: when you choose to run the Decolla capture agent in your environment, it collects the configuration information you point it at — for example Group Policy exports, deployment scripts, and installed-application inventory — and uploads it to your organisation's own space in our storage so the wizard can build your plan from your real estate. That material is about systems, not people, but it can incidentally contain personal data your environment put there (usernames in policies or scripts, computer names that include people's names).

Why: so your plan starts from what you actually run — the whole point of the import. The agent is transparent: you can read what it collected before it is used.

Where it goes — and where it never goes: your imports are stored tenant-scoped (your organisation's data, visible to your organisation) in Cloudflare R2/D1. They are never added to Decolla's shared catalogue or used to improve the product for anyone else without a separate, explicit opt-in — and anything that would flow there under that opt-in is anonymised first.

Lawful basis: contract — Article 6(1)(b) — you run the agent to have Decolla build from your estate; for any incidental personal data inside the import, legitimate interest — Article 6(1)(f) — processing it only as part of the configuration record you asked us to work from.

2.7 Custom app uploads — new in 1.2

What: installer files (MSI/EXE) you upload so Decolla can deploy your own or licensed applications — your RMM agent, VPN client, line-of-business apps — plus the details you enter about them. Stored tenant-scoped in Cloudflare R2, reachable only through short-lived, organisation-locked download links.

Why: so the apps only you hold can be part of your build, over the cloud or on a provisioning USB.

A deliberate safeguard: if you enter a secret alongside an app (for example an RMM token), the secret is redacted before it is stored — the stored record holds a placeholder, and the real value is used transiently at packaging time and never logged. Your uploads are yours: they are never published to other customers or to any shared catalogue.

Lawful basis: contract — Article 6(1)(b) — storing the installer is necessary to deploy it for you.

2.8 In-product feedback

What: the note you write, the screenshot captured with it, and the page context (which screen you were on), stored in Cloudflare D1 and R2.

Why: to improve the product. Nothing else.

Lawful basis: consent — Article 6(1)(a) — you chose to submit it.

3. What we do not collect

We have designed the system so that the following never reaches us:

• End-user device content. Decolla creates configuration objects in your tenant; it does not read your users' files, mailboxes, messages, or anything on their devices. The capture agent collects the configuration sources you point it at — not user files, not mailboxes, not documents.
• Payment data. Decolla is in early access and unpriced — there is no payment processing at all.
• Advertising or tracking data. There are no advertising trackers on any Decolla surface, and we do not sell or share data with advertisers. Ever.

4. Who we share information with

We do not sell your information to anyone. Exactly two suppliers process data in connection with Decolla:

• Cloudflare — hosts the whole service (Workers, D1, KV, R2) and routes notification email (waitlist signups, sign-in links) to and from our systems. Cloudflare processes data across its global edge network.
• Microsoft — when you confirm a deployment, Decolla calls the Microsoft Graph API under the permissions you consented to, in your own tenant. Your tenant data stays governed by your own agreement with Microsoft, in your tenant's own region; Decolla is a guest acting on your instruction, not a new home for your data.

If we ever add a supplier, we will update this Statement before the new supplier starts processing.

5. International transfers

Cloudflare operates a global network with points of presence in the UK, the EU and the US, so data we hold may be processed outside the UK. For those transfers we rely on Cloudflare's data processing addendum, which incorporates the safeguards UK GDPR recognises for transfers abroad (Standard Contractual Clauses with the UK Addendum). Microsoft Graph processing happens in your own tenant's region, under your own Microsoft agreement — we do not move your tenant data anywhere.

6. How long we keep things

• Tenant connection tokens — until you disconnect or they expire, whichever comes first. Disconnecting invalidates them.
• Sign-in records — for the life of your account; sign-in links themselves are short-lived and single-purpose.
• Build plans and job history — for the life of your account, so the audit trail of what was created in your tenant stays intact.
• Estate imports and app uploads — for the life of your account or until you delete them, so your plans and builds keep working; ask via the contact page and we will remove them sooner.
• Waitlist and contact data — until you ask us to remove it.
• Feedback — until it has served its purpose or you ask us to delete it.

We honour erasure requests promptly and within one month at the outside — see section 7. Note that deleting your account removes the job history that is your audit trail, so we will confirm before acting on a request that would destroy it.

7. Your rights

UK GDPR gives you rights over the information we hold about you. We respond within one month of a request, free of charge in almost all cases:

• Access (Article 15) — ask for a copy of what we hold.
• Rectification (Article 16) — ask us to correct anything wrong.
• Erasure (Article 17) — ask us to delete what we hold.
• Restriction (Article 18) — ask us to pause our use of your data while a question about it is resolved.
• Portability (Article 20) — receive your data in a structured, machine-readable form.
• Objection (Article 21) — object to any processing we base on legitimate interest.

Where our processing rests on your consent — the waitlist and in-product feedback — you can also withdraw that consent at any time; withdrawal does not affect the lawfulness of anything done before it.

To exercise any of these, use the contact page. If you are not happy with how we handle a privacy question, you can complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk — though we would prefer you came to us first, because we would like the chance to put it right.

8. Cookies

The honest version: Decolla uses only the cookies needed to make the service work and keep it secure — functional and security cookies set by our hosting platform, Cloudflare, and the session that keeps you signed in to the cockpit. There are no analytics cookies, no advertising cookies, and no tracking of you across other sites. That is why you do not see a cookie consent banner: we set nothing that requires one.

9. Security

The measures that matter most for a tool like this:

• Tenant tokens are AES-GCM-encrypted at rest in Cloudflare KV, and disconnecting a tenant invalidates them.
• Everything moves over TLS.
• Uploads are tenant-scoped with short-lived, organisation-locked access links, and secrets you enter are redacted before storage (§2.7).
• The downloadable tools are code-signed by The Cloud Platform Limited, so you can verify what you run came from us.
• Nothing deploys without you. Every write to your tenant requires your explicit per-batch confirmation, and policies are created unassigned — the consent model is itself a security control.

No system is invulnerable. If we discover a personal data breach, we will notify the ICO within 72 hours where the law requires it (Article 33), and we will tell you without undue delay if the breach is likely to put your rights and freedoms at high risk (Article 34).

10. Changes to this Statement

We will update this Statement when something changes — a new supplier, a new feature, a change in how we process something. The version number will increment and the date will move forward. For material changes — anything that affects what we collect or how we use it — we will flag the change prominently on the site. If a change does not work for you, your rights to withdraw consent and request erasure are unchanged.

Version 1.2 · 19 July 2026 · supersedes v1.1 (10 July 2026)