Privacy Policy

How Cumulus handles personal data across every product and service we provide.

Introduction and scope

This notice explains, in plain words, what information we handle when you use Cumulus products, services, projects, or support. It applies to the website, hosted tools, custom deliveries, and any engagement we run for clients and users.

Controller identity and contacts

Cumulus S.L. is the data controller. Email legal@cumulush.com for general matters and dpo@cumulush.com for privacy requests. Our registered address appears in the main legal notice. [Legal counsel placeholder: add statutory controller wording].

Data we collect

Account and profile data

Names, emails, login details, and profile content you supply to set up and use our platforms.

Usage and support data

Interactions with interfaces, product telemetry, tickets, and help conversations.

Payment data

Payment method details handled by Stripe, including authorised methods, metadata, and fraud signals.

Files and content

Uploads, documents processed, and outputs generated inside our tools or projects.

Logs and diagnostics

Security events, audit logs, and error diagnostics that keep the service reliable.

Why we process data

We process data to deliver contracts, provide support, improve our products, protect the platform, and meet legal duties. Consent covers optional cookies and promotional updates. Legitimate interests include safety, fraud control, and internal analytics. [Legal counsel placeholder: complete purpose and basis matrix].

Processors and recipients

We rely on specialised processors that follow our instructions and data protection agreements. Review their roles, categories, and security statements below.

Data processors we rely on
Name	Category	Role	Data types	Purpose	Docs
Stripe	Payments	Processor	payment method details payer metadata fraud signals	Process payments, prevent fraud	Security docs Privacy notice
Neon (Postgres)	Database	Processor	application data user records	Managed Postgres database	Security docs Privacy notice
Vercel Blob	Object Storage	Processor	file uploads assets logs (metadata)	Store and serve user/application files	Security docs Privacy notice
Supabase	Backend Services	Processor	auth data app data backups	Auth/DB/Edge functions (where applicable)	Security docs Privacy notice

International transfers and hosting

We aim to store data in the European Union whenever the stack allows. If a processor can operate outside the EEA, we rely on contracts and safeguards that keep rights protected. [Legal counsel placeholder: describe actual regions and transfer tools].

Data retention

We retain information while you have an active relationship with Cumulus and for longer when law or audit duties require it. Retention periods cover projects, support records, payments, and compliance archives.

Your rights

You can request access, correction, erasure, restriction, portability, or objection by emailing the DPO. You may also contact the Spanish Data Protection Agency (AEPD) or your local authority. We respond within thirty days unless the request is complex.

Our cookie notice lives at /cookies. Analytics and advertising tags observe Consent Mode v2 so behaviour adjusts to your choices. Until you agree, tags run in limited mode. We follow the current AEPD cookie guidance for Spain.

Products and services covered

The list below stays in sync with our central configuration so every live product and service appears here without manual edits.

Products

Blocks
Visual project terminal that keeps field teams, analytics, and security steps aligned.
DQuote
Interactive quotation builder that helps revenue teams send, track, and update offers.
Microagents
AI agent builder that automates small workflows with safe guardrails.
Resuming
AI CV optimizer that edits, formats, and personalizes documents instantly.
AgentOps
AI agents for operations and pipelines that watch tasks and report progress.

Services

Software & Applications
Product teams plan, build, and maintain custom software from discovery to live support.
Website Design & Development
Design-first web partners launch fast, accessible sites with clean code and ongoing care.
SEO & SAO
Search and answer optimization keeps content, structure, and signals ready for discovery.
Advertising
Paid media crews run Google, Meta, and TikTok programs that drive measured conversions.