Privacy policy

Plain-English summary: we collect the minimum data needed to reply to your enquiry, send the newsletter you opted into, and run cookieless analytics. We never sell or share your data with third parties beyond named processors (Cloudflare, Resend, GitHub). You have full UK GDPR rights; email privacy@salvador.cloud to exercise them.

Who we are

Salvador Cloud Ltd, a UK private company registered with Companies House under number 11311496. Our ICO data-protection registration number is pending registration completion at the time of v1.0 launch.

For all privacy questions, contact privacy@salvador.cloud. We respond within 30 calendar days as required by UK GDPR.

What data we collect, when, and why

Contact form

When you submit our contact form we collect:

• Name, work email, company
• Optional: role, sector, regulators, engagement type, timeline, brief context

We use it to respond to your enquiry. Lawful basis: legitimate interest (Article 6(1)(f)) — responding to an unsolicited B2B enquiry.

Newsletter

If you opt in (separately, never pre-ticked):

• Email, optional name, source UTM if you arrived via a tagged link

We use it to send the monthly briefing. Lawful basis: consent (Article 6(1)(a)). One-click unsubscribe in every email.

Lead-magnet downloads

When you request a downloadable resource:

• Name, work email, company

We use it to deliver the resource and follow up about it. Lawful basis: legitimate interest (you requested the resource).

Analytics

Anonymous aggregates only:

• Page-view counts, referrer (cleaned), country (city-level only), custom events (cta_click, form_submit, etc.)

No IP addresses are stored; no cookies set; no per-user identifiers used. Not personal data; no lawful basis declaration required.

Sources of data

We collect data directly from you when you submit a form. We do not buy contact data, scrape contact data, or enrich your record with third-party sources.

Recipients / third parties

We share data only with our named processors:

• Cloudflare (Pages, R2, Web Analytics, Workers Analytics Engine, Turnstile) — hosting + edge + analytics. UK + EU SCCs in our DPA.
• Resend — transactional email delivery + newsletter audience. EU region. Standard Resend DPA.
• GitHub — source-code hosting. Standard GitHub Enterprise DPA.

Vendor DPA register: see docs/legal/dpa-register.md (not public).

International transfers

UK adequacy decision applies to EU-based processing. EU SCCs in our vendor DPAs cover any onward US transfer (e.g., Cloudflare’s global edge).

Retention

• Contact form: 12 months from last contact.
• Newsletter: until you unsubscribe or request erasure.
• Lead-magnet records: 12 months from download.
• Cloudflare Web Analytics: 6 months rolling (Cloudflare default).
• Workers Analytics Engine: 90 days (Cloudflare default).
• Resend transactional logs: 30 days (configured).

Your rights (UK GDPR Articles 15–22)

You have the right to:

• Access (Art. 15) — what we hold about you (typically: your email if newsletter subscriber, your submitted enquiry text, our reply).
• Rectification (Art. 16) — correction.
• Erasure (Art. 17) — deletion.
• Restriction (Art. 18) — pause processing.
• Portability (Art. 20) — export your newsletter audience data.
• Object (Art. 21) — handled via the unsubscribe link.

To exercise any right, email privacy@salvador.cloud. We respond within 30 calendar days.

Right to complain

If you believe we have not handled your data correctly you may complain to the Information Commissioner’s Office: https://ico.org.uk.

Automated decision-making and profiling

We do not use automated decision-making or profiling.

Cookies and similar technologies

See our cookies policy.

Security measures

See our security page for the controls in place around your data.

Changes to this policy

We will notify any material change to opted-in newsletter subscribers at least 30 days before the new policy takes effect. The full version history lives in this page’s changelog section.

Effective date

Effective: 2026-04-20 · Last reviewed: 2026-04-20 · Version: 1.0.0