About this Policy
This Privacy Policy explains how Cloud Alter Inc. ("Cloud Alter", "we", "us") collects, uses, discloses and protects personal information through its websites (cloudalter.com, cloudfonica.com, textenvoy.com and optimasaver.com), its portals, and the services it provides to businesses (Cloudfonica, Optima Saver and TextEnvoy). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Act respecting the protection of personal information in the private sector, and, where they apply, the EU and UK GDPR and U.S. state privacy laws.
1. Our Two Roles
- Where we decide how information is used — for example, information about our customers' representatives, website visitors and people who contact us — we are responsible for it, as this Policy describes.
- Where we process information for our business customers — the calls and messages our customers route through our platforms, call detail records, phone numbers and message content — we act as their service provider. Our customer is responsible for that information and its own privacy policy applies. Our handling of it is governed by our Data Processing Agreement with that customer. If you received a call or message through our platform, please contact the business that sent it. Where we can identify that business, we will forward your request to it.
- Our own fraud and security use of traffic information — we also use limited traffic information (telephone numbers, IP addresses, call and message metadata and fraud signals, but not message content or call audio) for our own fraud and abuse prevention, network security, billing and legal compliance, and may share fraud indicators with carriers and anti-fraud and traceback groups as the law permits. For that use we are responsible in our own right.
2. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Contact and account | Name, business email, phone number, job title, company, username, password (stored hashed) | You or your employer |
| Verification (KYC) | Business registration, licences, identity of owners and authorized representatives (including government-issued ID where needed to prevent fraud or comply with law), description of intended use | You, public registries, verification providers |
| Billing | Billing contact and address, tax numbers, transaction history, partial card details and payment tokens, PayPal account email. Full card numbers are handled by our payment processors, not stored by us | You, payment processors |
| Communications | Support tickets, emails, Telegram and WhatsApp messages, call notes, feedback | You |
| Technical and usage | IP addresses, device and browser details, log-in records, portal and API activity, security logs, Client Software telemetry (device model, software version, port counts, throughput, error rates) | Automatically, from your devices and our systems |
| Traffic metadata for fraud prevention | Calling, called, sender and recipient numbers, IP addresses, call and message records, fraud signals (not message content or call audio) | Our platforms, carriers, anti-fraud and traceback groups |
| Cookies and similar technologies | See Section 11 | Automatically |
| Marketing preferences | Subscription status and consent records | You |
3. How We Use Information
| Purpose | Examples | Legal basis (EEA and UK only) |
|---|---|---|
| Provide and administer the Services | Create accounts, authenticate users, configure services, provide support | Contract |
| Billing and collections | Invoice, process payments, meet tax obligations, collect overdue amounts | Contract; legal obligation |
| Verify customers, prevent fraud and secure the Services | KYC checks, fraud and abuse detection, enforcing our Acceptable Use Policy, answering traceback requests | Legitimate interests; legal obligation |
| Communicate about the Services | Service, maintenance, incident and policy-change notices | Contract; legitimate interests |
| Improve the Services | Troubleshooting, analytics and product development, using aggregated or de-identified data where possible | Legitimate interests |
| Marketing | Newsletters and product news, sent with consent where CASL or other law requires | Consent |
| Legal compliance and claims | Complying with law, responding to lawful requests, establishing or defending legal claims | Legal obligation; legitimate interests |
We use personal information only for these purposes, purposes consistent with them, or as the law permits. If we want to use it for a new purpose, we will ask for consent where the law requires.
4. Consent
We obtain consent as PIPEDA and provincial laws require. Consent may be implied for information you give us to obtain the Services. We obtain consent for marketing messages as CASL and other laws require, and express consent before collecting government-issued ID. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may mean we can no longer provide some or all of the Services.
5. How We Share Information
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only:
- with service providers that act for us — hosting and infrastructure, payment processing (including PayPal and card processors), email delivery, website analytics, spam protection (Google reCAPTCHA on optimasaver.com), and AI tools that help us diagnose technical faults. They are bound by contract to protect it and use it only for our purposes. If you contact us through Telegram or WhatsApp, those apps are run by third parties under their own terms and privacy policies, not under contract with us, so please do not send passwords or other sensitive information through them. The providers that handle our customers' data are listed at cloudfonica.com/legal/subprocessors;
- with carriers and interconnection partners, to route traffic on our customers' instructions;
- to prevent fraud, with carriers, payment processors, and industry anti-fraud and traceback groups, as the law permits;
- for legal and safety reasons, with law enforcement, regulators and courts where the law requires or permits (for example, under a warrant or production order), or to protect rights, property or safety;
- in a business transaction, with a prospective buyer, investor or merger partner, under confidentiality obligations and as the law permits;
- with professional advisers, such as lawyers, accountants, auditors and insurers; and
- with your consent or at your direction.
6. International Transfers
We are based in Ontario, Canada. We and our service providers store and process personal information in Canada, the United States, Singapore and the countries of the hosting regions our customers choose, and our employees in Bangladesh and India may access it to operate and support the Services. Information held outside your province or country is subject to the laws of those places and may be accessible to their courts, law-enforcement and national-security authorities. We use contracts and other measures to protect it.
- Québec: before communicating personal information outside Québec, we assess whether it will be adequately protected, as Québec law requires.
- Alberta and elsewhere in Canada: to obtain written information about our policies and practices for service providers outside Canada, or to ask how those providers collect, use, disclose or store personal information, contact our Privacy Officer (Section 14).
- EEA and UK: the EU and the UK recognize Canada as providing adequate protection for commercial organizations subject to PIPEDA. For onward transfers to other countries, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.
7. Retention
| Information | How long we keep it |
|---|---|
| Account and contact | While the account is active, plus 2 years |
| Records of your acceptance of our terms | While the account is active, plus 7 years |
| Billing and tax records | At least 6 years after the end of the tax year they relate to, as Canadian tax law requires |
| Verification (KYC) | Copies of ID documents: deleted within 90 days of the check. The result of the check: 5 years after the account closes |
| Support communications | 3 years after the ticket closes |
| Enquiries from people who are not customers | 2 years after the last message |
| Security and access logs | 12 months, or longer when needed for an investigation |
| Call and traffic records we keep for our own fraud checks | 2 years |
| Marketing consent records | While you are subscribed, plus 3 years |
| Records of security breaches | At least 5 years (PIPEDA requires 24 months; Québec requires 5 years) |
| Data we process for customers | As set by the customer's agreement and our Data Processing Agreement |
When we no longer need personal information, we securely destroy it or anonymize it as the law requires.
8. Safeguards
We protect personal information with safeguards suited to its sensitivity, including encryption in transit and, where supported, at rest; need-to-know access controls; multi-factor authentication on our hosting control panel; logging and monitoring; vendor due diligence; confidentiality obligations and training for staff; and an incident-response plan. No system is completely secure. If a breach creates a real risk of significant harm to you, or a risk of serious injury under Québec law, we will notify you and the regulators as the law requires.
9. Your Rights
| Where you live | Your rights |
|---|---|
| Anywhere in Canada | Access your personal information, ask us to correct it, withdraw consent, and complain |
| Québec (in addition) | Receive computerized information in a structured, commonly used technological format; ask us to stop disseminating or de-index it; be told about, and comment on, decisions made exclusively by automated processing |
| EEA and UK | Access, correction, erasure, restriction, objection (including to direct marketing), portability, withdrawal of consent, and complaint to a supervisory authority |
| U.S. states with privacy laws (such as California), where those laws apply to us | Know and access, delete, correct, opt out of sale, sharing or targeted advertising (we do none of these), limit use of sensitive information, appeal a refusal, and be free from discrimination for exercising these rights |
To exercise a right, email privacy@cloudalter.com. We will verify your identity and respond within 30 days, or tell you if the law allows us more time and why. We normally do not charge; where the law permits, we may charge a minimal fee for copies. Requests about data we process for a customer are referred to that customer. You may use an authorized agent where the law allows.
10. Automated Decisions
We use automated systems to detect fraud, spam and abuse, for example to flag sign-ups for review, block suspicious traffic patterns, or restrict an account pending review. When we make a decision about you based exclusively on automated processing, we will tell you so no later than when we inform you of the decision. On request, we will tell you what personal information was used and the reasons and main factors behind the decision, and you may submit observations to a staff member who can review it.
11. Cookies and Similar Technologies
We use essential cookies and browser storage for sign-in, security and display choices. Analytics cookies are off by default and are used only with your consent, which you can give or withdraw through the cookie banner or the "Cookie settings" link on cloudfonica.com. We honour Global Privacy Control signals where the law requires. Our current cookie list is at cloudfonica.com/legal/cookies.
12. Children
Our Services are for businesses and are not directed to anyone under 18. We do not knowingly collect children's personal information.
13. Marketing Messages
We send commercial electronic messages only with consent, as CASL requires. Every message includes an unsubscribe link, and we act on unsubscribe requests within 10 business days.
14. Privacy Officer and Contact
Our person in charge of the protection of personal information is our Privacy Officer, whom you can reach at the contacts below.
Email: privacy@cloudalter.com · Mail: Cloud Alter Inc., Attention: Privacy Officer, 20 Teesdale Place, Toronto, Ontario M1L 1L1, Canada · Phone: +1 647-558-8722 · Our governance policies for personal information are available on request.
15. Complaints
Please contact us first so we can try to resolve your concern. You may also complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner of Alberta or of British Columbia, your EU or UK data-protection authority, or your U.S. state attorney general or the California Privacy Protection Agency.
16. Changes to this Policy
We will post updates here with a new effective date. Where practicable, we will give at least 30 days' notice of material changes by email or in the portal. Previous versions are available at cloudfonica.com/legal/archive.
A question about this document? Contact us.