Norcloud Privacy Policy
Covering the Norcloud website and platform (norcloud.uk) and the Norcloud Instance Monitor mobile app
Effective date: [01 September 2027] | Version 1.0 (first draft)
1. Introduction
This Privacy Policy explains how North Sky Cloudworx Ltd (“Norcloud”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you:
• visit or use our website and hosting control panel at norcloud.uk and any subdomain of it (“Norcloud Online”);
• use the Norcloud Instance Monitor mobile application for Android and iOS (the “App”); or
• otherwise interact with us, for example by contacting support or subscribing to a Norcloud-hosted Odoo instance.
Norcloud Online and the App are referred to together in this Policy as the “Services.” This Policy does not cover the content, data, or privacy practices of the individual Odoo business applications that run on a customer's hosted instance — that data is controlled by the customer operating the instance, who acts as data controller for their own end users. Norcloud acts as a data processor / hosting provider for that data, and as data controller for the account, billing, platform, and app data described in this Policy.
2. Who We Are
Norcloud is operated by:
North Sky Cloudworx Ltd
Company number: 17404007
7 Rubin Drive, Crewe, England, CW1 3GF
United Kingdom
Contact us about privacy matters at:
If you are in the UK or EEA, we are the data controller for the personal data described in this Policy, except where stated otherwise.
3. Information We Collect
3.1 Information you give us directly
• Account details: name, email address, phone number, and password (or single sign-on identifier) when you register for Norcloud Online.
• Billing details: company name, billing address, VAT/tax identifiers, and payment information (processed by our payment provider — we do not store full card numbers ourselves).
• Support communications: anything you send us via a support ticket, email, or in-app message.
• Instance/application logins: the login credentials you use to connect the App to your own Norcloud-hosted Odoo instance (a separate credential from your Norcloud account). These are stored encrypted on your device and are transmitted only to the instance you are connecting to.
3.2 Information collected automatically (Norcloud Online)
• Log data: IP address, browser type and version, device type, pages visited, referring URLs, and timestamps.
• Usage and diagnostic data about your hosted instance(s): resource usage, uptime, backup status, and error/crash reports, used to operate and support the hosting service.
• Cookies and similar technologies used for authentication, session management, and (where you consent) analytics. See Section 9.
3.3 Information collected by the mobile App
The App requests the following device permissions. Each is used only for the feature described, and only when you actively use that feature:
• Camera — to let you capture and attach photos to records in your connected Odoo instance (e.g. via the in-app photo capture or the embedded web view's file picker). Photos are sent to the Odoo instance you are working in, not to Norcloud.
• Location (GPS) — to support location-based features such as check-in/check-out and “Use My Location” actions. Location data is sent to the Odoo instance the feature is used against, not stored centrally by Norcloud.
• Push notifications — the App registers a Firebase Cloud Messaging (FCM) device token so your connected Odoo instance(s) can send you push notifications (for example, an approval waiting for you). See Section 6 for how this works.
• Biometric authentication (fingerprint / Face ID), if you enable an app-lock — handled entirely by your device's operating system. Norcloud never receives or stores your biometric data; the App only receives a yes/no confirmation from the OS.
• Device identifiers — a random identifier generated on first install (not your device's IMEI, serial number, or advertising ID), plus device make/model, used to recognise your device across app sessions (e.g. for push notification delivery and the “My Devices” list).
The App also stores, locally and encrypted on your device, the credentials and connection details for the Odoo instance(s) you connect it to. This data does not pass through Norcloud's own servers except where explicitly described in Section 6 (push notification relay) and Section 3.1 (Norcloud account login).
4. How We Use Your Information
We use the information described above to:
• provide, operate, and maintain Norcloud Online and the App;
• create and manage your account, and process billing and payments;
• provide customer support and respond to your enquiries;
• send you service-related communications (e.g. maintenance notices, security alerts) and, where you have agreed, marketing communications;
• deliver push notifications you have configured on your connected instance(s);
• monitor, secure, and improve the performance and reliability of our infrastructure;
• detect, investigate, and prevent fraud, abuse, or security incidents; and
• comply with our legal obligations.
Legal bases (UK/EU GDPR)
• Performance of a contract — to provide the hosting service and App you have signed up for.
• Legitimate interests — to secure our Services, prevent abuse, and improve reliability.
• Consent — for optional features such as location access, camera access, push notifications, and marketing communications, which you can withdraw at any time via your device settings or account settings.
• Legal obligation — for example, retaining billing records for tax purposes.
5. How We Share Information
We do not sell your personal data. We share information only in the following circumstances:
• Service providers who process data on our behalf (e.g. cloud/data-centre providers, payment processors, email delivery providers), under contractual confidentiality and data protection obligations.
• Firebase Cloud Messaging (Google) — used solely to relay push notification delivery to your device. See Section 6.
• Legal and safety reasons — where required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Norcloud, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to your data.
6. Push Notifications and Firebase Cloud Messaging
Push notifications are relayed using Google Firebase Cloud Messaging (FCM). When a feature on your connected Odoo instance sends you a push notification, the notification is routed: your Odoo instance → a Norcloud-operated relay service → Google's FCM → your device. Norcloud's relay does not read, log, or retain the content of notifications beyond what is technically necessary to deliver them, and does not use notification content for any other purpose. Google's handling of data via FCM is governed by Google's own privacy policy.
You can disable push notifications at any time in your device's system settings or within the App.
7. International Data Transfers
All Norcloud hosting infrastructure is currently located within the European Union, so hosting your account, your instance(s), and your data does not itself involve any transfer of personal data outside the EU. The main service provider we rely on that may process data outside the UK/EEA is Google, for delivery of push notifications via Firebase Cloud Messaging (see Section 6). Where such a transfer occurs, we rely on appropriate safeguards recognised under UK/EU data protection law, such as Standard Contractual Clauses or an applicable adequacy decision, to protect your data. Should we introduce hosting or other processing outside the EU in future, we will update this Policy and put equivalent safeguards in place before doing so.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. As a general guide:
• Account and billing data is retained for the duration of your account plus 6 years after closure, to meet accounting obligations.
• Support communications are retained for 6 years.
• Server/application logs are retained for 6 months on a rolling basis.
• The App's locally stored device identifier and instance credentials are retained on your device until you disconnect the instance, revoke the device, or uninstall the App.
9. Cookies
Norcloud Online uses cookies and similar technologies that are strictly necessary for authentication and session management, and, where you consent, for analytics to help us understand how the site is used. You can control cookies through your browser settings; disabling strictly necessary cookies may prevent you from logging in or using parts of the site.
Cookie preferences on norcloud.uk are managed through Odoo's built-in cookie consent banner, which distinguishes between cookies that are strictly necessary (for example, session authentication and security cookies) and optional cookies, which are only set once you accept them via the banner. We currently use Google Analytics, set only under the optional cookie category, to understand aggregate visitor behaviour (such as pages visited, session duration, and traffic sources) so we can improve norcloud.uk. Google's own use of this data is governed by Google's privacy policy. If you decline optional cookies, no Google Analytics cookies are set on your device. The specific cookies in use at any time, together with their purpose and duration, can be reviewed directly via the cookie banner on norcloud.uk.
The Norcloud Instance Monitor app does not itself set any first-party cookies. Several of its screens do, however, embed a web view that loads your connected Odoo instance directly — for example, to open a record or complete an action in Odoo's own interface. Any cookies set during that in-app browsing session belong to, and are controlled by, that Odoo instance, not by Norcloud. As with visiting the instance in a regular web browser, its cookie practices and any consent banner it shows are the responsibility of that instance's own administrator.
10. Security
We use administrative, technical, and physical safeguards designed to protect personal data, including encryption of data in transit (HTTPS/TLS), encrypted local storage of credentials within the App, and access controls on our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
11. Your Rights
If you are located in the UK or EEA, you have the following rights regarding your personal data, subject to certain exceptions:
• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Portability — receive certain data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent (e.g. location, camera, marketing), at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us using the details in Section 2. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local data protection authority.
12. Children's Privacy
Our Services are intended for business use and are not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
13. Third-Party Links and Services
Norcloud Online and the App may link to or integrate with third-party websites and services (including the individual Odoo instance(s) you connect to, which are controlled by you or your organisation, not Norcloud). We are not responsible for the privacy practices of those third parties, and encourage you to review their own policies.
14. Changes to This Policy
We may update this Policy from time to time. We will post the revised Policy on norcloud.uk with an updated effective date, and, for material changes, will make reasonable efforts to notify you (e.g. by email or an in-app notice).
15. Contact Us
If you have questions about this Policy or our data practices, contact us at:
North Sky Cloudworx Ltd
7 Rubin Drive, Crewe, England, CW1 3GF