Privacy Policy

Who we are and scope

Tucloud operates cloud hosting, domain, deployment, account management, billing, and artificial intelligence services from Puerto Plata, Dominican Republic. This Privacy Policy applies to tucloud.app, the Tucloud Dashboard, Kuro, support interactions, and related services that link to this policy.

Customers are responsible for the personal data they collect through websites, applications, databases, email accounts, and other content hosted on Tucloud. For that data, the customer generally acts as controller and Tucloud acts as a service provider or processor under the customer's instructions.

Information you provide

We collect account and profile information such as name, email address, company, password credentials handled by our authentication provider, selected plan, and support communications.

If you choose Google Sign-In, we receive your Google account identifier, email address, name, profile image, and authentication metadata. We use this information only to create or authenticate your Tucloud account, display your account profile, maintain session security, and provide the services you request. We do not use Google account data for advertising, sell it, or access Google contacts, Drive files, or other Google services.

For domain registrations, we collect registrant contact information including name, company, postal address, country, telephone number, and email address. For paid services, payment providers process payment card, bank, or wallet details and send us transaction identifiers, customer identifiers, subscription status, billing events, and limited payment metadata.

When you use Kuro, we process prompts, instructions, project files or code you submit for revision, generated outputs, and feedback. When you deploy a project, we process repository selections, branches, build settings, domains, deployment metadata, logs, and environment variable names and encrypted values.

Information collected automatically

We collect IP addresses, request timestamps, browser and device information, authentication events, security signals, service logs, bandwidth and storage usage, deployment health, DNS and TLS status, and interactions needed to operate and protect the services.

Kuro uses an IP-based request counter to prevent abuse. Kuro projects, prompts, generated code, versions, and message history are stored in the user's browser local storage unless the user clears them. A signed Kuro session cookie may retain account identifiers, email, name, company, and plan for up to seven days.

How we use information

We use information to create and secure accounts, authenticate users, provide hosting and deployment services, register and manage domains, process subscriptions, monitor resource limits, provide support, prevent fraud and abuse, troubleshoot incidents, improve reliability, and comply with legal obligations.

We process information as necessary to perform our contract with you, pursue legitimate interests such as security and service improvement, comply with law, protect vital interests in emergencies, and obtain consent where applicable law requires it.

Artificial intelligence processing

Kuro sends prompts and relevant portions of existing project content to third-party model gateways and AI services to plan, generate, revise, and summarize output. Depending on availability, those providers may include HeckAI, Koala, OpenCode, and llmproxy or FreeChat, and the underlying models they make available.

Do not submit passwords, payment data, government identifiers, health information, confidential client data, or other sensitive personal information to Kuro. Third-party AI providers may process submitted content under their own terms and privacy practices. See the AI Product Terms and Subprocessor List for more detail.

How we disclose information

We disclose information to service providers that support authentication, databases, infrastructure, payments, domain registration, source control, deployments, security, certificates, support, and AI generation. These providers receive only the information reasonably necessary for their role.

We may disclose information in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections. We do not sell personal information or share it for cross-context behavioral advertising.

Legal requests and safety

We may preserve or disclose information when required by applicable law, a valid court order, subpoena, or other binding legal process. We may also disclose limited information when we reasonably believe it is necessary to prevent imminent harm, investigate fraud or cybercrime, protect users or infrastructure, or enforce our agreements.

We assess requests for legal validity and scope. Emergency disclosures are limited to information we believe is necessary for the emergency and are documented where legally permitted.

International transfers

Tucloud and its service providers may process information in the Dominican Republic, the United States, Europe, and other countries where providers operate. Those countries may have different data protection laws from your country.

Where required, we use contractual, organizational, or legal safeguards for international transfers. Use of a service from another country does not reduce any mandatory rights available under applicable law.

Retention and deletion

We retain account, service, and customer content while an account is active and for a reasonable period afterward to complete deletion, restore service, prevent fraud, resolve disputes, and meet legal obligations. Billing, tax, domain registration, security, and abuse records may be retained longer where law or legitimate operational needs require it.

Backups and logs may persist for limited periods after deletion before being overwritten. Kuro browser-stored projects remain on the user's device until the user deletes them or clears browser storage.

Security

We use access controls, encrypted connections, restricted administrative privileges, row-level database controls, encrypted environment variable storage, infrastructure isolation, firewalls, monitoring, backups, and other safeguards designed to protect information.

No online service can guarantee absolute security. Customers remain responsible for securing their accounts, credentials, source repositories, applications, dependencies, and hosted content, and for maintaining appropriate independent backups.

Your privacy rights

Subject to applicable law, you may request access, correction, updating, deletion, portability, objection, restriction, withdrawal of consent, or information about how we process your personal data. Residents of the Dominican Republic may exercise rights recognized by Law No. 172-13. Other jurisdictions may provide additional rights.

Send requests to legal@tucloud.app. We may verify your identity and ask for information needed to locate the relevant account. You may also lodge a complaint with the competent data protection or consumer authority in your jurisdiction.

Children

The services are not directed to children under 13. Users who have not reached the age at which they can consent to data processing or enter a binding contract in their jurisdiction may use the services only with authorization from a parent or legal guardian.

If we learn that personal information was collected from a child without appropriate authorization, we will take reasonable steps to delete it and may suspend the associated account.

Changes and contact

We may update this policy as our services, providers, or legal obligations change. Material changes will be announced through the services or another reasonable channel. Questions and privacy requests may be sent to legal@tucloud.app. Tucloud is based in Puerto Plata, Dominican Republic.