Draft. This describes what the platform genuinely does with data today, but it has not been reviewed by a lawyer. Have it checked against the law where CloudOut Studios is registered before you take real users.
Privacy policy
Last updated 12 August 2026
Who we are
CloudOut Studios operates a marketplace connecting people with creative studios, workshops and production spaces, and a shop for original artwork. If you want to ask about anything here, contact us at the address in the footer.
What we collect
When you create an account we store your name, email address and, if you give it, your phone number. Passwords are never stored: we keep only a bcrypt hash, which cannot be reversed into the original.
If you sign in with Google we receive your name, email address, Google account id and profile picture. We do not receive your Google password and have no access to anything else in your Google account.
If you list a studio or an artwork we store what you enter, including the address of the space and the contact details you give for it. If you place an order we store the delivery name, phone number and address you provide.
What is public and what is not
A published listing shows its name, category, city and area, description, facilities, equipment, rates and photographs. The street address and the contact details on a listing are not published. They are held for our team and released to a client only once a booking is confirmed.
Delivery details on an order are visible to you and to CloudOut staff. They are not shown to the seller before an order is confirmed.
Why we hold it
To run your account, to review listings before they are published, to put buyers and sellers in touch once a transaction is agreed, and to arrange payment and delivery. We do not sell personal information, and we do not use it for advertising.
We send transactional email only: confirming your address, resetting your password, and messages about your listings and orders. There is no marketing list.
Cookies
One cookie, holding a random session token so you stay signed in. It ishttpOnly, so page scripts cannot read it, and the database stores only a hash of the token rather than the token itself. There is no analytics or advertising cookie.
How long we keep it
Account data is kept while your account exists. Order records are kept after that, since they are a record of a transaction between two parties. Sessions expire after 30 days; confirmation links after 24 hours; password reset links after one hour.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. Write to us and we will act within a month. Deleting an account removes your listings; order history is retained where we are required to keep a record of a transaction.
Where it is processed
Data is held on servers operated by our hosting and database providers. Depending on the region chosen, that may be outside the country you live in.
Changes
If this policy changes in a way that matters, we will say so on this page and date it.