Privacy Policy
What personal data we collect about you as a G7Cloud customer or visitor, why we hold it, how long we keep it, who we share it with, and the rights you have under UK GDPR.
1. Two different relationships, and which one this covers
There are two distinct sets of personal data in a hosting relationship, and mixing them up is how privacy policies become useless. This document is clear about which is which.
The data inside your site. Your customer records, your order history, your mailing list, your email, your uploaded files. You decide what goes there and why, which makes you the controller and us the processor. We hold it, protect it and back it up on your instructions, and we do not use it for anything else. Those terms are in our Data Processing Agreement, not here.
The data about you as our customer. Your account, your billing records, your conversations with support, and the operational logs we keep to run and secure the platform. We decide the purposes for that data, which makes us the controller. This document covers that.
If you are a visitor to a website hosted on G7Cloud rather than a G7Cloud customer, the site owner is the controller for your data. Contact them. We will pass on a request if you send it to us and we can identify the site.
2. What we collect
| What | Where it comes from |
|---|---|
| Name, email address, and any company name or telephone number you give us | You, when you create an account or contact us |
| Billing address and VAT number where applicable, plus invoices and payment history | You and Stripe. Card numbers are captured by Stripe and never reach our systems. |
| Account credentials | You. Passwords are stored as salted hashes and cannot be read by us or recovered. |
| Support tickets, emails and any attachments you send | You, when you contact support |
| Technical and security logs: IP address, user agent, pages requested, times, and the security decision taken for a request | Automatically, when you use the dashboard or when traffic reaches a site we host |
| Records of administrative actions taken on your account | Automatically, as a security audit trail |
| Prompts you submit to the AI assistant or website builder | You, only when you choose to use those features |
We do not buy personal data, we do not enrich your record from data brokers, and we do not track you across other websites.
3. Why we hold it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, providing the services, and giving you support | Performance of a contract |
| Taking payment, issuing invoices, chasing failed payments | Performance of a contract, and legal obligation for tax records |
| Sending service messages you cannot opt out of while you have an account: password resets, security alerts, billing notices, planned maintenance, incident notifications | Performance of a contract, and legitimate interests in operating the service safely |
| Keeping the platform secure: detecting attacks, filtering hostile traffic, investigating abuse, keeping an audit trail | Legitimate interests in protecting our customers, our platform and third parties |
| Keeping accounting records | Legal obligation |
| Marketing email about G7Cloud, where you have asked for it | Consent, which you can withdraw at any time |
| Answering a request you make to the AI assistant or builder | Performance of a contract |
Where we rely on legitimate interests we have considered your rights and freedoms and concluded that the processing is proportionate to the purpose. You can ask us for that assessment, and you can object to the processing, at privacy@g7cloud.com.
4. What we do not do with it
Stated plainly, because these are the questions people actually want answered.
- We do not sell personal data. Not to anyone, in any form, ever.
- We do not share it with advertising networks and we run no advertising or cross-site tracking technology on this website.
- We do not read your site content, your databases or your email except where you ask us to in order to fix something, or where we are compelled by law.
- We do not use customer content to train AI models, and we do not allow our sub-processors to do so.
- We do not profile you or use automated decision-making that produces legal or similarly significant effects.
- We do not move your hosting data outside the UK. Your sites, databases and mailboxes are hosted on infrastructure we operate in the United Kingdom, with backup copies in the UK and EEA.
5. AI features
The AI Website Builder and the dashboard assistant are powered by Anthropic, which processes in the United States under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Nothing is sent unless a person chooses to send it. No part of the platform passes your site content, files, databases, email or visitor data to an AI provider in the background or for our own purposes. Content leaves only when a user in your account uses one of those two features, and only what is needed to answer that request.
Enterprise customers can have AI features disabled at account level, after which no user in the organisation can invoke them and nothing can reach an AI provider by any route. Ask at privacy@g7cloud.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account record and its content | While the account is open. See deletion below. |
| Billing and accounting records | 6 years after the last transaction, as UK tax law requires. This survives account deletion because we are legally obliged to keep it. |
| Support correspondence | 3 years from the close of the ticket. |
| Request and security logs | 14 days. |
| Email send records | Metadata 90 days. Message bodies stripped after 30 days. |
| Administrative audit log | The life of the account. |
| Backup copies | On the backup retention cycle. See DPA clause 10 for why these cannot be deleted on demand. |
8. How we protect it
Connections are encrypted with TLS. Passwords are stored as salted hashes. Two-factor authentication is available on every account and we recommend turning it on. API keys are scoped to the permissions you select. Every site runs in its own container with its own database, so one customer cannot reach another's data through the platform. Administrative actions are recorded in an audit log. Backups are encrypted before they leave the machine that creates them and are held on an append-only service that a compromised server cannot delete from.
The full description is in our Security Statement.
9. Your rights
Under the UK GDPR you have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, data portability, and objection, including to direct marketing at any time. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects, which we do not make.
To exercise any of them, email privacy@g7cloud.com. We will respond within one month. We will not charge you, and we will not make you justify the request.
Deleting your account. You can request deletion from the dashboard or by email. The account is then permanently deleted after a 7 day cooling-off period, which exists so that a deletion made in error, or by someone who should not have had access, can be reversed. After that the account and its associated records are removed. Data we are legally required to keep, such as invoices, is retained for its statutory period and nothing else.
You have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right, but it is your right either way and you do not need our permission to use it.
10. Children
The services are for business use and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact privacy@g7cloud.com and we will delete it.
11. Changes and contact
We will update this policy when what we do changes. Material changes are notified by email to account holders before they take effect, and the version and date at the top of this document always reflect the current text.
Privacy questions and rights requests: privacy@g7cloud.com. Security reports: security@g7cloud.com. Anything else: support@g7cloud.com.
The controller for the personal data described in this policy is G7CLOUD ENTERPRISE LTD, a company registered in England and Wales under number 16828080, whose registered office is at 71-75 Shelton Street, London, England, WC2H 9JQ, trading as G7Cloud.