About this Policy

This Privacy Policy explains how Cloud Alter Inc. ("Cloud Alter", "we", "us") collects, uses, discloses and protects personal information through its websites (cloudalter.com, cloudfonica.com, textenvoy.com and optimasaver.com), its portals, and the services it provides to businesses (Cloudfonica, Optima Saver and TextEnvoy). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Act respecting the protection of personal information in the private sector, and, where they apply, the EU and UK GDPR and U.S. state privacy laws.

1. Our Two Roles

Where we decide how information is used — for example, information about our customers' representatives, website visitors and people who contact us — we are responsible for it, as this Policy describes.
Where we process information for our business customers — the calls and messages our customers route through our platforms, call detail records, phone numbers and message content — we act as their service provider. Our customer is responsible for that information and its own privacy policy applies. Our handling of it is governed by our Data Processing Agreement with that customer. If you received a call or message through our platform, please contact the business that sent it. Where we can identify that business, we will forward your request to it.
Our own fraud and security use of traffic information — we also use limited traffic information (telephone numbers, IP addresses, call and message metadata and fraud signals, but not message content or call audio) for our own fraud and abuse prevention, network security, billing and legal compliance, and may share fraud indicators with carriers and anti-fraud and traceback groups as the law permits. For that use we are responsible in our own right.

2. Information We Collect

Category	Examples	Source
Contact and account	Name, business email, phone number, job title, company, username, password (stored hashed)	You or your employer
Verification (KYC)	Business registration, licences, identity of owners and authorized representatives (including government-issued ID where needed to prevent fraud or comply with law), description of intended use	You, public registries, verification providers
Billing	Billing contact and address, tax numbers, transaction history, partial card details and payment tokens, PayPal account email. Full card numbers are handled by our payment processors, not stored by us	You, payment processors
Communications	Support tickets, emails, Telegram and WhatsApp messages, call notes, feedback	You
Technical and usage	IP addresses, device and browser details, log-in records, portal and API activity, security logs, Client Software telemetry (device model, software version, port counts, throughput, error rates)	Automatically, from your devices and our systems
Traffic metadata for fraud prevention	Calling, called, sender and recipient numbers, IP addresses, call and message records, fraud signals (not message content or call audio)	Our platforms, carriers, anti-fraud and traceback groups
Cookies and similar technologies	See Section 11	Automatically
Marketing preferences	Subscription status and consent records	You

3. How We Use Information

Purpose	Examples	Legal basis (EEA and UK only)
Provide and administer the Services	Create accounts, authenticate users, configure services, provide support	Contract
Billing and collections	Invoice, process payments, meet tax obligations, collect overdue amounts	Contract; legal obligation
Verify customers, prevent fraud and secure the Services	KYC checks, fraud and abuse detection, enforcing our Acceptable Use Policy, answering traceback requests	Legitimate interests; legal obligation
Communicate about the Services	Service, maintenance, incident and policy-change notices	Contract; legitimate interests
Improve the Services	Troubleshooting, analytics and product development, using aggregated or de-identified data where possible	Legitimate interests
Marketing	Newsletters and product news, sent with consent where CASL or other law requires	Consent
Legal compliance and claims	Complying with law, responding to lawful requests, establishing or defending legal claims	Legal obligation; legitimate interests

We use personal information only for these purposes, purposes consistent with them, or as the law permits. If we want to use it for a new purpose, we will ask for consent where the law requires.

4. Consent

We obtain consent as PIPEDA and provincial laws require. Consent may be implied for information you give us to obtain the Services. We obtain consent for marketing messages as CASL and other laws require, and express consent before collecting government-issued ID. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may mean we can no longer provide some or all of the Services.

5. How We Share Information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share it only:

with service providers that act for us — hosting and infrastructure, payment processing (including PayPal and card processors), email delivery, website analytics, spam protection (Google reCAPTCHA on optimasaver.com), and AI tools that help us diagnose technical faults. They are bound by contract to protect it and use it only for our purposes. If you contact us through Telegram or WhatsApp, those apps are run by third parties under their own terms and privacy policies, not under contract with us, so please do not send passwords or other sensitive information through them. The providers that handle our customers' data are listed at cloudfonica.com/legal/subprocessors;
with carriers and interconnection partners, to route traffic on our customers' instructions;
to prevent fraud, with carriers, payment processors, and industry anti-fraud and traceback groups, as the law permits;
for legal and safety reasons, with law enforcement, regulators and courts where the law requires or permits (for example, under a warrant or production order), or to protect rights, property or safety;
in a business transaction, with a prospective buyer, investor or merger partner, under confidentiality obligations and as the law permits;
with professional advisers, such as lawyers, accountants, auditors and insurers; and
with your consent or at your direction.

6. International Transfers

We are based in Ontario, Canada. We and our service providers store and process personal information in Canada, the United States, Singapore and the countries of the hosting regions our customers choose, and our employees in Bangladesh and India may access it to operate and support the Services. Information held outside your province or country is subject to the laws of those places and may be accessible to their courts, law-enforcement and national-security authorities. We use contracts and other measures to protect it.

Québec: before communicating personal information outside Québec, we assess whether it will be adequately protected, as Québec law requires.
Alberta and elsewhere in Canada: to obtain written information about our policies and practices for service providers outside Canada, or to ask how those providers collect, use, disclose or store personal information, contact our Privacy Officer (Section 14).
EEA and UK: the EU and the UK recognize Canada as providing adequate protection for commercial organizations subject to PIPEDA. For onward transfers to other countries, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum.

7. Retention

Information	How long we keep it
Account and contact	While the account is active, plus 2 years
Records of your acceptance of our terms	While the account is active, plus 7 years
Billing and tax records	At least 6 years after the end of the tax year they relate to, as Canadian tax law requires
Verification (KYC)	Copies of ID documents: deleted within 90 days of the check. The result of the check: 5 years after the account closes
Support communications	3 years after the ticket closes
Enquiries from people who are not customers	2 years after the last message
Security and access logs	12 months, or longer when needed for an investigation
Call and traffic records we keep for our own fraud checks	2 years
Marketing consent records	While you are subscribed, plus 3 years
Records of security breaches	At least 5 years (PIPEDA requires 24 months; Québec requires 5 years)
Data we process for customers	As set by the customer's agreement and our Data Processing Agreement

When we no longer need personal information, we securely destroy it or anonymize it as the law requires.

8. Safeguards

We protect personal information with safeguards suited to its sensitivity, including encryption in transit and, where supported, at rest; need-to-know access controls; multi-factor authentication on our hosting control panel; logging and monitoring; vendor due diligence; confidentiality obligations and training for staff; and an incident-response plan. No system is completely secure. If a breach creates a real risk of significant harm to you, or a risk of serious injury under Québec law, we will notify you and the regulators as the law requires.

9. Your Rights

Where you live	Your rights
Anywhere in Canada	Access your personal information, ask us to correct it, withdraw consent, and complain
Québec (in addition)	Receive computerized information in a structured, commonly used technological format; ask us to stop disseminating or de-index it; be told about, and comment on, decisions made exclusively by automated processing
EEA and UK	Access, correction, erasure, restriction, objection (including to direct marketing), portability, withdrawal of consent, and complaint to a supervisory authority
U.S. states with privacy laws (such as California), where those laws apply to us	Know and access, delete, correct, opt out of sale, sharing or targeted advertising (we do none of these), limit use of sensitive information, appeal a refusal, and be free from discrimination for exercising these rights

To exercise a right, email privacy@cloudalter.com. We will verify your identity and respond within 30 days, or tell you if the law allows us more time and why. We normally do not charge; where the law permits, we may charge a minimal fee for copies. Requests about data we process for a customer are referred to that customer. You may use an authorized agent where the law allows.

10. Automated Decisions

We use automated systems to detect fraud, spam and abuse, for example to flag sign-ups for review, block suspicious traffic patterns, or restrict an account pending review. When we make a decision about you based exclusively on automated processing, we will tell you so no later than when we inform you of the decision. On request, we will tell you what personal information was used and the reasons and main factors behind the decision, and you may submit observations to a staff member who can review it.

11. Cookies and Similar Technologies

We use essential cookies and browser storage for sign-in, security and display choices. Analytics cookies are off by default and are used only with your consent, which you can give or withdraw through the cookie banner or the "Cookie settings" link on cloudfonica.com. We honour Global Privacy Control signals where the law requires. Our current cookie list is at cloudfonica.com/legal/cookies.

12. Children

Our Services are for businesses and are not directed to anyone under 18. We do not knowingly collect children's personal information.

13. Marketing Messages

We send commercial electronic messages only with consent, as CASL requires. Every message includes an unsubscribe link, and we act on unsubscribe requests within 10 business days.

14. Privacy Officer and Contact

Our person in charge of the protection of personal information is our Privacy Officer, whom you can reach at the contacts below.

Email: privacy@cloudalter.com · Mail: Cloud Alter Inc., Attention: Privacy Officer, 20 Teesdale Place, Toronto, Ontario M1L 1L1, Canada · Phone: +1 647-558-8722 · Our governance policies for personal information are available on request.

15. Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner of Alberta or of British Columbia, your EU or UK data-protection authority, or your U.S. state attorney general or the California Privacy Protection Agency.

16. Changes to this Policy

We will post updates here with a new effective date. Where practicable, we will give at least 30 days' notice of material changes by email or in the portal. Previous versions are available at cloudfonica.com/legal/archive.

Privacy Policy.