Privacy Policy

Contents

1. Introduction

CloudSys LLC ("CloudSys," "we," "us," or "our") respects privacy and is committed to handling personal information responsibly. This Privacy Policy describes the personal information we collect, how and why we use it, the circumstances in which we disclose it, the safeguards we use, how long we retain it, and the choices and rights that may be available to you.

CloudSys provides business-to-business technology consulting and related services focused on NetSuite, enterprise resource planning (ERP), optimization, managed support, custom development, automation, and artificial intelligence. Our website is intended primarily for business users, prospective customers, customer representatives, vendors, partners, and other professional contacts.

This Policy should be read together with our Cookie Policy and any service-specific or contractual privacy terms that apply to a particular CloudSys engagement.

2. Scope and Our Privacy Roles

2.1 When this Policy applies

This Policy applies when CloudSys determines why and how personal information is processed in connection with:

• visits to cloudsysllc.com and related CloudSys webpages that link to this Policy;
• contact, assessment, and consultation requests submitted through the website;
• use of the CloudSys AI assistant made available on the website;
• business communications with prospective and existing customers, vendors, partners, and professional contacts; and
• other CloudSys business activities for which this Policy is presented or referenced.

2.2 Customer-controlled service data

CloudSys may access or process personal information contained in a customer’s NetSuite environment, ERP system, integration, support workflow, automation, or other customer-controlled environment while providing contracted services. In those circumstances, CloudSys generally processes that information on the customer’s documented instructions as a service provider, contractor, or processor. The customer determines the purposes of that processing and is ordinarily responsible for the privacy notice and choices provided to the individuals whose information is involved.

If your request concerns personal information that CloudSys processes solely on behalf of one of our customers, we may direct your request to that customer or assist the customer in responding, as required by applicable law and our agreement with the customer.

2.3 What this Policy does not cover

This Policy does not govern the independent privacy practices of third-party websites, platforms, or services that you choose to use. It also does not replace a customer’s own privacy notice for information that the customer controls and asks CloudSys to process on its behalf.

3. Definitions

For purposes of this Policy:

• "Personal information" or "personal data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an identifiable individual or household, where applicable law uses such concepts.
• "Process" or "processing" means any operation performed on personal information, such as collecting, using, storing, disclosing, transmitting, organizing, or deleting it.
• "Customer" means an organization that engages CloudSys to provide consulting, support, development, automation, AI, or related services.
• "Service Data" means data CloudSys processes on behalf of a customer in connection with providing contracted services.
• "AI assistant" means the CloudSys website assistant that uses artificial intelligence to provide general educational responses about CloudSys-related technology topics.

4. Information We Collect

The categories of information we collect depend on how you interact with CloudSys. We apply data-minimization principles and seek to collect information that is reasonably necessary for the relevant business, security, support, or legal purpose.

4.1 Categories of personal information

5. Information You Provide

5.1 Contact and assessment information

When you submit an assessment or contact request, we may collect your name, work email address, company name, telephone number (including country code), company website, and the description you provide of your NetSuite, ERP, automation, or business-process requirements.

Please provide only information that is relevant to your request. Do not submit passwords, API keys, authentication tokens, government identification numbers, bank or payment-card information, health information, confidential customer or employee records, or other sensitive or highly confidential material through a general website form.

5.2 Communications

If you contact us by email, telephone, through the website, or through another business channel, we may process the content of the communication, associated contact details, and related business records to respond, maintain the relationship, document requests, and protect our legal and business interests.

6. Information Collected Automatically

When you use the website, hosting and security infrastructure may automatically generate technical information such as IP address, browser or user-agent information, requested URLs, request times, server errors, security events, and similar operational records. We use this information to deliver the site, maintain reliability, diagnose problems, secure our systems, prevent abuse, and protect CloudSys, our customers, and users.

The website is hosted through GoDaddy/cPanel using Apache and PHP. Hosting infrastructure may process normal server, access, error, and security information as part of providing and protecting the hosting service. Retention of hosting logs depends on the applicable hosting configuration and operational requirements.

7. Contact and Assessment Requests

Website assessment submissions are processed by the CloudSys PHP backend and transmitted through Resend’s email-delivery API to CloudSys’s configured business email environment. Resend therefore processes the information needed to deliver the message, which may include the form contents, email address, message metadata, and delivery information.

CloudSys uses assessment information to review the request, respond to you, arrange or discuss a consultation, understand your business requirements, and protect the submission process from misuse. Based on our current website practice, submitting an assessment request does not automatically enroll you in unrelated promotional email campaigns.

7.1 Duplicate-submission and anti-spam controls

To reduce automated or duplicate submissions, the form uses a hidden honeypot field, server-side field validation, request-size limits, Cloudflare Turnstile, and a short-lived duplicate-submission mechanism. The duplicate-submission control combines the visitor’s email address and IP address and cryptographically hashes the result. The temporary record is used for approximately one hour and does not contain the form message, name, phone number, or company name.

After a successful submission, the visitor’s browser also stores a submission timestamp in local storage for approximately one hour so the form does not immediately reappear after a page refresh. The local-storage value does not contain the visitor’s name, email address, phone number, company, or message.

8. Cloudflare Turnstile and Security Verification

CloudSys uses Cloudflare Turnstile as a necessary website security and fraud-prevention service. Turnstile is used before a contact-form submission and before a visitor sends the first message to the CloudSys AI assistant. Its purpose is to distinguish legitimate visitors from automated or abusive activity and to protect CloudSys systems and forms.

For server-side verification, CloudSys sends the Turnstile response token and may send the visitor’s IP address to Cloudflare’s verification service. Cloudflare may independently process technical and security information such as IP address, browser or user-agent characteristics, device and connection signals, origin information, interaction data, and other security signals in accordance with its privacy terms.

We treat Turnstile as a necessary security technology rather than an advertising or behavioral analytics tool. Cloudflare may use cookies, local storage, or other browser technologies where necessary to perform security verification.

9. CloudSys AI Assistant

9.1 Purpose and scope

The website includes the CloudSys Guide, an AI assistant designed to provide short, general educational information about topics such as NetSuite, ERP systems, saved searches, SuiteCloud, SuiteScript, accounting workflows, inventory, integrations, business-process automation, and AI agents.

The AI assistant is not a human consultant and is not intended to provide customer-specific consulting, legal advice, security credentials, pricing commitments, or a diagnosis of your actual NetSuite or ERP environment. AI-generated responses may be incomplete, inaccurate, or outdated and should be treated as general informational material. Important business, technical, financial, legal, security, or implementation decisions should be independently verified.

9.2 Information processed by the AI assistant

After Cloudflare verification, a chatbot message is submitted to the CloudSys PHP backend. Questions that are clearly unrelated or that require customer-specific knowledge are generally handled locally through the website’s topic and context controls and may be redirected without a model request. Relevant questions may be sent through OpenRouter’s AI-routing service to an AI-model provider approved by CloudSys for response generation.

A model request may include your current message, CloudSys system instructions defining the assistant’s permitted behavior, and up to six recent chat messages needed to maintain short conversational context. CloudSys does not intentionally append information from your assessment form—such as your email address, phone number, company name, or form message—to the AI request unless you independently type that information into the chat.

Automated filtering cannot guarantee perfect classification. Information you type into a relevant chatbot question may therefore be processed by OpenRouter and the selected AI-model provider to generate the response.

9.3 Do not submit confidential or sensitive information

Do not enter passwords, security credentials, API keys, authentication tokens, personal customer or employee records, financial account information, payment-card data, health information, government identifiers, tax records, confidential production data, trade secrets, or other sensitive or highly confidential information into the AI assistant.

9.4 Temporary chat context and rate limiting

The browser does not persist the full chat conversation in browser storage. Refreshing the page discards the browser’s chat-session token, and the refreshed page cannot retrieve the previous conversation through that token.

On the server, a temporary session is associated with a cryptographic hash derived from the visitor’s IP address. The application treats the session as valid for up to approximately 30 minutes and keeps no more than six recent messages for short conversational context. A verified chat is limited to 15 messages, and a separate hashed-IP mechanism limits model-backed requests to 30 per hour. Expired temporary records are treated by the application as invalid and remain subject to the hosting system’s temporary-file cleanup process.

9.5 AI service providers

CloudSys uses OpenRouter to route eligible chatbot requests to an approved underlying AI-model provider. OpenRouter and the selected model provider may process chatbot content and limited technical or usage information as necessary to route the request, generate a response, prevent abuse, secure the service, and meet contractual or legal obligations. The specific underlying provider may vary based on CloudSys’s approved production configuration.

CloudSys does not authorize the AI assistant to intentionally use contact-form information as hidden model context. Where available and appropriate, CloudSys seeks to configure AI services to minimize retention and restrict use of CloudSys content for provider model training, subject to the selected provider’s contractual terms and technical settings.

10. Cookies and Similar Technologies

CloudSys uses limited cookies, local storage, and similar technologies for consent preferences, necessary website functionality, and security. Please see our Cookie Policy for additional details.

10.1 CloudSys consent cookie

The website uses one known first-party consent cookie named cloudsys_cookie_consent_v4. It records either "all" or "necessary" and remains in the browser for up to one year. Its purpose is to remember the visitor’s cookie preference so the consent interface does not need to appear on every visit.

10.2 Current absence of advertising and analytics tracking

CloudSys does not currently activate website analytics tracking, advertising cookies, behavioral advertising technologies, or social-media tracking pixels. Selecting "Accept All" therefore does not currently cause advertising or analytics trackers to load; it primarily records the visitor’s preference for optional technologies that may be introduced in the future. If CloudSys later introduces optional analytics or marketing technologies, we intend to update our disclosures and apply appropriate consent controls before those technologies are activated where required by law.

11. Business, Customer, Vendor, and Service Data

11.1 Business relationship information

CloudSys may process business contact and relationship information about customers, prospective customers, vendors, contractors, partners, and their representatives. This may include names, business contact information, role or affiliation, contractual records, invoices, relationship history, and communications needed to administer the business relationship.

11.2 Service Data processed for customers

CloudSys’s NetSuite, ERP, support, development, automation, and AI engagements may require authorized access to customer-controlled systems. Depending on the engagement, those systems may contain customer, employee, user, supplier, invoice, accounts-payable, accounts-receivable, purchasing, financial, operational, log, support, or other records. CloudSys does not determine those categories merely because it provides technical services; the customer generally determines what information is present and why it is processed.

Where CloudSys processes Service Data solely on a customer’s instructions, our obligations are governed primarily by the applicable customer agreement, data-processing terms, and law. We seek to use Service Data only as necessary to provide, support, secure, or improve the contracted service in a manner permitted by the customer relationship and applicable law.

12. Sensitive Information

CloudSys does not intentionally request sensitive personal information through the public website form or AI assistant. Because free-text fields can be used to submit arbitrary content, visitors should not provide sensitive or highly confidential information unless CloudSys has expressly requested it through an appropriate secure channel and there is a legitimate business need.

Customer-controlled systems may contain sensitive information depending on the customer’s business and configuration. When CloudSys processes such information as Service Data, we do so subject to the customer’s instructions, applicable contractual restrictions, and appropriate safeguards.

13. How We Use Personal Information

Depending on the context, CloudSys uses personal information for the following purposes:

• provide, operate, maintain, and secure the website;
• review and respond to contact, assessment, consultation, and business requests;
• communicate with prospective and existing customers and other business contacts;
• provide consulting, development, support, automation, and related services;
• provide general informational responses through the AI assistant;
• verify legitimate users, prevent bots, rate-limit abusive requests, detect fraud or misuse, and protect systems;
• administer contracts, invoices, vendor relationships, and other business operations;
• maintain records needed for customer service, legal compliance, accounting, security, and dispute resolution;
• enforce agreements and protect the rights, property, security, and safety of CloudSys, our customers, users, and others;
• comply with legal obligations, lawful requests, court orders, and regulatory requirements; and
• perform other compatible or legally permitted purposes that are disclosed at the time of collection or authorized by you.

14. Legal Bases Where Applicable

Where the GDPR, UK GDPR, or another law requires CloudSys to identify a legal basis for processing, the basis depends on the context. We may rely on:

• Contract or pre-contractual steps — where processing is necessary to respond to a request made in anticipation of a business engagement or to perform an agreement with you or the organization you represent.
• Legitimate interests — where reasonably necessary to operate and secure the website, respond to business inquiries, manage professional relationships, prevent misuse, maintain records, improve business operations, or protect CloudSys and others, provided those interests are not overridden by your rights and interests.
• Legal obligations — where processing is necessary to comply with applicable law, regulatory duties, tax or accounting obligations, court orders, or lawful government requests.
• Consent — where applicable law requires consent, including for optional cookies or technologies if CloudSys later introduces them, or where we otherwise expressly ask for consent.
• Other lawful bases — where another lawful basis is available and appropriate under the law that applies to the particular processing.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal.

15. How We Disclose Personal Information

CloudSys does not disclose personal information indiscriminately. We may disclose personal information to the following categories of recipients where reasonably necessary for the purposes described in this Policy:

• hosting and infrastructure providers;
• website-security and anti-abuse providers;
• email-delivery and business-communications providers;
• AI routing and approved AI-model providers for eligible chatbot messages;
• professional advisers such as attorneys, accountants, auditors, insurers, and consultants where appropriate;
• CloudSys customers where information relates to a customer-controlled service or request;
• government authorities, regulators, courts, law enforcement, or other parties where disclosure is required or permitted by law or reasonably necessary to protect rights and safety;
• parties involved in a merger, financing, acquisition, reorganization, sale of assets, insolvency process, or similar corporate transaction; and
• other recipients at your direction or with your authorization.

Service providers that process personal information for CloudSys are expected to use it for the contracted purpose and to protect it in accordance with applicable contractual and legal requirements.

16. Service Providers and Technology Partners

The website and related business processes use service providers that may process personal information on CloudSys’s behalf or as necessary to provide their services. Current or planned website-related providers include:

CloudSys may change service providers as our systems and services evolve. We evaluate the privacy and security implications of material changes and update this Policy or related disclosures when required.

17. International Data Transfers

CloudSys is based in the United States. Our service providers, technology partners, customers, or their subprocessors may process information in the United States or other countries, and those countries may have privacy laws that differ from the laws where you live.

Where applicable law restricts international transfers, CloudSys seeks to use a lawful transfer mechanism appropriate to the circumstances, which may include adequacy decisions, contractual safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, participation in an approved transfer framework where available and applicable, or another mechanism recognized by law.

The exact transfer mechanism depends on the countries, service providers, customer arrangements, and law applicable to the specific processing.

18. Data Retention

CloudSys retains personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide or support services, maintain appropriate business and security records, comply with legal or contractual obligations, resolve disputes, enforce agreements, and protect rights and systems. Retention therefore varies by category and context.

18.1 Short-lived website records

• The contact-form duplicate-submission hash is used for approximately one hour.
• The browser’s successful-form-submission local-storage timestamp is used for approximately one hour.
• The AI assistant’s server-side session is treated as valid for up to approximately 30 minutes and retains no more than six recent messages for short conversational context.
• The AI request-rate record uses a short-lived hashed identifier to enforce an hourly limit.
• The cloudsys_cookie_consent_v4 preference cookie remains for up to one year unless removed sooner by the user or browser.
• Expired temporary server records are treated as invalid by the application and are subject to the hosting system’s temporary-file cleanup process.

18.2 Business communications and vendor records

Contact-form submissions delivered into CloudSys’s business email environment may be retained longer than the temporary website security records. We retain business inquiries, customer relationship records, vendor records, contracts, accounting information, and related communications based on the ongoing relationship, operational needs, applicable limitation periods, legal obligations, security requirements, and legitimate recordkeeping needs.

18.3 Service-provider retention

Third-party providers may maintain their own service logs, delivery records, security records, backups, or other information in accordance with their contractual terms, technical configuration, and legal obligations. CloudSys seeks to configure providers to minimize retention where appropriate, particularly for AI content, but exact retention can vary by provider and service configuration.

19. Data Security

CloudSys uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure. The safeguards used for the website include HTTPS, security headers, server-side validation, request-size limits, bot detection, Cloudflare Turnstile, temporary rate limiting, cryptographic hashing for certain short-lived security identifiers, and storage of service API keys in private server configuration rather than exposing secret keys to browser JavaScript.

Access to personal information is intended to be limited to people and service providers with a legitimate business need. We also seek to apply appropriate access, credential, configuration, and operational controls to the systems used to provide our services.

No security measure can guarantee absolute security. You should use appropriate caution when sending information over the internet and should not send passwords, credentials, or highly sensitive information through ordinary website forms or chatbot interfaces.

20. Marketing Communications

CloudSys may communicate with you about an inquiry, consultation, service, contract, or business relationship. These service or business communications are different from general promotional marketing.

Based on our current website practice, submitting a contact or assessment request does not automatically subscribe you to unrelated promotional email campaigns. If CloudSys introduces broader marketing programs, we will provide appropriate disclosures and choices and will comply with applicable marketing laws.

If you receive a promotional communication from CloudSys and no longer wish to receive it, you may use the unsubscribe method in the communication or contact us. We may retain limited suppression information necessary to honor an opt-out.

21. Sale, Sharing, Targeted Advertising, and Profiling

CloudSys does not currently sell personal information collected through the website, use website information for cross-context behavioral advertising, or operate third-party advertising or analytics tracking technologies on the site. We do not currently use the website to build advertising profiles of visitors across unrelated websites or services.

If CloudSys materially changes these practices, we will update the relevant privacy and cookie disclosures and provide legally required opt-out or consent controls before or when the new processing begins, as required by applicable law.

22. Your Privacy Rights

Depending on where you live and the law that applies to CloudSys’s processing, you may have rights regarding your personal information. These may include the right to:

• request access to personal information we hold about you;
• request correction of inaccurate personal information;
• request deletion of personal information;
• receive a portable copy of certain personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• opt out of certain sale, sharing, targeted advertising, or profiling activities where applicable;
• appeal a decision on a privacy request where applicable state law provides an appeal right; and
• complain to an applicable privacy or data-protection authority.

These rights are not absolute. Applicable law may permit or require CloudSys to retain or continue processing information for purposes such as security, fraud prevention, legal compliance, exercising legal rights, completing transactions, maintaining business records, or honoring customer instructions.

22.1 How to exercise a right

To make a privacy request, contact CloudSys using the methods in Section 31 and clearly identify the request as a privacy request. Please provide enough information for us to understand the request and locate the relevant records. We may need to verify your identity or authority before completing certain requests.

If you are making a request about information CloudSys processes solely on behalf of a customer, we may direct you to that customer or coordinate with the customer, as appropriate.

23. California Privacy Rights

If the California Consumer Privacy Act, as amended (CCPA), applies to CloudSys and to the personal information at issue, California residents may have rights to know/access, correct, delete, and obtain information about certain disclosures, as well as rights relating to sale, sharing, sensitive personal information, and non-discrimination, subject to statutory exceptions and applicability requirements.

CloudSys does not currently sell personal information collected through the website or share such information for cross-context behavioral advertising. We also do not currently use website analytics or advertising trackers that would constitute targeted advertising or cross-context behavioral advertising under our present architecture.

Where California law requires us to recognize an authorized agent, we may request evidence of the agent’s authority and may take reasonable steps to verify the request.

CloudSys may also process personal information as a service provider or contractor on behalf of customers. When we do so, the customer is generally responsible for responding to consumer requests regarding that customer-controlled information, and CloudSys assists as required by contract and law.

24. Other U.S. State Privacy Rights

Residents of certain U.S. states may have privacy rights under state comprehensive privacy laws, depending on whether the particular law applies to CloudSys and the processing at issue. These rights can include access, correction, deletion, portability, opt-out rights concerning certain sales, targeted advertising or profiling, and an appeal right following denial of a request.

CloudSys evaluates applicability based on the relevant statutory thresholds, exemptions, type of processing, and our role as controller, processor, service provider, or contractor. Nothing in this Policy is intended to imply that every state comprehensive privacy statute applies to every CloudSys activity.

25. European and UK Privacy Rights

Where the GDPR, UK GDPR, or similar European data-protection law applies to CloudSys’s processing of your personal data, you may have rights including:

• access to your personal data;
• correction of inaccurate or incomplete data;
• erasure in circumstances provided by law;
• restriction of processing;
• objection to processing based on legitimate interests and objection to direct marketing;
• data portability for certain information processed by automated means under contract or consent;
• withdrawal of consent where consent is the legal basis; and
• the right to lodge a complaint with a competent supervisory authority.

CloudSys may request information necessary to verify identity and process the request. Legal rights are subject to conditions and exceptions under the applicable law.

26. Global Privacy Control and Do Not Track

26.1 Global Privacy Control

Global Privacy Control (GPC) is a browser or device signal designed to communicate certain privacy opt-out preferences. Because CloudSys does not currently sell website personal information or use it for cross-context behavioral or targeted advertising, a GPC signal does not change our current website advertising practices. If CloudSys later engages in processing for which applicable law requires recognition of GPC or another universal opt-out mechanism, we intend to honor qualifying signals as required by law.

26.2 Do Not Track

Some browsers offer a Do Not Track (DNT) preference. There is no single universally adopted legal or technical standard that requires websites to respond to DNT in the same way. CloudSys does not currently operate behavioral advertising or analytics tracking on the website, so DNT does not presently change such tracking behavior on our site.

27. Children’s Privacy

CloudSys’s website and services are designed for business and professional use and are not directed to children. We do not knowingly use the website to solicit personal information from children. If you believe a child has provided personal information to CloudSys through the website, contact us so that we can assess the situation and take appropriate action.

28. Third-Party Websites and Services

The website may contain links to third-party websites, resources, or services. CloudSys does not control the privacy or security practices of those third parties. Their processing is governed by their own terms and privacy notices. We encourage you to review those notices before providing personal information to a third party.

29. Business Transactions

If CloudSys is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, personal information may be disclosed to advisers, counterparties, or successors as reasonably necessary to evaluate, negotiate, or complete the transaction and subject to applicable confidentiality and legal requirements.

30. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or privacy practices. When we make changes, we will update the effective or last-updated date and provide additional notice where required by applicable law. Material changes to website tracking, AI processing, or data-use practices will be reflected in the relevant privacy or cookie disclosures.

31. Contact Us

Questions or requests concerning this Privacy Policy or CloudSys’s handling of personal information may be submitted through the contact options available on cloudsysllc.com or by mail to:

When contacting us about a privacy matter, please clearly state that your message is a "Privacy Request" and describe the request with enough detail for us to understand and respond appropriately. Do not send passwords, authentication credentials, or unnecessary sensitive information with a privacy request.

— END OF PRIVACY POLICY —