Privacy Policy

This Privacy Policy explains how Yeap Cloud collects, uses, discloses and protects personal information when you visit yeap.cloud, create an account or use our services. Yeap Cloud is operated by ZoneCloud Network LLC ("ZoneCloud", "we", "us"), 1942 Broadway Ste 314C, Boulder, CO 80302, United States. ZoneCloud is the controller of the personal information described here, except where we process data on behalf of our customers as explained in section 2.

#1. Scope

This policy covers our website, the Yeap Cloud console and APIs, and the services we offer, including cloud servers (EVM), containers and hosting, CDN and security, DNS, domain registration, SSL and code signing certificates, email hosting (Yeap Mail), transactional email, cloud drive (Yeap Disk) and the LLM API.

#2. Customer content

"Customer content" means the data you or your users store on or send through our services: files on servers and in cloud drive, website content, DNS records, email messages and attachments, API requests and similar data. We process customer content only to provide the services you have ordered, to keep them secure, to prevent abuse and to comply with law. For customer content that contains personal information of other people, you are the controller and we act as your processor. You are responsible for having a lawful basis to collect and process that data.

#3. Information we collect

Account information. When you register we collect your email address, a password (stored only as a salted hash), and optional profile details such as your name, company and phone number. If you enable two-factor authentication we store the secret needed to verify your codes.

Billing information. We collect billing name and address, invoices, payment history, account balance and transaction records. Card payments are handled by Stripe and PayPal payments by PayPal. We never receive or store full card numbers or security codes. For a saved card we keep only a token from Stripe, the card brand and the last four digits.

Domain contact information. To register a domain we must collect the registrant, administrative, technical and billing contacts (name, organization, postal address, email and phone) required by the registry and our registrar partners.

Certificate validation information. For SSL certificates we process domain validation data. For organization-validated (OV), extended-validation (EV) and code signing certificates we collect the organization and identity details the certificate authority requires, which can include business registration documents and contact details.

Usage and log data. Our systems record technical data when you use the website, console, APIs and services: IP addresses, browser and device information, timestamps, pages and API endpoints accessed, login events, resource usage (such as traffic, CPU and storage), email delivery logs (sender, recipient, time and status), CDN and firewall access logs, and LLM API usage records (model, token counts and time).

Support communications. When you open a ticket or email us we keep the conversation and any attachments you provide.

Cookies and similar technologies. See section 9.

#4. How we use information

We use personal information to:

• create and manage your account and authenticate you;
• provide, operate and maintain the services you order, including provisioning, renewals and usage metering;
• process payments, issue invoices, collect amounts owed and keep financial records;
• register and manage domains and certificates on your behalf with registries, registrars and certificate authorities;
• send service messages such as security alerts, expiry reminders, invoices and important changes;
• provide customer support and respond to your requests;
• detect, investigate and prevent fraud, spam, malware, attacks and other abuse, and enforce our Terms of Service and Acceptable Use Policy;
• monitor, troubleshoot and improve the performance and security of our network and services;
• understand how visitors use our website so we can improve it;
• comply with legal obligations and respond to lawful requests.

We do not sell your personal information, and we do not use your customer content to advertise to you. We do not use content you send to the LLM API to train models.

#5. Legal bases

Where the EU or UK General Data Protection Regulation (GDPR) or similar laws apply, we rely on these legal bases:

• Contract: to provide the services you request and manage your account and billing.
• Legal obligation: to keep tax and accounting records, meet registry and certificate authority rules and respond to lawful requests.
• Legitimate interests: to secure our services, prevent fraud and abuse, improve our website and services and communicate with you about your account. We balance these interests against your rights.
• Consent: where the law requires it, for example for certain cookies or optional communications. You can withdraw consent at any time.

#6. How we share and disclose information

We share personal information only as described below, and only to the extent needed for each purpose. Disclosures happen through secure, authenticated connections (such as encrypted API calls to our providers) or, for legal requests, through a documented review.

Payment processors. Stripe and PayPal receive the payment details you enter directly on their forms, together with the amount, currency and an order reference, to process payments, refunds and fraud checks. Their own privacy policies apply to that data.

Domain registries, registrars and WHOIS. When you register, transfer or renew a domain, we send the domain contact information to our registrar partners and the relevant registry, as required by ICANN and registry policies. Registries may publish some contact data in public WHOIS/RDAP directories. Where the extension supports it, our domain privacy service replaces your details in public directories with proxy contact details, and only the registrar and registry receive your real data. We may still disclose the underlying contact details when the registry or ICANN rules require it, in response to a valid legal request, or to address a substantiated abuse complaint.

Certificate authorities. We send certificate requests and validation data to the certificate authority that issues your certificate (for example Let's Encrypt, ZeroSSL, Sectigo, DigiCert or Certum). Issued SSL certificates are published in public Certificate Transparency logs, which include the domain names in the certificate.

Infrastructure and service providers. We use data center and network providers, cloud object storage (Cloudflare R2, for cloud drive files and large email attachments), backup storage, security services (including captcha.la for bot protection on login and other forms), analytics (Google Analytics) and push notification services (Firebase Cloud Messaging, for the Yeap Mail mobile app). These providers process data only on our instructions and under confidentiality and security obligations.

AI model providers. When you use the LLM API, the content of your request is passed to the upstream provider that serves the model you select, so that it can generate a response. That provider's terms and data practices apply to the request.

Legal and safety. We may disclose information when we believe in good faith that it is required by law, court order or other legal process; to respond to lawful requests from public authorities; or to protect the rights, property or safety of our customers, the public or ZoneCloud, including investigating abuse reports. Where the law allows, we will try to notify the affected customer before disclosing their information.

Business transfers. If ZoneCloud is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

#7. International transfers

ZoneCloud is based in the United States, and we and our providers operate infrastructure in several regions, including North America, Asia and Europe. Your information may therefore be processed in countries other than your own, which may have different data protection laws. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.

#8. Retention

We keep personal information only as long as needed for the purposes described in this policy:

• Account information is kept while your account is open and for a limited period after it is closed, to handle any remaining billing, disputes or legal matters.
• Billing and invoice records are kept for as long as tax and accounting laws require, generally up to seven years.
• Logs such as access, security and delivery logs are kept for a limited period, generally up to 180 days, unless we need them longer to investigate a security incident or abuse.
• Customer content is deleted when you delete it or when the service is terminated under our Terms of Service. Deleted data may remain in encrypted backups for up to 30 days before it is overwritten.
• Domain registration data is kept as required by registry and ICANN rules.
• Support tickets are kept while your account is open so we can refer to earlier conversations.

#9. Cookies and analytics

We use a small number of cookies and similar browser storage:

• Essential cookies keep you signed in to the console, remember your language (the locale cookie, shared across yeap.cloud sites) and your display preferences, and protect forms against abuse.
• Analytics. Our website uses Google Analytics 4 to measure visits and page views. Google Analytics sets its own cookies and receives information such as your IP address, browser details and the pages you view. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser.

You can delete or block cookies in your browser settings. Blocking essential cookies may stop the console from working.

#10. Security

We protect personal information with technical and organizational measures appropriate to the risk, including:

• Encryption in transit: our website, console, APIs and mail services use TLS.
• Encryption at rest for backups: platform database backups and our backup service are encrypted before storage.
• Access controls and least privilege: staff access to production systems and customer data is limited to people who need it for their role and requires authentication.
• Account protection: passwords are stored as salted hashes, two-factor authentication is available for every account, and login and sensitive actions are rate-limited and protected against automated attacks.
• Network and service isolation: customer resources are isolated from each other, and our network is protected by firewalls and monitoring.
• Monitoring and response: we monitor our systems for suspicious activity and investigate security events.

No method of transmission or storage is completely secure. If we become aware of a security incident that affects your personal information, we will notify you and the authorities where the law requires.

#11. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent;
• lodge a complaint with your local data protection authority.

Residents of California and other US states may have similar rights, including the right to know what we collect and to request deletion. We do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

How to exercise your rights. You can view and update most account information in the console. For other requests, open a support ticket in the console or email support@yeap.cloud. We may need to verify your identity before acting on a request, and we will respond within the time the applicable law requires. Some information must be kept to meet legal obligations, for example invoices.

#12. Children

Our services are intended for businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

#13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If a change materially affects how we handle your personal information, we will notify you by email or in the console before it takes effect.

#14. Contact

ZoneCloud Network LLC (Yeap Cloud) 1942 Broadway Ste 314C, Boulder, CO 80302, United States

• Email: support@yeap.cloud
• Support tickets: console.yeap.cloud/support/tickets