Cloudairy

GDPR overview

Implementation is documented rather than merely claimed. The homepage states that Cloudairy complies with the GDPR and extends it to all customers, including those outside the EU. Behind the footer badge, the trust centre names a GDPR Management Standard certification from UKCert issued in March 2026 and valid to March 2029, plus an independent audit by Veroscert/UKcert on 23 February 2026 covering eight areas, all marked Complied. A DPO is named: Chandresh Desai, chandresh.desai@cloudairy.com. Access, rectification, erasure, restriction, objection and portability are listed, with a one-month response time, 72-hour breach notification to supervisory authorities, DPIAs for high-risk processing and standard contractual clauses for transfers. Two frictions remain: no Article 27 EU representative is designated, and the privacy policy places itself under the laws of India.

Who owns the data?

Cloudairy's terms answer only half the question. The software, the content Cloudairy publishes and the branding are declared its protected intellectual property, and unauthorised use is prohibited. The six sections say nothing about the boards, docs and projects you create: no assignment, no licence granted to Cloudairy, no statement that the work stays yours. The privacy policy is narrower and clearer, listing name, email address and, with explicit consent, auditor data, and limiting sharing to essential service partners, again only with consent. The trust centre adds tenant isolation with no cross-tenant data exposure, and data processing agreements with audit rights covering every subprocessor.

Reuse rights

Nothing in the terms restricts what you do with your own output, but nothing grants it either, since the six sections never address user content. In practice the exits are open: boards export as PNG, PDF, SVG and CSV or JSON from the editor, and the AI Library exports PNG, SVG and Markdown. Export quality follows your plan, with the free tier limited to low resolution, and sending files straight to Google Drive or OneDrive starts at Starter. Imports run the other way, from Lucidchart, Miro, Mural, Visio and Google. One caveat sits in the liability clause: data loss caused by your own mistake or by a third party is not covered.

Data retention & training

Hosting summary

By default customer data is stored in AWS US-EAST-1, in Northern Virginia, which places it under United States jurisdiction. An EU region instance is available for organisations that require European data residency, and the privacy policy tells EU residents their data is held in Europe-based secure storage. Everything runs on AWS, itself certified SOC 2, ISO 27001 and FedRAMP, using EC2, Amplify for the front end and CDN, load balancing, a VPC with private subnets, AWS WAF, Aurora PostgreSQL Serverless and S3 with versioning. Data is encrypted with AES-256 at rest, databases, object storage and backups included, and TLS 1.2+ in transit, service to service as well, with keys held in AWS KMS. Backups are encrypted, taken daily, kept in geographically separate locations and restorable to a point in time. Transfers out of the EU rely on standard contractual clauses. Three subprocessors are named as of March 2026: AWS, Stripe for payments and Amplitude for anonymised product analytics. Uptime is backed by a 99.9% SLA with 24/7 monitoring. Note that the domain resolves to a CloudFront edge node geolocated in Zurich: a delivery point, not a storage location.