Cheat Layer

GDPR overview

There is no mention of the GDPR anywhere on this site. Searches across the privacy policy, the licence agreement and the documentation, in both extracted text and archived HTML, return no occurrence of the regulation, and none of the CCPA either. No legal basis for processing is stated, no right of access, rectification, erasure or portability is described, no Article 27 EU representative is designated and no data protection officer is named. No data processing agreement is offered, no subprocessor list is published, and international transfers are handled by a generic consent clause rather than standard contractual clauses. The policy is dated 14 January 2022 and has not been revised since. The Chrome Web Store listing compounds this by declaring the publisher a non-trader, warning that EU consumer rights do not apply.

Who owns the data?

The end-user licence agreement states that the software is licensed rather than sold and that the vendor reserves every right it does not expressly grant. Users may not resell, rent or exchange the software, may not resell accounts, and may not decompile or reverse-engineer it. Notably, no clause addresses ownership of the automations, agents or output that customers themselves create, which leaves that question open. The privacy policy allows personal data to be shared with service providers, with corporate affiliates including the parent company and subsidiaries, and with business partners, and to be transferred wholesale in a merger, sale, financing or bankruptcy. Open-source components remain governed by their own licences, which prevail over the agreement.

Reuse rights

The licence permits installing as many copies as wanted and using the software for any lawful purpose, and the desktop application may be redistributed provided the agreement travels with it. One tension deserves attention: the agreement forbids selling or exchanging the software for anything of value, while the marketing pages actively encourage users to publish premium agents for recurring revenue, to embed agents and sell access on their own websites, and to turn automations into Chrome extensions or desktop applications they could sell. Nothing in the documents explicitly grants or denies commercial reuse of agent output, so that permission rests on the marketing copy rather than on the contract. Operational limits do apply: webhooks are capped at one per minute, multiple accounts are prohibited, tenants must belong to the same business and share its domain, and installing locally or on-premise requires an enterprise licence. Data drawn through Google APIs is subject to Google's API Services User Data Policy and its Limited Use requirement.

Data retention & training

Hosting summary

The vendor declares no hosting country or region. The privacy policy says only that data is processed at the company's operating offices and in any other place where the parties involved are located, and that submitting information constitutes consent to that transfer. Network resolution tells us more than the documents do, and should be read as an observation rather than a vendor commitment: the domain resolves to 34.170.154.36, an address belonging to Google LLC in Council Bluffs, Iowa, which is a Google Cloud region rather than a content delivery node. Desktop installers are served from Google Cloud Storage. Open Agent Cloud runs agents in Linux containers on the vendor's servers, with no location stated. Where Supabase is used as a vector store for sales conversations, that data sits in the customer's own Supabase account. Enterprise customers may run Cheat Cloud on-premise for compliance reasons. Encryption at rest or in transit is never mentioned.