Privacy Policy

Effective date: 1 October 2026 · Last updated: 30 October 2026

Clouty (“Clouty”, “we”, “us”) is a reporting service at clouty.app and app.clouty.app, operated by ZiyaraGo Technologies Company, a limited liability company registered in the Kingdom of Saudi Arabia (Commercial Registration 7053928433), 7782 Al Basala, Ar Rusayfah District, Makkah 24232, Saudi Arabia. Contact: [email protected].

Clouty helps marketing agencies and their clients see the search, analytics and advertising statistics of the clients' websites in one read-only dashboard. This policy explains what data we receive, why, how we store and protect it, and how you can have it deleted.

1. Who uses Clouty

• Operators — staff of the agency who manage clients in Clouty.
• Clients — businesses whose websites and ad accounts are reported on, and the people they invite to view their own dashboard.

2. Data we collect

Account data. For each login: name, email address, a hashed password (we never store passwords in readable form) and a session cookie (see section 8).

Client records. Client name, website domain, services provided, fees and payment records entered by the operator.

TV screens. The Clouty TV app and the /tv page show a client's dashboard on a TV or wall display without a login. When a screen is paired we create a random secret token for it (only its hash is stored) and keep the screen's settings (name, language, rotation, scenes) and what the device reports about itself: browser or app version, display size and recent display errors. We do not collect location, contacts, advertising identifiers or personal data of the people who watch the screen. The token is deleted when the operator removes the screen or when the client's data is deleted (section 7).

Data from connected platforms. Only after a client grants read access, and only the following, as aggregated statistics:

• Google Ads API — names and IDs of the ad accounts and campaigns the authorising user can access, and daily campaign performance: impressions, clicks, cost, conversions and derived figures (click-through rate, cost per click, cost per conversion). We do not read or store personal data of people who saw or clicked ads.
• Google Search Console API — daily search performance of the client's site: clicks, impressions, click-through rate and average position, by search query, page, device and country.
• Google Analytics Data API (GA4) — daily aggregated website metrics: sessions, users, new users, page views, engaged sessions, key events, revenue and engagement time, and sessions by default channel group.
• Meta Marketing API — names and IDs of ad accounts shared with the agency, and daily campaign insights: impressions, reach, link clicks, spend and the counts of actions (such as leads, purchases, messaging conversations).
• Yandex Metrica and Yandex Webmaster APIs — daily aggregated visits, visitors, page views, bounce rate, visit duration, goal completions and traffic sources; search shows, clicks and positions; site quality index and indexing status.
• For the platforms a client authorises with their own account (Google, Yandex), the login name or email of the authorising account and OAuth access and refresh tokens.

All platform data is aggregated statistics about websites and advertising campaigns. We do not request access to e-mail, contacts, files, messages or any other personal content of the authorising user.

3. How we use the data

We use data received from these platforms only to:

• show the client and their agency reports and charts about the client's own website and campaigns in the Clouty dashboard;
• compare periods and highlight changes in those reports;
• keep the connection working (for example, refreshing an access token) and detect errors.

We do not:

• sell, rent or share platform data with third parties or data brokers;
• use it for advertising, retargeting, profiling, credit assessment or lending;
• use it to train or improve artificial intelligence or machine-learning models;
• create, change, pause or delete campaigns, budgets, ads or any settings — Clouty requests read-only access;
• let any person read the data except the agency and the client it belongs to, or our staff when the client asks for support, when needed for security, or when required by law.

4. Google API Services — Limited Use

Clouty's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through the Google Ads API is used only to provide the reporting features described above to the advertiser and the agency managing its account.

5. Where and how long we store data

• Data is stored on servers rented from Hetzner Online GmbH in data centres in Germany and Finland (European Union).
• OAuth tokens are encrypted with a public key before they are stored. The private key that can decrypt them exists only on the separate server that collects statistics; the server that runs the website and dashboard cannot read the tokens.
• All traffic is encrypted with TLS. Access to servers is limited to our engineers by key-based authentication.
• Statistics are kept while the client uses Clouty, for up to the history the platform itself provides (about 16 months for Google and Yandex search data). When a source is disconnected or a client leaves, its tokens are deleted immediately and its statistics within 30 days. Backups are overwritten within a further 30 days.

6. Who we share data with

Data is shown only to the agency operators and to the client it belongs to. We use Hetzner (hosting) and Cloudflare (network security and delivery) as processors; they do not use the data for their own purposes. We disclose data to authorities only when required by applicable law.

7. Withdrawing access and deleting data

• Google: remove Clouty at myaccount.google.com/permissions, or remove our service account from your Search Console / Google Analytics users, or unlink our manager account in Google Ads.
• Meta: remove the agency's partner access to your ad account in Business Settings.
• Yandex: revoke Clouty at id.yandex.ru/security.
• To delete your data from Clouty, follow the data deletion instructions or write to [email protected]. We complete deletion within 30 days and confirm by email.

8. Cookies

The dashboard uses one strictly necessary cookie that keeps you signed in. It is http-only, sent over HTTPS only and expires after 30 days or when you sign out. We do not use advertising or third-party tracking cookies. Your language choice is kept in your browser's local storage.

9. Your rights

You may request access to, correction of, or deletion of your personal data, and object to its processing, by writing to [email protected]. We handle requests in line with the Saudi Personal Data Protection Law and other applicable law.

10. Children

Clouty is a business service and is not directed to children under 18.

11. Changes

We will post any change to this policy on this page and update the date above. Material changes will be announced in the dashboard.

12. Contact

ZiyaraGo Technologies Company, 7782 Al Basala, Ar Rusayfah District, Makkah 24232, Kingdom of Saudi Arabia · [email protected]