Privacy Policy
Version 3.2 · Last updated: 12 January 2026 · Applies to cloud-core.casa and the AetherHome Cloud platform
1. Controller
The controller within the meaning of Art. 4 (7) GDPR is CloudCore Casa Solutions GmbH, Landsberger Str. 155 (BC Westend), Office 412, 80687 Munich, Germany. Reach our Data Protection Officer at privacy@cloud-core.casa or by post (mark the envelope "Attn: DPO").
2. What we collect
Account data: name, email address, hashed password, billing address, VAT ID (business customers). Provided by you at registration.
Site data: site ID, gateway firmware version, device inventory and device telemetry (temperature, humidity, energy, state changes). Generated by your hardware; processed to deliver the service you subscribed to.
Operational data: API request logs (IP address, timestamp, endpoint, response code, retained 30 days), support tickets and their content, billing records as required by German tax law (§ 147 AO, 10-year retention).
We do not use tracking cookies, advertising pixels, third-party analytics or social plugins on this website. The only local storage used is your shopping cart, saved in your browser's localStorage and never transmitted to us until you actively place an order.
3. Purposes and legal bases
Contract performance (Art. 6 (1) (b) GDPR): operating the cloud platform, telemetry storage, support tickets, order fulfilment. Legitimate interests (Art. 6 (1) (f) GDPR): infrastructure security, abuse prevention, service improvement on aggregated, non-identifying data. Legal obligations (Art. 6 (1) (c) GDPR): tax and commercial record-keeping.
4. Storage locations and recipients
All personal and site data is stored in EU-Central facilities operated by ISO/IEC 27001-certified providers in Frankfurt and Munich, with an encrypted replica in Zurich. No data is transferred to, or accessible from, countries outside the EU/EEA. Payment processing (where applicable) is handled by an EU-licensed payment institution under its own privacy policy; we transmit only the data required to complete the transaction.
5. Retention
Telemetry follows your plan's retention (30–90 days, unlimited on Fleet). Account data is retained while your account is active and deleted within 30 days of account closure, except billing records (10 years) and incident logs (12 months). Backup copies are rotated out within 30 days of any deletion request.
6. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Export and deletion are also self-service in the console under Account → Privacy. You may lodge a complaint with the Bavarian supervisory authority (Bayerisches Landesamt für Datenschutzaufsicht, Ansbach).
7. Security measures
TLS 1.3 in transit, AES-256 at rest with per-tenant keys in EU-hosted HSMs, mutual TLS device authentication, quarterly penetration tests by an independent German auditor, and a documented incident-response process with notification within 72 hours to affected users and authorities where required (Art. 33–34 GDPR).
8. Changes
Material changes to this policy are announced by email at least 30 days before taking effect. Previous versions are archived and available on request.