All client data is confidential and end-to-end encrypted (AES-256 / TLS 1.3)
Infrastructure hosted & managed in the United States · EU–US Data Privacy Framework certified · Google Consent Mode v2 implemented
This policy complies with Google Publisher Policies 2026, GDPR, CCPA/CPRA, COPPA, and India's DPDPA 2023.
1. Introduction & Scope
Welcome to P2PClouds. We are a product-based technology company headquartered in the United States, offering 50+ cloud-powered, AI-driven products and services designed to accelerate digital transformation for businesses worldwide.
This Privacy Policy describes how P2PClouds ("we", "us", or "our") collects, uses, discloses, and safeguards personal information when you visit https://p2pclouds.net, use any of our products, or interact with our services — whether as a visitor, registered user, or business client.
This policy is designed to comply with the EU General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), India's Digital Personal Data Protection Act (DPDPA) 2023, Google's Publisher Policies 2026, and other applicable data protection laws.
We provide this notice at or before the time of data collection. If you do not agree with this policy, please discontinue use of our services.
2. Data Controller & Data Protection Officer
P2PClouds acts as the Data Controller for personal data collected through our website and product platforms. For data processed on behalf of our business clients within their product environments, P2PClouds acts as a Data Processor under a Data Processing Agreement (DPA).
We have appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and applicable data protection laws. You may contact our DPO at:
3. Information We Collect
We collect personal information only to the extent necessary for the stated purposes. The categories of data we collect include:
- Identity & Contact Data: Full name, email address, phone number, job title, and company name — provided when you register, subscribe, request a demo, or contact us.
- Account Credentials: Username and securely hashed password for accessing our platforms. We never store passwords in plain text.
- Usage & Interaction Data: Pages visited, features used, session duration, click-through patterns, form interactions, and in-product actions — collected via server logs, cookies, and analytics SDKs.
- Device & Technical Data: IP address (anonymized where required by law), browser type and version, operating system, screen resolution, device type, and referring URL.
- Location Data: Approximate geographic location derived from anonymized IP address. We do not collect precise GPS location without explicit consent.
- Communications Data: Emails, live chat messages, support tickets, survey responses, and any other correspondence you initiate with us.
- Payment & Billing Data: Billing address and transaction reference IDs. Full card details are processed exclusively by PCI-DSS Level 1 certified payment processors and are never stored on our servers.
- Cookies & Tracking Identifiers: Google Analytics Client IDs, advertising cookies (including DoubleClick/Google Ads cookies), and consent signals — as further described in Section 8.
- Product-Specific Data: Operational data generated inside individual products (e.g., learner progress in LMS, attendance records in AMS, visitor logs in VPM, CRM contact records). This data is governed by the applicable product agreement and processed only on your instruction.
- Sensitive Data: We do not intentionally collect special category data (health, biometrics, religion, etc.) unless expressly required by a product feature you activate and consent to.
4. Legal Basis for Processing (GDPR / UK GDPR)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data only where we have a valid legal basis under Article 6 of the GDPR. The applicable bases are:
- Contractual Necessity (Art. 6(1)(b)): Processing required to deliver our services, manage your account, process payments, and provide customer support.
- Legitimate Interests (Art. 6(1)(f)): Analytics to improve our products, fraud prevention, network security, and direct marketing to existing customers — balanced against your rights. You may object at any time.
- Consent (Art. 6(1)(a)): For non-essential cookies, personalized advertising, marketing emails to prospects, and any processing not covered by the above bases. Consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time without affecting prior lawful processing.
- Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable laws, tax obligations, court orders, or regulatory requirements.
- Vital Interests (Art. 6(1)(d)): Processing necessary to protect the vital interests of individuals in emergency situations.
Where we rely on legitimate interests, we conduct and document Legitimate Interests Assessments (LIAs). Copies are available on request via info@p2pclouds.net.
5. How We Use Your Information
We process personal data for specific, explicit, and legitimate purposes. We do not use your data in ways incompatible with the purposes for which it was collected. Our processing purposes include:
- Service Delivery: Create and manage your account; provide access to our 50+ products; fulfill orders and subscriptions.
- Billing & Payments: Process transactions, issue invoices, detect and prevent payment fraud.
- Communications: Send transactional emails (account confirmations, security alerts, invoices), product update notifications, and — where you have consented or we have a legitimate interest — marketing communications. You may unsubscribe at any time.
- Product Improvement: Analyze aggregated and anonymized usage data to improve product features, performance, and user experience.
- AI Model Operation: Power our AI agents and machine learning features. We do not use your personal data to train third-party AI models without your explicit consent.
- Security & Fraud Prevention: Detect, investigate, and prevent unauthorized access, data breaches, and fraudulent activity.
- Legal Compliance: Comply with applicable laws, regulations, and valid legal processes.
- Analytics & Research: Conduct internal analytics via Google Analytics 4 (with IP anonymization enabled and data retention limited to 14 months) and similar tools to understand product adoption and market trends.
- Advertising: Serve and measure interest-based advertisements through Google Ads and remarketing lists — only where you have provided consent or we have a legitimate interest, and always with opt-out mechanisms available.
6. Google Services & Third-Party Technologies
We use several Google and third-party services that may collect data on our behalf. In compliance with Google's Publisher Policies 2026, we disclose the following:
- Google Analytics 4 (GA4): We use GA4 to measure website traffic and user behavior. GA4 uses first-party cookies and, where applicable, Google signals. IP addresses are anonymized before storage. Data is retained for 14 months. You can opt out by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.
- Google Ads & Remarketing: We use Google Ads conversion tracking and remarketing lists to measure ad performance and show relevant ads to past visitors. Google uses cookies (including DoubleClick cookies) for this purpose. You can opt out of personalized advertising at https://adssettings.google.com.
- Google Consent Mode v2: Our website implements Google Consent Mode v2. When you decline non-essential cookies, we send cookieless pings to Google that model conversions without using personal data, ensuring analytics continuity while respecting your consent choices.
- Google Tag Manager (GTM): We use GTM to manage and deploy tracking scripts. All tags deployed via GTM are governed by this Privacy Policy. GTM itself does not collect personal data.
- Google Fonts & APIs: We use Google Fonts and Maps APIs. Usage data (including IP address) may be sent to Google servers. See Google's Privacy Policy at https://policies.google.com/privacy.
- Meta Pixel (Facebook): We use Meta Pixel for conversion tracking and retargeting. This is loaded only with your consent for marketing cookies. You can manage Facebook ad preferences at https://www.facebook.com/adpreferences.
- Other Third-Party SDKs: Additional analytics, chat, and support tools may be used. Each is bound by a Data Processing Agreement and processes data only as instructed by us.
For any Google service listed above, P2PClouds remains the data controller for the data we collect. Google acts as a data processor/sub-processor under applicable agreements.
8. Data Security & Encryption
The confidentiality and integrity of your data is our highest priority. All client data processed through P2PClouds systems is end-to-end encrypted using AES-256 encryption at rest and TLS 1.3 in transit. Our infrastructure is hosted and managed within the United States.
We implement the following technical and organizational security measures (TOMs):
- End-to-end encryption (AES-256 at rest; TLS 1.3 in transit) for all client data.
- Role-based access control (RBAC) with the principle of least privilege.
- Multi-factor authentication (MFA) enforced for all internal systems and available to product users.
- Regular penetration testing, vulnerability assessments, and third-party security audits.
- Automated intrusion detection, anomaly monitoring, and 24/7 SOC coverage.
- Strict logical data isolation between tenants in all multi-tenant product environments.
- Incident response plan with breach notification within 72 hours to supervisory authorities (GDPR Art. 33) and affected users without undue delay (GDPR Art. 34) where applicable.
- Annual employee training on data protection, security awareness, and acceptable use.
Despite these measures, no system is entirely immune to risk. If you suspect unauthorized access to your account, contact us immediately at info@p2pclouds.net.
9. Data Sharing & Disclosure
We do not sell, rent, or broker your personal information to third parties. We share data only in the following circumstances, and only to the minimum extent necessary:
- Sub-processors & Service Providers: Vendors who process data on our behalf (cloud hosting, payment processing, email delivery, analytics) under written Data Processing Agreements (DPAs) that impose GDPR-equivalent obligations. A current list of sub-processors is available on request.
- Google & Advertising Partners: As described in Section 6, we share data with Google and Meta for analytics and advertising purposes — subject to your consent where required.
- Legal & Regulatory Authorities: Where required by applicable law, court order, or governmental authority, or to protect the rights, safety, or property of P2PClouds, our users, or the public. We will notify you of any such request where legally permitted.
- Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity. We will provide 30 days' advance notice and the right to delete your data before transfer.
- With Your Explicit Consent: When you authorize us to share specific data with a named third party.
- Aggregated / De-identified Data: We may share anonymized, aggregated statistical data that cannot reasonably identify any individual.
10. International Data Transfers
P2PClouds is headquartered in the United States. If you access our services from the EEA, UK, Switzerland, or other regions with data transfer restrictions, your personal data may be transferred to and processed in the United States.
We rely on the following transfer mechanisms to ensure adequate protection:
- EU–US Data Privacy Framework (DPF): P2PClouds adheres to the EU-US DPF and UK Extension, certified with the US Department of Commerce.
- Standard Contractual Clauses (SCCs): For transfers not covered by DPF, we use the European Commission's 2021 Standard Contractual Clauses, supplemented by a Transfer Impact Assessment (TIA).
- UK International Data Transfer Agreements (IDTAs): For transfers from the UK, we use the ICO-approved IDTA where required.
- Adequacy Decisions: Where the European Commission or UK Government has issued an adequacy decision for the destination country.
You may request a copy of the applicable transfer safeguards by contacting info@p2pclouds.net.
11. Data Retention
We retain personal data only for as long as necessary to fulfill the documented purpose, comply with legal obligations, resolve disputes, and enforce our agreements. Our general retention schedule is:
- Account & Profile Data: Retained for the duration of your account plus 3 years after account closure, unless a longer period is required by law.
- Transaction & Billing Records: 7 years in accordance with US tax and accounting regulations.
- Support & Communications: 2 years from the date of last interaction.
- Analytics Data (Google Analytics): Maximum 14 months, after which data is automatically deleted.
- Advertising Cookies: Maximum 13 months as required by Google Ads policies.
- Marketing Consent Records: Retained indefinitely as evidence of consent, unless consent is withdrawn.
- Product-Specific Data: As specified in the relevant product agreement or DPA.
When data is no longer required, we securely delete or irreversibly anonymize it using methods consistent with NIST SP 800-88 guidelines.
12. Your Rights & Choices (Global)
Regardless of your location, you have the following general rights. Additional jurisdiction-specific rights are detailed in Sections 13 and 14.
- Right to Access (Art. 15 GDPR): Request a copy of the personal data we hold about you, including information about how it is used and shared.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
- Right to Erasure / 'Right to be Forgotten' (Art. 17 GDPR): Request deletion of your personal data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful — subject to legal retention obligations.
- Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format and transmit it to another controller.
- Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests or for direct marketing purposes.
- Right to Restrict Processing (Art. 18 GDPR): Request restriction of processing in certain circumstances.
- Rights Related to Automated Decision-Making (Art. 22 GDPR): Not be subject to decisions based solely on automated processing — including profiling — that produce significant legal effects, without human review.
- Right to Withdraw Consent: Withdraw any consent previously given at any time, without affecting the lawfulness of processing prior to withdrawal.
- Right to Lodge a Complaint: File a complaint with your local supervisory authority (e.g., EU Member State DPA, ICO in the UK, or CNIL in France).
To exercise any right, submit a verifiable request to info@p2pclouds.net with the subject line 'Privacy Rights Request'. We respond within 30 days (extendable to 90 days for complex requests, with notice). We do not charge a fee for reasonable requests.
13. California Privacy Rights (CCPA / CPRA 2026)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights:
- Right to Know: Know what personal information we collect, use, disclose, or sell about you over the past 12 months.
- Right to Delete: Request deletion of your personal information, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information we maintain about you.
- Right to Opt-Out of Sale / Sharing: We do not sell personal information. We share data with advertising partners (Google, Meta) for cross-context behavioral advertising. You may opt out at any time via our 'Do Not Share My Personal Information' link in the website footer.
- Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information to purposes necessary for service delivery.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
To submit a CCPA request, contact info@p2pclouds.net or use the 'California Privacy Request' form on our website. We will verify your identity before processing. Authorized agents may submit requests with a signed power of attorney.
14. EU / EEA / UK User Rights (GDPR)
In addition to the rights in Section 12, EU, EEA, and UK users have the following rights under GDPR and UK GDPR:
- Supervisory Authority: You have the right to lodge a complaint with the data protection authority in your EU Member State or with the UK Information Commissioner's Office (ICO) at https://ico.org.uk.
- EU Representative: P2PClouds has appointed an EU Representative in accordance with GDPR Art. 27. Contact details are available at info@p2pclouds.net.
- Consent Withdrawal: For processing based on consent (non-essential cookies, marketing emails), you may withdraw via our Cookie Settings or by emailing info@p2pclouds.net.
- Lawful Basis Transparency: You may request information about the specific lawful basis for any processing activity at any time.
- Age of Digital Consent: Our services are directed at persons aged 16 or older in the EEA. For users aged 13–15, verifiable parental/guardian consent is required before account creation. (Member States may lower this threshold to 13.)
15. Children's Privacy (COPPA)
Our website and the majority of our products are not directed to children under the age of 13 (or 16 in the EEA). In compliance with the Children's Online Privacy Protection Act (COPPA) and GDPR Art. 8:
- We do not knowingly collect personal information from children under 13 without verifiable parental consent.
- If a product feature requires user data from minors (e.g., an educational LMS used in schools), it is deployed under a separate Data Processing Agreement with the educational institution, which acts as the data controller and is responsible for obtaining parental consent.
- If we discover we have inadvertently collected data from a child under 13 without consent, we will delete it promptly.
- Parents or guardians who believe their child's data has been collected without consent should contact info@p2pclouds.net for immediate action.
16. AI, Automated Processing & Profiling
Several of our 50+ products include AI-powered features. In compliance with GDPR Art. 22 and the EU AI Act:
- We use AI to power features such as predictive analytics, chatbot responses, document analysis, and personalized recommendations. These do not produce solely automated legal or similarly significant decisions about individuals without human oversight.
- We do not use your personal data to train foundational AI models owned by third parties without your explicit consent.
- Where AI-generated profiling affects service delivery, you have the right to request human review of the decision.
- Our AI systems are subject to regular bias audits, accuracy assessments, and fairness evaluations.
- AI training on client-owned data within product environments is governed solely by the applicable DPA and product agreement.
17. Third-Party Links & Integrations
Our website and products may link to third-party websites or integrate with external services (e.g., Zapier, Slack, Salesforce). We are not responsible for the privacy practices of those services. We encourage you to review their privacy policies before sharing personal data. P2PClouds is not liable for data breaches or privacy violations caused by third-party services operating independently of our platforms.
18. Changes to This Privacy Policy
We may revise this Privacy Policy periodically to reflect changes in our data practices, technology, legal requirements, or regulatory guidance — including updates to Google's Publisher Policies.
For material changes, we will: (1) update the 'Last Updated' date at the top of this page; (2) post a notice on our website homepage for at least 30 days; and (3) where feasible, notify registered users by email at least 14 days before the change takes effect.
Your continued use of our services after the effective date of any revised policy constitutes your acknowledgment of the changes. Where a change requires new consent (e.g., a new purpose for processing), we will obtain that consent before processing.
19. Contact Us
For any questions, concerns, data subject access requests, or complaints regarding this Privacy Policy or our data practices, please contact our Privacy Team. We are committed to resolving all inquiries promptly and transparently.
We aim to acknowledge all privacy inquiries within 5 business days and provide a full response within 30 calendar days. For unresolved concerns, you retain the right to escalate to your local data protection supervisory authority.
© 2026 P2PClouds. All rights reserved. This Privacy Policy is governed by the laws of the United States.
