Last updated: 21 October 2026
Clouds and Light Limited is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use LightPane, our cloud infrastructure visibility service.
1. Data Controller
Clouds and Light Limited is the data controller responsible for your personal data. We are a Limited Company registered in the United Kingdom and are registered with the UK Information Commissioner's Office (ICO).
We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Information We Collect
We collect and process the following types of personal data when you use our Service:
- Name: Your name, as you provide it at sign-up — or as supplied by Google or LinkedIn if you choose to sign in with one of them (see Section 5.3)
- Email Address: Your email address, which we verify — or as supplied by Google or LinkedIn if you sign in with one of them
- Social sign-in identifier: If you sign in with Google or LinkedIn, the identifier that provider uses for you, so we can recognise you next time
- Organisation details: Your organisation name and the role/permissions you hold within it
- Consent records: The version of the Terms you accepted and when, and — separately — whether and when you opted in to marketing email
We do not store passwords. Sign-in is passwordless: we email you a single-use link, and hold only a short-lived sign-in token and your session.
Where you connect a cloud account (Amazon Web Services, Google Cloud, or Microsoft Azure), we collect:
- Cloud account identifiers: Your AWS account ID, GCP project ID, or Azure subscription/tenant ID
- Connection credentials: What we hold depends on how the provider authenticates us, and we always hold the least it allows. For AWS, the identifier of the read-only role you create for us and its external ID — no secret is involved. For Google Cloud, a keyless federation configuration — again no secret. Microsoft Azure offers us no keyless option, so there we also hold the client secret of the service principal you create for us; see “How we protect your Azure client secret” below. We never ask for, and never store, your own user credentials for any provider.
- Regions: The cloud regions you ask us to look at
- Resource metadata: Read-only configuration metadata about your cloud resources — resource identifiers, configuration, tags, state and health, and related service details
How we protect your Azure client secret. Azure is the only provider we support that has no keyless way for a third party to read your resources, so it is the only one where we hold a secret at all. We treat that as a thing to be minimised rather than a thing to be managed: the secret belongs to a service principal you create for us, it grants read-only access, and you can revoke it at any time from your own tenant without involving us.
- It is encrypted before it is stored, under a dedicated encryption key that we manage in AWS Key Management Service and that is rotated automatically. The plain value is never written to our database.
- The encrypted value is cryptographically bound to your subscription and tenant, so it cannot be decrypted in the context of any other account.
- It is never shown back to you, never returned by our API, and never included in a data export. Once you have entered it, no interface of ours can reveal it — if you lose it, you replace it in Azure rather than retrieving it from us.
- It is decrypted only at the moment it is needed to ask Azure for a short-lived read-only token, and only by the components that perform that task.
- It is erased when you disconnect the account or close your subscription, as part of deleting your record.
Important: we connect using a read-only role or service principal that you create and can revoke at any time. We have no ability to make changes to your cloud environment. We read resource metadata solely to render the visibility panes and analysis you have asked for. Access by our service is logged in your own cloud account, so you can audit it independently. You can also exclude or hide individual resources from us entirely using a reserved resource tag, without changing any permissions.
- Product usage events — for example sign-in, connecting a cloud account, creating an access key, or viewing a pane
- Which panes and pages you use, and basic interaction patterns
- Configuration you create in the product: access keys, embed configurations, saved selections and preferences
Product usage events are captured only for signed-in users and are identified by your account ID. We do not track anonymous visitors, and we do not build advertising profiles. See Section 5.4 and Section 8.
- IP Addresses: Your internet protocol address for security and system administration
- Cookies: Essential session cookies required for website functionality (see Section 8)
- Log Data: Browser type, access times, pages viewed, and other diagnostic data
3. How We Use Your Information
We use your personal data for the following purposes:
- Creating and managing your user account
- Authenticating your identity when you log in
- Verifying your email address
- Providing secure access to the platform
- Reading metadata from the cloud accounts you connect, in order to render the visibility panes you have configured
- Caching that metadata so panes load quickly and we make fewer calls to your cloud provider
- Managing your access keys, embed configurations and organisation membership
- Applying your plan's limits and features
We treat email as two separate lanes:
- Service email (always sent): sign-in links, email verification, security and account notices, billing and payment notices, and service incident notifications. These are necessary to provide the Service and are not marketing — you cannot opt out of them while you hold an account.
- Marketing email (opt-in only): occasional product updates and news. We send these only if you actively opted in — the box is never pre-ticked — and you can withdraw consent at any time, without affecting service email.
We also use your email address to respond to support requests you send us.
- Analyzing usage patterns to improve our services
- Identifying and fixing technical issues
- Developing new features and functionality
- Ensuring platform security and preventing abuse
- Complying with legal requirements and regulations
- Enforcing our Terms and Conditions
- Protecting our rights and the rights of our users
4. Legal Basis for Processing
Under UK GDPR, we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide the Service you have registered for
- Consent: Where you have given explicit consent (e.g., subscribing to email notifications)
- Legitimate Interests: For platform improvements, security, and analytics, where it does not override your rights
- Legal Obligation: Where required by law
5. Data Sharing and Third Parties
We do not sell your personal data, and we do not share it for advertising.
The authoritative list of our subprocessors — who they are, where they are, and the safeguard covering any transfer — is published at lightpane.io/subprocessors. That page also sets out the 30 days' notice we give before a new subprocessor begins processing personal data, and your right to object. This section explains what each one does and why.
We use Amazon Web Services (AWS) to host and operate the platform. Our production systems run in the AWS Europe (Ireland) region, with disaster-recovery replication to Europe (Frankfurt). AWS provides the underlying infrastructure and does not access or process your personal data except as necessary to provide those hosting services. See Section 6.1.
The Service works by connecting, at your instruction, to accounts you hold with third-party providers and reading data from them. Today those providers are Amazon Web Services, Google Cloud and Microsoft Azure; we may add or withdraw supported providers over time. In every case the connection is initiated by you, uses credentials you create as described in Section 2.2, grants read-only access, can be revoked by you at any time without involving us, and is logged in your own account with that provider.
These providers are not our subprocessors. We are not disclosing your data to them — you are directing us to read from systems you already control. The processors we use are listed separately at lightpane.io/subprocessors.
Amazon Web Services appears in both places, wearing two different hats: it is our host, and therefore our subprocessor (Section 5.1), and it is also a provider you may connect, in which case it is your own system.
You can sign in with Google or LinkedIn instead of waiting for an email link. This is entirely optional — the email link always remains available, and nothing is shared with either company unless you choose their button.
When you do, we ask that provider only for your name, your email address, and the identifier they use for you. We request no other permission: we cannot read your contacts or connections, we cannot post anything, and we do not use the connection for advertising or tracking. We store the identifier against your account so that the same button signs you into the same account next time, and so that a change at the provider's end is visible to us rather than silently creating a second account.
If the address matches an account you already have, you are signed into that account — you do not get a second one.
We do not simply take LinkedIn's word for your address. Where a provider does not meet our bar for vouching for an email address, we email you our own single-use link and the click is what proves control of the mailbox. That is one extra step, and it is the step that makes the account yours.
Google and LinkedIn each act as a controller in their own right for their own purposes, under their own privacy policies. Using one of these buttons necessarily tells that provider that you signed in to LightPane.
We use PostHog (PostHog Cloud EU) to understand how the website and the product are used, so we can improve them.
For signed-in users, we send product events identified by your account ID — the actions that make up the setup journey, such as choosing a provider or linking an account.
For anonymous visitors, we record page views: which page was opened, the site you arrived from, and any campaign parameters in the link you followed. Each page view is sent with a random value that is generated fresh, used once, and never stored. It is not an identifier for you: two page views cannot be linked to each other, and we cannot recognise you on a later visit. We do not build a profile of anonymous visitors, and we do not know who you are.
In both cases PostHog also receives the technical data inherent in any web request, such as your IP address. We rely on our legitimate interest in understanding and improving the Service (Section 4).
Our analytics is cookieless: it stores nothing on your device — no cookie, no local storage — and we create no persistent identifier for anonymous visitors. If we later introduce anything that does store data on your device for analytics — session replay, or simply counting returning visitors — we will ask for your consent first.
We use Resend to deliver email. Your name and email address, and the content of the message, are processed by Resend in order to send it. Resend also reports delivery outcomes back to us (for example a bounce or a spam complaint), which we use to protect the reliability of our email and to detect abuse of our sign-up form.
We use Stripe to take payments and manage subscriptions. When you subscribe to a paid plan, Stripe processes your payment and billing details directly. We never see or store your full card details — we hold only the identifiers Stripe gives us (such as your customer and subscription IDs), your plan, and your billing status, so we can apply your plan and show your billing history. Stripe processes your payment data as a controller in its own right under its own privacy policy.
The Service is provided through lightpane.io and its subdomains (including app.lightpane.io, console.lightpane.io, api.lightpane.io and lens.lightpane.io), and our company site cloudsandlight.com. Cookies set by the Service are limited to our own domains — see Section 8.
We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).
6. Data Storage and Retention
Your personal data is stored on AWS infrastructure in the European Economic Area — primarily the AWS Europe (Ireland) region, with disaster-recovery replication to Europe (Frankfurt) so the Service can be restored if a region becomes unavailable.
We retain your account data while your account remains active, so we can provide the Service — your account and organisation details, connected cloud accounts, access keys and saved configuration.
Cached cloud resource metadata is transient and is refreshed or expires on a rolling basis; it is not kept as a historical archive. Records we must keep for legal reasons — for example billing and tax records — are retained for the period the law requires, even after you close your account.
You may request deletion of your data at any time by contacting us (see Section 10). Upon deletion request, we will permanently delete your personal data, though we may retain certain information where required by law or for legitimate business purposes (e.g., preventing fraud or abuse).
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of sensitive data at rest, with credential material such as an Azure client secret encrypted individually under a managed, automatically-rotated key before it is stored
- Secure HTTPS connections for all data transmission
- Access controls and authentication mechanisms
- Regular security assessments and monitoring
- AWS infrastructure security features and compliance certifications
No online service can guarantee absolute security, but we take these obligations seriously and design the Service to minimise what we hold: we store no passwords, we hold only read-only access to your cloud accounts, and we never see your full card details.
7. International Data Transfers
We are a UK data controller and your data is stored in the European Economic Area (Ireland, with disaster-recovery replication to Germany). Transfers between the UK and the EEA are covered by the UK's adequacy regulations for the EEA and the European Commission's adequacy decision for the UK.
Some of the processors described in Section 5 are organisations based outside the UK and EEA, or may support their services from outside it. Where personal data is transferred outside the UK/EEA, it is protected by an appropriate safeguard — an adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — as set out in our agreement with that processor.
8. Cookies
We use cookies to provide essential functionality on our website. Cookies are small text files stored on your device that help us recognize you and maintain your session.
We store only what is necessary to run the Service. We set no advertising cookies, no third-party tracking cookies, and no analytics cookies.
- Essential session cookie: keeps you signed in and secures your session. Strictly necessary — without it you cannot log in.
- Functional browser storage: small items saved in your browser's local storage to remember interface state you chose — for example your progress through the cloud-connection wizard, or that you dismissed a walkthrough. This never leaves your browser and is not used to track you.
Our product analytics (Section 5.4) is cookieless. It stores nothing on your device and creates no identifier for anonymous visitors; events are recorded only for signed-in users, against your account ID. Because we place no analytics or advertising technology on your device, we do not need to show you a cookie consent banner. This is a deliberate design choice, not an oversight.
If we ever introduce technology that does store analytics data on your device, we will ask for your consent first, with a genuine option to refuse.
You can block or delete cookies in your browser settings. Because the cookies we set are essential, blocking them will prevent you from signing in and using your account. You can clear the functional browser storage described above at any time without losing any account data.
9. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you.
You have the right to request that we correct any inaccurate or incomplete personal data.
You have the right to request that we delete your personal data in certain circumstances.
You have the right to request that we export your personal data in a structured, commonly used, and machine-readable format.
You have the right to request that we restrict the processing of your personal data in certain circumstances.
You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis.
Where we process your data based on consent (e.g., marketing emails), you have the right to withdraw your consent at any time.
10. How to Exercise Your Rights
To exercise any of your rights under UK GDPR, please contact us at:
We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.
If you are not satisfied with how we handle your data or respond to your requests, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
ICO Website: https://ico.org.uk/
ICO Helpline: 0303 123 1113
11. Children's Privacy
Our Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at support@cloudsandlight.com so we can delete the information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
- Updating the "Last Updated" date at the top of this page
- Posting a notice on our website
- Sending an email notification (if you have subscribed to notifications)
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
13. Contact Information
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at:
Clouds and Light Limited
United Kingdom
ICO Registration: ZB995225
Email: support@cloudsandlight.com
14. Acceptance of This Policy
By using the LightPane Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal data as described in this Privacy Policy.