Privacy Policy



CloudSapio · Effective date: [October 20, 2026]



1. Who we are

CloudSapio, LLC ("CloudSapio", "we", "us") provides security and compliance advisory services, including virtual CISO support and readiness work for SOC 2, ISO 27001, HIPAA and CMMC. This policy explains what personal information we collect through cloudsap.io and our related pages and tools (together, the "Site"), how we use it, and the choices you have. CloudSapio, LLC is the controller of the personal information described in this policy. Our contact details are in Section 16.


2. What this policy covers

This policy covers visitors to the Site, people who fill in our forms or use our tools, people who book calls with us, newsletter subscribers, and business contacts we reach out to.

It does not cover information we handle for clients while delivering services. That information is governed by our agreement with each client, including any confidentiality terms and data processing terms in it.


3. Information we collect

Information you give us

  • Contact details: name, work email, phone number, company, job title.
  • Form and message content: anything you write when you contact us, request a gap analysis, or ask about our services.
  • Scheduling details: the information you enter when you book a discovery call.
  • Assessment responses: your answers to our readiness tools, such as the SOC 2 readiness check, and the results we email to you. We treat your assessment responses as confidential. We use them only to prepare and send your results and to follow up on your request, and we do not share them with referral partners or advertisers
  • Subscription details: your email address and preferences if you sign up for updates or our blog.
  • Job or partnership enquiries: the details and documents you send us.

Please do not send us passwords, credentials, health records, or the confidential data of your own customers through the Site. We do not need them to respond to an enquiry.

Information collected automatically

When you visit the Site, we and our service providers collect technical and usage data through cookies and similar technologies. This includes your IP address, browser and device type, operating system, referring page, pages viewed, time spent on pages, clicks, and approximate location based on IP address.

Information from other sources

We may receive business contact information (name, work email, job title, company, and company size or industry) from professional networks and business data providers, and from referral partners who introduce you to us. We use this information for business-to-business outreach, as described below.


4. How we use information

We use personal information to:

  1. Respond to your questions and requests, and schedule and hold calls.
  2. Deliver the tools and content you ask for, including assessment results.
  3. Send you emails you have requested, and follow up on your enquiry.
  4. Contact businesses that may benefit from our services (see Section 5).
  5. Measure how the Site and our marketing perform, and improve our content and services.
  6. Run and show our ads, and measure whether they lead to enquiries.
  7. Keep the Site secure and prevent fraud and abuse.
  8. Meet legal obligations and enforce our terms.


5. Business outreach

We contact business professionals by email and on professional networks about security and compliance services, where the law allows it. We do this on the basis of your professional role and our reasonable view that the message is relevant to it. Our outreach emails tell you how we obtained your details and link to this policy.


You can object to direct marketing at any time, for any reason, and we will stop. Every marketing email includes an unsubscribe link, or you can email privacy@cloudsap.io. We keep a record of opt-outs so that we do not contact you again.


6. Legal bases (EEA and UK visitors)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

  • Consent, for non-essential cookies and similar technologies, and for newsletters where consent is required. You can withdraw consent at any time.
  • Legitimate interests, for responding to enquiries, B2B outreach, improving the Site, and keeping it secure. We balance these interests against your rights.
  • Contract, where we need information to take steps at your request before entering an agreement.
  • Legal obligation, where the law requires us to keep or disclose information.

7. Cookies and tracking technologies

We use cookies, pixels, and similar tools for these purposes:

  • Essential: to keep the Site working and secure.
  • Analytics: to understand how visitors use the Site (for example Google Analytics).
  • Advertising and conversion measurement: to measure the results of our ads on platforms such as Google, LinkedIn, Reddit, and OpenAI.

Where the law requires it, we ask for your consent before setting non-essential cookies. You can change your choices through the cookie banner on the Site or in your browser settings. You can also use Global Privacy Control or a similar browser signal, which we treat as an opt-out of advertising cookies where required by law. Blocking some cookies may affect how parts of the Site work.


8. How we share information

We share personal information only as needed to run our business:

  • Service providers that work for us under contract, including website hosting and design, analytics, form and survey tools, scheduling, email delivery, customer relationship management, outreach and sales tools, and advertising platforms.
  • Referral and technology partners where you ask us to connect you with them or where that partner referred you to us.
  • Professional advisers, such as lawyers, accountants and insurers.
  • Authorities or other parties where the law requires it, to protect rights and safety, or to respond to valid legal requests.
  • A successor business, if CloudSapio is involved in a merger, acquisition, or sale of assets. We would tell you if your information became subject to a different privacy policy.

We do not sell your personal information for money. Some advertising and analytics tools can count as "sharing" for cross-context behavioral advertising under some US state laws. You can opt out through the cookie settings or by contacting us.


9. International transfers

We and our service providers may process information in the United States and other countries. Where we transfer personal information from the EEA or UK to a country without an adequacy decision, we use safeguards recognized by law, such as the Standard Contractual Clauses.


10. How long we keep information

We keep personal information only as long as we need it for the purposes above.

  • Enquiries, call bookings and assessment responses: for as long as we are in contact with you and for up to 24 months after our last interaction.
  • Marketing contacts: until you unsubscribe or ask us to delete your information, plus a minimal suppression record so we honor your opt-out.
  • Analytics data: according to the retention settings of the analytics tool, currently up to 14 months.
  • Records we must keep for legal, tax, or accounting reasons: for the period the law requires.

11. Security

Security is our business, and we apply the same care to our own systems. We use access controls, encryption in transit, and vetting of the vendors that handle personal information. We use multi-factor authentication, least-privilege access controls, encryption in transit and at rest, and vetting of the vendors that handle personal information.


12. Your rights

All visitors. You can ask us to tell you what personal information we hold about you, correct it, or delete it, and you can unsubscribe from marketing emails at any time.

EEA and UK visitors. You also have the right to access your information, have it corrected or erased, restrict or object to our processing, receive a portable copy, and withdraw consent. You can complain to your local data protection authority. In the UK, this is the Information Commissioner's Office.

California and other US state residents. Depending on where you live, you may have the right to know what personal information we collect, use, and disclose; to access and delete it; to correct it; to opt out of the sale or sharing of personal information and of targeted advertising; and to not be treated unfairly for using these rights. We do not use or disclose sensitive personal information for purposes beyond those the law permits.

To use any of these rights, email us at the address in Section 16. We may need to verify your identity before acting on a request. You can use an authorized agent to make a request for you, and we will ask for proof of their authority. If we decline a request, you can appeal by replying to our decision, and we will review it.


We respond to requests within one month for EEA and UK residents and within 45 days for US residents, and we will tell you if we need more time where the law allows it.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.


13. Children

The Site is for business audiences and is not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.


14. Links to other sites

The Site links to other websites, including partner vendor pages, social networks, and review sites. Those sites have their own privacy practices, and this policy does not apply to them. Some links to partner vendors are referral or affiliate links. If you follow one, the partner may set its own cookies and learn that you came from our Site.


15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new effective date. If the changes are significant, we will give you more prominent notice.


16. Contact us

For privacy questions or requests:


For privacy questions or requests, email us at privacy@cloudsap.io.

CloudSapio, LLC
Denver, CO