Privacy Policy

Last updated: 31 July 2026

Cloudexp OÜ ("Säuts", "we", "us", "our") respects your privacy and processes personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), applicable Estonian legislation, and this Privacy Policy.

This Privacy Policy explains what personal data we collect, why we process it, how long we retain it, and what rights you have regarding your personal data.

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

For the purposes of this Privacy Policy, the Data Controller is:

Cloudexp OÜ

Registry Code: 16263842

Registered Address:

Juurdeveo tn 18-9
Kesklinn, Tallinn
Harju County 11313
Estonia

Email:

tere@sauts.ee

Website:

https://sauts.ee

If you have any questions regarding the processing of your personal data, please contact us by email.

2. Scope

This Privacy Policy applies to all personal data processed by Säuts in connection with:

• use of the Website;
• registration of a User Account;
• use of the Service;
• subscription management;
• customer support;
• invoicing and payment processing;
• sending Google review invitations;
• marketing activities where there is a lawful basis to do so.

This Privacy Policy does not apply to third-party websites or services that may be linked from our Website.

3. Definitions

For the purposes of this Privacy Policy, the following definitions apply.

Personal Data means any information relating to an identified or identifiable natural person as defined in Article 4 of the GDPR.

Processing means any operation performed on Personal Data, including collection, recording, storage, alteration, use, disclosure, transmission or deletion.

Data Subject means the individual whose Personal Data is processed.

Data Controller means Cloudexp OÜ.

Data Processor means a natural or legal person processing Personal Data on behalf of the Data Controller.

Customer means a customer of a User who receives an SMS invitation through the Service.

User means the business or sole trader using the Säuts Service.

4. Personal Data We Process

Depending on how the Service is used, we may process the following categories of Personal Data.

Account Information

• full name;
• email address;
• telephone number;
• company name;
• company registration number;
• billing information;
• VAT registration number, where applicable.

Authentication Information

• encrypted password;
• authentication logs;
• IP address;
• device identifiers;
• login timestamps.

Customer Data

Users may upload the following Customer information into the Service:

• first name;
• telephone number;
• date of service;
• communication history;
• SMS delivery status;
• review invitation status.

The Service Provider only requests Personal Data that is necessary to provide the Service.

Payment Information

In connection with payment processing, we may receive:

• payment identifier;
• payment status;
• invoice number;
• payment date.

We do not store payment card numbers or other card payment credentials.

Technical Information

When you use the Service, we may automatically collect:

• IP address;
• browser type;
• operating system;
• device type;
• log files;
• error reports;
• usage statistics.

5. Sources of Personal Data

We collect Personal Data from the following sources.

Directly from You

For example, when you:

• register an Account;
• subscribe to the Service;
• contact customer support;
• send us an email;
• submit a contact form.

From Your Organisation

Where your employer or organisation creates an Account for you.

Through Your Use of the Service

Including automatically collected technical information, system logs and security events.

From Third-Party Service Providers

For example:

• payment service providers;
• authentication providers;
• analytics providers;
• cloud infrastructure providers.

6. Purposes of Processing

We process Personal Data only for legitimate and specified purposes.

These purposes include:

• managing User Accounts;
• providing the Service;
• sending SMS review invitations;
• managing customer communications;
• issuing invoices;
• processing payments;
• providing customer support;
• improving the Service;
• maintaining security;
• preventing fraud;
• complying with legal obligations;
• producing statistical reports;
• improving the reliability and performance of the Service;
• establishing, exercising or defending legal claims.

We do not process Personal Data for purposes that are incompatible with this Privacy Policy.

7. Legal Bases for Processing

We process Personal Data only where there is a lawful basis under Article 6 of the GDPR.

Depending on the circumstances, the applicable legal basis may include:

Performance of a Contract

For example:

• creating User Accounts;
• providing the Service;
• issuing invoices;
• managing payments;
• providing customer support.

Compliance with a Legal Obligation

For example:

• accounting;
• tax compliance;
• statutory record retention;
• responding to lawful requests from public authorities.

Legitimate Interests

For example:

• maintaining system security;
• preventing fraud;
• retaining security logs;
• improving the Service;
• managing customer relationships;
• establishing, exercising or defending legal claims.

Where processing is based on legitimate interests, we carry out an appropriate balancing test to ensure that the rights and freedoms of Data Subjects are adequately protected.

Consent

Where required by law, we process Personal Data based on your prior consent.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

8. SMS Review Invitations

Säuts enables businesses to send SMS invitations requesting Google reviews from their existing customers.

In these situations:

• the business generally acts as the Data Controller;
• Cloudexp OÜ acts as the Data Processor.

The business is responsible for ensuring that:

• it has a lawful basis for processing the Customer's Personal Data;
• Customers have been provided with the required privacy information;
• all applicable laws and regulations are complied with.

Cloudexp OÜ processes such Personal Data solely on the documented instructions of the business and in accordance with the applicable Data Processing Agreement (DPA).

9. Google Services

The Service may integrate with Google services, including Google Business Profile and other Google APIs.

Cloudexp OÜ does not control Google's processing of Personal Data and is not responsible for Google's privacy practices.

Your use of Google services may also be subject to Google's own terms of service and privacy policy.

We recommend reviewing Google's current Privacy Policy before using Google services through the Service.

10. Cookies and Similar Technologies

The Säuts Website uses cookies and similar technologies to ensure the proper operation of the Website, improve the user experience, and collect statistical information about the use of the Service.

Cookies may include:

• strictly necessary cookies;
• functional cookies;
• analytics cookies;
• marketing cookies.

Analytics and marketing cookies are used only where there is an appropriate legal basis, including your consent where required by applicable law.

Further information about our use of cookies is available in the Säuts Cookie Policy.

11. Google Analytics and Meta Pixel

Säuts may use the following analytics and marketing services:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• other comparable analytics technologies.

These services may collect statistical information regarding, for example:

• Website visits;
• visitor behaviour and navigation;
• conversions;
• advertising campaign performance.

Where technically possible, we enable IP anonymisation and other privacy-enhancing settings.

12. Automated Decision-Making and Profiling

Cloudexp OÜ does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on Data Subjects within the meaning of Article 22 of the GDPR.

The Service may perform automated functions such as:

• scheduling SMS messages;
• sending reminders;
• delivering system notifications;
• detecting technical errors;
• monitoring system health.

These activities do not constitute automated decision-making under Article 22 of the GDPR.

13. Data Processors

To provide the Service, Cloudexp OÜ engages carefully selected third-party service providers that process Personal Data on our behalf.

These providers may include:

• cloud infrastructure providers;
• SMS delivery providers;
• payment service providers;
• authentication providers;
• analytics providers;
• customer support platforms;
• email service providers;
• backup and disaster recovery providers.

Where required by Article 28 of the GDPR, Cloudexp OÜ enters into appropriate Data Processing Agreements with its Data Processors.

We engage only those providers that are capable of implementing appropriate technical and organisational measures to protect Personal Data.

14. International Transfers of Personal Data

As a general rule, Personal Data is processed within the European Economic Area (EEA).

Where Personal Data is transferred outside the EEA, such transfers take place only where an appropriate legal safeguard exists under the GDPR.

Such safeguards may include:

• an adequacy decision issued by the European Commission;
• the European Commission's Standard Contractual Clauses (SCCs);
• another transfer mechanism recognised under the GDPR.

Cloudexp OÜ implements reasonable technical and organisational measures to ensure an appropriate level of protection for Personal Data transferred internationally.

15. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations.

Retention periods depend on the type of Personal Data involved.

Examples include:

Once Personal Data is no longer required, it is securely deleted or irreversibly anonymised.

16. Security of Personal Data

Cloudexp OÜ implements appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, alteration, disclosure, loss or destruction.

Such measures may include, among others:

• encrypted communications (HTTPS/TLS);
• access controls;
• role-based permissions;
• multi-factor authentication;
• security logging;
• encrypted backups;
• continuous security monitoring;
• regular software updates;
• vulnerability management.

Although we implement reasonable security measures, no information system can be guaranteed to be completely secure.

17. Your Rights

Under the GDPR, you have several rights regarding your Personal Data.

Subject to applicable law, you have the right to:

• obtain information about how your Personal Data is processed;
• request access to your Personal Data;
• request correction of inaccurate or incomplete Personal Data;
• request deletion of your Personal Data ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interests;
• receive your Personal Data in a structured, commonly used and machine-readable format where technically feasible;
• withdraw your consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

Not every right applies in every circumstance, and the exercise of these rights may be subject to applicable legal limitations.

18. Exercising Your Rights

If you wish to exercise any of your rights under this Privacy Policy or applicable data protection law, please contact us at:

Email: tere@sauts.ee

Before responding to your request, we may ask you to provide additional information to verify your identity.

We will respond to legitimate requests without undue delay and, in any event, within one (1) month of receipt, unless a longer period is permitted under the GDPR.

Requests are generally handled free of charge unless they are manifestly unfounded or excessive.

19. Right to Lodge a Complaint

If you believe that Cloudexp OÜ has processed your Personal Data unlawfully or in violation of applicable data protection laws, we encourage you to contact us first so that we may attempt to resolve the matter promptly.

You also have the right to lodge a complaint with the competent supervisory authority.

In Estonia, the competent supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Tatari 39
10134 Tallinn
Estonia

Website:

https://aki.ee

The right to lodge a complaint does not affect your right to seek any other administrative or judicial remedies available under applicable law.

20. Responsibilities of Business Customers

Säuts is intended for businesses communicating with their existing customers.

Each business using the Service is responsible for ensuring that:

• it has a lawful basis for processing Customer Personal Data;
• Customers have received all legally required privacy notices;
• Customer contact details are used only for lawful purposes;
• the GDPR, electronic communications legislation and all other applicable laws are complied with;
• Google review requests comply with Google's applicable policies and guidelines.

Cloudexp OÜ does not verify the legal relationship between a business and its Customers and is not responsible for the lawfulness or accuracy of Personal Data entered into the Service by Users.

21. Children's Personal Data

The Service is not intended for individuals under the age of 18.

Cloudexp OÜ does not knowingly collect Personal Data from children.

If we become aware that Personal Data relating to a child has been submitted without an appropriate legal basis, we will take reasonable steps to delete such information without undue delay.

If you believe that a child has provided Personal Data through the Service, please contact us immediately.

22. Changes to this Privacy Policy

Cloudexp OÜ may amend this Privacy Policy from time to time in order to:

• comply with changes in applicable legislation;
• reflect changes to the Service;
• improve our privacy practices;
• implement guidance issued by supervisory authorities;
• improve the clarity and accuracy of this documentation.

The latest version of this Privacy Policy will always be published on our Website together with the date of the most recent update.

Where required by applicable law, we will provide reasonable notice of any material changes before they become effective.

23. Contact

If you have any questions regarding this Privacy Policy or the processing of Personal Data, please contact us.

Cloudexp OÜ

Registry Code: 16263842

Registered Address:

Juurdeveo tn 18-9
Kesklinn, Tallinn
Harju County 11313
Estonia

Email:

tere@sauts.ee

Website:

https://sauts.ee

24. Governing Law

This Privacy Policy is governed by the laws of the Republic of Estonia and the General Data Protection Regulation (GDPR).

If any provision of this Privacy Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

This Privacy Policy becomes effective upon its publication on the Website and remains in force until it is replaced by a newer version.