Legal
This Privacy Policy explains what personal data Cloudmarlin LLC, a Delaware limited liability company ("Cloudmarlin", "we"), collects when you use cloudmarlin (the "Service"), why we collect it, how we use it, and what choices you have. It applies to cloudmarlin.com and any subdomain operated by Cloudmarlin.
For uploaded PCAPs: packet captures often contain personal data of third parties — IP and MAC addresses, hostnames, DNS queries, HTTP headers, and unencrypted application traffic. When you upload a PCAP, you act as the controller of the personal data inside it; Cloudmarlin acts as a processor on your instructions. Your responsibility to have a lawful basis for that processing is described in our Terms of Service.
The data controller for personal data collected through the Service is:
Cloudmarlin LLC
A Delaware limited liability company
Privacy contact: privacy@cloudmarlin.com
support@, privacy@, or similar inboxes.session is set on login to keep you authenticated. It is essential to providing the Service.We process personal data for the following purposes (with the GDPR lawful basis indicated where relevant):
We share personal data only with the third-party processors that help us run the Service. The current list is published at /subprocessors and is summarized below:
We may also disclose information when required by law, court order, or government request, or to protect the rights, property, or safety of Cloudmarlin, our users, or the public. If Cloudmarlin is involved in a merger, acquisition, or asset sale, we will provide notice before personal data is transferred and becomes subject to a different privacy policy.
| Data category | Retention |
|---|---|
| Anonymous PCAP uploads and reports | 24 hours from upload, then permanently deleted. |
| Authenticated reports (free and paid) | While your account is active; deletable at any time from your account. |
| Account profile and credentials | While your account is active; deleted within 30 days of account closure. |
| Pending email-verification tokens | 24 hours, then deleted. |
| Server access logs | Up to 30 days. |
| Billing records | As required by tax and accounting law (typically 7 years). |
Cloudmarlin's primary hosting is in Germany (Hetzner). When you upload data to the Service, it is processed and stored in the European Union. Some of our subprocessors (Stripe, Postmark, Google, hCaptcha) are based in the United States; transfers to them rely on Standard Contractual Clauses or, where applicable, the EU – US Data Privacy Framework. Where Cloudmarlin is the importer (e.g., from a UK or EU customer's perspective), we maintain appropriate safeguards.
cloudmarlin uses one essential cookie:
| Name | Purpose | Lifetime |
|---|---|---|
session | Keeps you signed in across requests and protects against CSRF. | Cleared when you log out or your browser session ends. |
This cookie is strictly necessary to operate the Service and is exempt from consent requirements under the EU ePrivacy Directive and equivalent laws. We do not use advertising, analytics, or tracking cookies on the Service. The hCaptcha widget on the signup page may set its own cookies under hCaptcha's control; see hCaptcha's privacy policy.
We use TLS 1.2+ for all traffic, store passwords as bcrypt hashes, and apply security headers including a strict Content-Security-Policy on the Cloudmarlin-controlled surface. Access to the production environment is restricted to authorized personnel and audited. No system is perfectly secure; we will notify affected users and supervisory authorities of personal-data breaches as required by law.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:
To exercise any of these rights, email privacy@cloudmarlin.com. We respond within 30 days; we may request information to verify your identity before acting on a request.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA gives you the right to:
To exercise these rights, email privacy@cloudmarlin.com. We do not use "sensitive personal information" as that term is defined in the CPRA outside of providing the Service.
The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@cloudmarlin.com and we will delete it.
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. We will notify users of material changes by email or by a banner on the Service.
For privacy questions or to exercise your rights, contact privacy@cloudmarlin.com. For other inquiries, see our Terms of Service.