Privacy policy

CloudRoute is a free referral service that matches startups with vetted AWS consulting partners. The partner files the AWS funding only partners can request (MAP for migrations, POC for tests, incremental workload funding for new work on AWS) when the work qualifies and AWS approves it. Startups pay nothing. Partners pay CloudRoute a monthly membership plus 10% of AWS-approved funding. CloudRoute is not part of AWS and does not issue credits.

CloudRoute (“we”, “us”, “our”) operates cloudroutehq.com and provides demand-generation services to AWS consulting partners. This policy explains what personal data we collect, why, who we share it with, and the rights you have over it.

This is a plain-English summary. If anything here conflicts with our binding agreements (e.g. partner contracts), the contracts govern.

Who is the data controller

CloudRoute, registered in the United States, is the data controller for personal data submitted through cloudroutehq.com and processed in the partner dashboard (when launched). For matters under EU/UK GDPR, you can reach us at privacy@cloudroutehq.com.

What we collect

From visitors to cloudroutehq.com

• Analytics events — page views and anonymous counts of key steps (for example an application submitted, a partner workspace set up, an application portal claimed, a survey or check-in answered, a deal moved forward in the partner dashboard, a support request opened), captured by Vercel Web Analytics (by Vercel Inc.), which is cookieless and reports aggregated counts with no personal identifiers. Each event carries at most a couple of broad categories, such as the landing page, the kind of site that referred you, an option you picked from a list, or a range rather than an exact figure — never your name, email, company or anything you type. You can opt out via the cookie banner; declining stops both.
• Aggregate service counts — we also count milestones that happen on our side, such as an account being created, an application being reviewed, approved or matched with a partner, a partner being activated, a deal being routed to a partner or updated by our team or a connected CRM, a check-in email going out, or an invoice being issued or paid. These are not tied to your browser or visit and carry no personal identifiers.
• Advertising measurement (OpenAI Ads) — on our public pages, where allowed (see Cookies), the OpenAI Ads pixel tells OpenAI which pages you viewed and when you submit one of our forms, so we can measure our ads in ChatGPT. It reads contact details you type into those forms (such as your email or name) and sends only SHA-256 hashes of them, never the readable values.
• IP address and user-agent — collected in standard server logs (Vercel hosting) and used for security, rate limiting, and basic geographic aggregation. Retained for 30 days.
• Search and AI crawler visits. When a search engine or AI crawler (for example Googlebot, Bingbot, GPTBot, ClaudeBot or PerplexityBot) fetches a page, we log the page path, the crawler's name and the time. We identify crawlers by their user-agent only. The log holds no IP address and nothing about people, and we keep it for 180 days.

From founders who ask for a partner match

The inquiry form on our /for pages collects your name, email, which cloud you use, your funding stage, your monthly cloud spend and how you heard about us. With it we store the page you sent it from, the site that linked you there (referrer), any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content) and your browser's user-agent.

Where allowed (see Cookies), we also store the first page you opened on our site in that visit, the outside site that sent you there and the campaign tags on that first link. We keep the page path and the referring site's address without any query string. From all of this we file the inquiry under one channel, such as search, AI assistant, social, community, referral or direct.

We use these details to answer you, to match you with a partner, and to learn which channels bring founders to us. When we match you, the partner receives your contact details and what you told us so they can reach you. We do not sell your details.

Where allowed (see Cookies), our server also tells OpenAI that an inquiry was submitted, so we can measure our ads in ChatGPT. That report carries SHA-256 hashes of your email and name (never the readable values), your IP address, browser user-agent and IP country, and the OpenAI Ads cookies described below. It carries nothing else you told us.

From partner-program applicants

The application form collects: name, firm, work email, website, AWS Partner Network tier, region, capabilities, and any free-text notes you provide. We use this only to evaluate fit and respond to the application. We do not sell it. Where allowed (see Cookies), our server tells OpenAI that an application was submitted, with a SHA-256 hash of your email, your IP address, browser user-agent and IP country, so we can measure our ads in ChatGPT; nothing else from the form is shared.

From dashboard users (when launched)

Authentication identifiers (email, optional MFA factors) handled by Clerk; firm-level data including team members, integration credentials (encrypted), and lead-related records. Documented in detail in the dashboard's in-app privacy notice once it ships.

Why we collect it

• To deliver the service — route leads, run the partner application process, send notifications.
• To improve the service — aggregated analytics on what content and flows perform.
• To keep things working safely — rate limiting, abuse detection, audit trails.
• Legal compliance — invoicing records, data subject requests.

Who we share it with (subprocessors)

We share personal data only with the vendors below, only for the purposes described, and only under data-processing agreements that bind them to comparable protections.

Cookies

We use these cookies and similar technologies:

• Strictly necessary — session cookies set by Vercel for security. Cannot be disabled.
• Analytics — Vercel Web Analytics uses no cookies. You can still opt out via the banner; your choice is kept in your browser's local storage and in one first-party cookie (cr-analytics-consent) that holds only that choice, so our server can respect it too. We will not count your visits or the steps you take; only the aggregate service counts described above, which are not tied to your browser or visit, continue.
• Advertising measurement (OpenAI Ads) — on our public pages only (never in the partner dashboard, the founder portal or on personal links), the OpenAI Ads pixel from OpenAI sets its own first-party cookies (such as __obref, __oppref and __oaiq_consent) to recognise your browser and the ChatGPT ad you clicked. It reports the pages you view and the forms you submit, and hashes (SHA-256) any contact details you type into those forms in your browser before sending them. When you submit a form, our server sends OpenAI the same event, as described above. Same rules as the first-page record below: it runs only if you accepted in the banner, or if you have not chosen and you are outside the EU, the EEA and the UK. Declining stops it straight away, and our server then sends nothing for you either.
• Authentication — when you sign in to the partner dashboard or the founder portal, Clerk sets session cookies. Required to keep you logged in.
• Partner invite links — opening a CloudRoute partner invite link (/welcome/…) sets one first-party cookie, cloudroute_signup_code, that holds only that invite's code for 30 days, so a partner account created afterwards gets the terms the invite offers. We count how many partner workspaces each invite brings in, and an anonymous "set up through an invite" count in our analytics. It is not used for advertising, and scripts on the page can't read it.
• Session storage for the first page of your visit. Your browser's session storage (not a cookie) can keep the first page you opened on our site, the outside site that sent you there and the campaign tags on that link. It stays in your browser, is deleted when you close the tab, and reaches us only if you submit the inquiry form. We keep it only if you accepted analytics in the banner, or if you have not chosen and you are outside the EU, the EEA and the UK. To check that, your browser's time zone is read locally and, if needed, our server answers yes or no from your IP country without storing either. If you decline in the banner, nothing is kept and anything already kept is not sent.

Retention

• Application submissions, including the referral and first-page details stored with them: kept for 24 months from receipt unless you ask us to delete sooner.
• Crawler log: holds no personal data; kept for trend reporting.
• Analytics events: aggregated page-view and event counts in Vercel Web Analytics, kept for the retention period of our Vercel plan.
• Hosting logs: 30 days.
• Dashboard records (once active): kept for the life of the partner contract plus 24 months after termination, then deleted.

Your rights

Under EU/UK GDPR and equivalent laws, you can ask us to:

• Access the personal data we hold about you
• Correct anything inaccurate
• Delete it (subject to legal-hold exceptions)
• Export it in a portable format
• Object to processing or restrict it
• Withdraw consent for analytics and advertising measurement

Email privacy@cloudroutehq.com. We respond within 30 days.

International transfers

Several of our subprocessors are US-based. When personal data moves from the EU/UK to the US, we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, whichever is applicable to the specific subprocessor.

Security

Encryption in transit (TLS 1.3), at rest (provider-managed), MFA available for staff and partner accounts, principle-of-least-privilege access control, audit logging on every meaningful action. Security disclosures: security@cloudroutehq.com.

Changes

We'll update this page when our practices change. The “last updated” date at the top reflects the most recent revision. Material changes get a separate notice to active partners.

Contact

Questions: privacy@cloudroutehq.com. CloudRoute is based in the United States and operates globally.