Privacy & Your Data
This page summarizes how TimberCloud handles personal data and how you exercise your data rights. The authoritative document is the Privacy Policy (opens in a new tab).
What we collect
- Account information — name, email, company, role, and optionally phone number.
- Operational data — products, orders, customers, contacts, addresses, quotes, invoices, reviews, notes, and uploads you author in TimberCloud.
- Payment information — processed by Stripe; we never store full card numbers.
- Usage and device data — collected via cookies only after you opt in (see Cookies & Consent).
Your rights
Depending on where you live (GDPR Arts. 15–22 in the EU/UK; CCPA/CPRA in California), you can:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you. |
| Export / portability | Receive your data in a portable format. |
| Rectification | Correct inaccurate data. |
| Erasure | Have your data deleted ("right to be forgotten"), except records we must keep for legal/tax reasons, which we anonymize instead. |
| Restrict / object | Limit or object to certain processing, including marketing. |
| Withdraw consent | Turn off analytics/marketing at any time. |
How to export or delete your data
- From the dashboard: account holders can export and delete account-linked data from their account settings.
- By email: for anything the dashboard doesn't cover — or if you are the end-customer of a merchant's white-label storefront — email privacy@timbercloud.com. We respond within the timeframes required by law.
Note on erasure: Some records (for example invoices) must be retained for accounting and tax purposes. Where the law doesn't permit deletion, we anonymize the personal data rather than keep it identifiable.
Marketing email
Marketing email is opt-in. At signup there is a separate, unticked checkbox to receive product updates and tips. You can unsubscribe from any marketing message at any time, and it never affects transactional email (receipts, password resets, billing notices).
International transfers
Most of our service providers are US-hosted, so providing the service involves transferring data internationally. We use Standard Contractual Clauses and other safeguards for these transfers. See the Privacy Policy (opens in a new tab) and Sub-processors.
Retention
We keep personal data only as long as needed, then delete or anonymize it. Lead/contact-form, beta, and storefront submissions (including any stored IP) are purged by automated retention jobs. Specific windows are stated in the Privacy Policy (opens in a new tab).
Contact
Privacy questions and data-subject requests: privacy@timbercloud.com.