Privacy Policy

1. Who you’re dealing with

CloudMount.ai is a trade name of Cloud Mountain Graphics Ltd., a Colorado limited liability company based in Colorado Springs, Colorado, and cloudmount.ai is its website. Our company site is cloudmountaingraphics.com. They are one business, not two.

Whichever name you see — CloudMount.ai, CloudMount, Cloud Mountain Graphics, CMG, or a product name such as CloudEasel or WrapPort — your agreement, your account and your payments are with Cloud Mountain Graphics Ltd., and that is the company you are doing business with. In our legal pages, Cloud Mountain Graphics Ltd. is called “CMG,” “we” or “us.”

Cloud Mountain Graphics Ltd. is responsible for the personal information this policy describes.

Our postal address is Cloud Mountain Graphics Ltd., 3609 Austin Bluffs Pkwy, Ste 31-1085, Colorado Springs, CO 80918. You can reach us through the contact form on this site or at [email protected].

2. What we collect

Most of it you give us directly. Some is created as you use the site:

• Your account: your name, email address and company. Your password is handled by our sign-in provider and stored only in scrambled (hashed) form. If you sign in with Google, Google gives us your name, email address and, if you have one, your profile picture.
• Contact and lead forms (the contact page, website audit and project assessment): your name, email, and what you tell us about your project, business, goals, timeline and budget.
• Projects: files you upload, messages you send in the client portal, deliverable feedback, approvals, estimates and agreements — including when, and from which IP address, an estimate was opened or accepted.
• Designs you make in our editors — websites, cards, wraps and the business details you type into them.
• Purchases and subscriptions: what you bought, the plan, amounts and payment status, and, for print orders, the shipping address. Payment is handled entirely by Stripe — we never receive or store your card number.
• Meetings: if you join a video meeting with us, audio and video pass between the people in the call. We record only if the host starts a recording, and everyone in the call sees a Recording indicator the whole time. A recording becomes a transcript and AI-written notes; the audio is deleted after 30 days unless we mark that recording to keep.
• The Ask assistant: what you type or say to it and the page you were on. Questions it cannot answer are saved so that we can improve its answers.
• Technical information: your IP address, browser type and the time of a request, used to keep the site secure, to limit abuse, and to deliver pages.

3. How we use it

• To respond to inquiries and provide quotes and assessments.
• To deliver what you bought: run your project or subscription, communicate with you, share files and deliverables, print and ship orders, and collect payments.
• To send transactional email — order confirmations, receipts, account invitations, project notifications, and reminders about estimates, proofs, balances and renewals.
• To send marketing email: follow-ups after you ask about a project or start an assessment, and, occasionally, a note to a business we think we can help. Every marketing email carries our postal address and a way to opt out — reply “stop” and we will not send you marketing email again.
• To keep the site, portal and payments secure, and to screen for misuse under our acceptable-use rules.
• To improve the site, our tools and the assistant.
• To meet legal, tax and accounting obligations.

4. AI features

Several features send what you give them to an AI model provider to produce a result: the project assessment, the Ask assistant, design and copy suggestions in our editors, image generation and upscaling for wrap designs, and meeting transcripts and notes. Only what the feature needs is sent — never your payment details. We do not use your content to train AI models.

The Ask assistant is an AI, not a person, and it says so. It can be wrong: the prices and quotes that count are the ones on the checkout page and in your estimate.

5. Service providers

We share personal information only with the providers we need to run the service, and only what each needs:

• Stripe — payments, subscriptions and the billing page where you manage or cancel a plan (Stripe handles your card details under its own privacy policy).
• Supabase — our database, sign-in, file storage and server functions.
• Cloudflare — hosting and delivery for this site and the sites we host for clients, a relay for video meetings, and some AI processing.
• Google — Google Workspace for our email, Google sign-in if you choose it, and Google business listings and page-speed data about businesses (not about you as a visitor).
• Resend — sends our transactional and follow-up email.
• AI model providers — Anthropic, Replicate, fal.ai and OpenRouter — process only what an AI feature is given, as described in section 4.
• UPS and FedEx — shipping quotes and delivery for print orders.
• The social platforms you choose to connect (section 8).

6. Businesses we contact

We research local businesses we think we can help, using public sources such as Google business listings and the business’s own website. We keep the business’s name, address, public phone number and website, and notes from our contact with it. If one of our representatives visits, they may keep notes and a written transcript of the conversation; the audio itself is not kept.

If you would rather we did not contact your business, tell us and we will stop.

7. Websites we run for our clients

When we build or host a website for a client, the enquiries, bookings and messages its visitors send are stored for that client. We handle that information on the client’s behalf, to run their site and their business system. The client is responsible for its own privacy notice, and requests about that information should go to the client first — we will help them answer.

8. Connecting your social accounts

If you ask us to publish to your social accounts, you connect each account yourself through that platform’s own sign-in screen, and you choose whether to allow it. We never ask for, see, or store your social media password.

• What we receive: an access token issued by the platform, a refresh token where the platform provides one, your account name, handle, profile image, and account identifier. That is what appears in your dashboard so you can tell which account is connected.
• What we do with it: publish only the posts you have created and approved in your account with us, at the times you scheduled them. Nothing is posted that you have not approved.
• Platforms we connect to and the permissions we request: Meta (Facebook Pages and Instagram) to publish posts to a Page or Business account you manage; LinkedIn to share posts as you; X to post on your behalf; TikTok to upload video content. Each platform shows you these permissions before you agree to them.
• We do not read your private messages, we do not post advertising, and we do not use anything from your connected accounts to build a profile of you or to train models.
• Tokens are encrypted at rest and used only to publish your scheduled posts. We refresh them automatically so your connection keeps working, and we stop using them the moment a connection is removed.
• You are in control: disconnect an account from your dashboard at any time, or revoke our access directly in that platform’s own settings. Either one takes effect immediately, and we delete the stored tokens when a connection is removed.

9. What we don’t do

• We do not sell or rent your personal information.
• We do not store payment card details.

10. Cookies and what we keep in your browser

Almost everything below is stored by your own browser rather than sent to us — it stays on your device and we cannot read it from ours. We still list it, because it is your device and you are entitled to know what is on it.

Anything that is not strictly necessary loads only after you allow it. Nothing in the optional categories runs before you have made a choice, and you can change or withdraw that choice at any time using the “Cookie settings” link at the bottom of any page — turning something off is the same one click as turning it on.

Where the law where you live requires consent before optional storage (the EU, the UK, Switzerland and Brazil, among others), we apply that stricter standard. Where it requires an opt-out instead, we honour the Global Privacy Control signal your browser can send, and we treat that signal as a refusal without asking you to click anything.

• sb-*-auth-token — Strictly necessary. Supabase (Cloud Mountain Graphics). Kept 1 hour, refreshed while signed in. Keeps you signed in to your portal. Without it every page would ask for your password again.
• cmg.signCart.v1 · cmg.signCart.shipping.v1 · cmg.signCart.zip.v1 — Strictly necessary. Cloud Mountain Graphics. Kept until you clear it. Your basket, the shipping option you picked and the ZIP you entered for a shipping quote.
• est-token:<id> — Strictly necessary. Cloud Mountain Graphics. Kept until the tab is closed. Holds the access token from an estimate link so a refresh does not lock you out of your own quote.
• cmg.chunk.reloaded · mr-inuse-reloaded — Strictly necessary. Cloud Mountain Graphics. Kept until the tab is closed. A one-shot guard so a failed script load reloads the page once instead of looping.
• cmg.cardstudio.chrome.v1 · cmg.editorMode.v1 · cmg.cardRulers.v1 · cmg.cardGuides.v1 · cmg.cardGuidesLock.v1 · cmg.cardFilmstrip.v1 — Preferences. Cloud Mountain Graphics. Kept until you clear it. Remembers how you left the design editor — Simple or Pro, which panel was open, rulers and guides on or off.
• cmg.cardDetails.v1 — Preferences. Cloud Mountain Graphics. Kept until you clear it. The business details you typed into a design, so the next template opens already wearing them.
• wrapport.screen-px-per-in — Preferences. Cloud Mountain Graphics. Kept until you clear it. Your screen calibration, so a vehicle preview is shown at a true size.
• cmg.assistant.optin · proof-room:seen · cmg.rep.checklist.dismissed · cmg.joinOffer.seen.v1 · cmg.joinOffer.visits.v1 — Preferences. Cloud Mountain Graphics. Kept until you clear it. Small "you have already seen this" flags, so a panel you dismissed stays dismissed and an invitation you ignored is not shown a third time.
• _ga · _ga_* — Analytics. Google Analytics. Kept 13 months. Counts visits and which pages get read, so we know what to write more of. Not used to advertise to you. Data is processed in United States.
• _gcl_au · _gcl_aw · _gcl_gb — Advertising. Google Ads. Kept 90 days. Tells us whether a visit that started from one of our Google ads ended in a message, a call or an order, so we stop paying for ads that do not work. Not used to follow you around the web with ads. Data is processed in United States.

11. How long we keep it

We keep inquiry and lead information as long as it is useful for responding to you. Client account, project, order and subscription records are kept for the life of the client relationship and as long as tax and accounting rules require. Meeting audio is deleted after 30 days unless we mark a recording to keep; transcripts and notes stay with the meeting. Project files may be removed after a project concludes; keep your own copies of final deliverables once delivered.

12. Your privacy rights

Whatever state you live in, you can ask us to:

• tell you what personal information we hold about you, where it came from, what we use it for and who we share it with, and give you a copy in a portable format;
• correct it;
• delete it, apart from records we must keep, such as completed orders and tax records;
• stop sending you marketing email.

13. How to use those rights

Send us a message through the contact form, email [email protected], or write to Cloud Mountain Graphics Ltd., 3609 Austin Bluffs Pkwy, Ste 31-1085, Colorado Springs, CO 80918. We will confirm it is you before acting — usually by replying to the email address on your account — and answer within 45 days. You can ask someone to make a request for you as your authorised agent; we will check that they are authorised.

If we turn down a request, you can appeal by replying to our answer, and we will respond to the appeal within 45 days. If you are still unhappy, you can contact your state attorney general. We will not charge you more or treat you differently for using these rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of there; we honour the Global Privacy Control signal anyway. Some of these rights come from laws such as the California Consumer Privacy Act and the Colorado Privacy Act, which may not all apply to a business our size — we offer them to everyone regardless.

14. Security

Client data is protected with authenticated accounts, per-client access controls at the database level, and private file storage. No internet service can guarantee perfect security, but we build with access restricted by default.

One exception, by design: artwork you upload in WrapPort (and the design proof image) is stored at an unguessable, unlisted web address so your design can be shared by link and printed — treat wrap designs as shareable, not confidential.

15. Children

Our services are for businesses and adults, and you must be 18 to create an account. The site is not directed at children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it.

16. Where your information is processed

We are based in the United States. Your information may be processed in the United States and in other countries where our service providers operate.

17. Changes

If we change this policy, we will update it here with a new effective date. Material changes will be flagged on this page, and we will email account holders about them.