Privacy Policy
Last updated: 17 August 2026
1. Who we are
"Agaya Cloud" ("we", "us", "our") is the name under which TrueSignal is developed and operated from Madeira, Portugal. Agaya Cloud is currently in the process of formal company registration; this policy will be updated with our registered company name and number once that is complete. In the meantime, the contact details below identify who is responsible for the personal data described in this policy.
Contact: hello@agayacloud.com
2. Scope of this policy
This policy covers two things:
- agayacloud.com - this website, and any data you give us directly (for example, emailing us or joining a waiting list).
- TrueSignal - the delivery-triggered survey product we build and operate for our brand customers. TrueSignal is built in a separate codebase from this website, but is part of the same service, so this policy also explains, at a general level, how personal data is handled inside the product.
If you are a customer of a brand that uses TrueSignal and you've responded to a survey, please see Section 4 below: the brand you purchased from is the data controller for your information, and is your primary point of contact for privacy questions.
3. What data we collect
On agayacloud.com
- Usage data: pages visited, time on page, device/browser type, approximate location, and referral source, collected via Google Analytics and Microsoft Clarity - only once you accept analytics cookies (see our Cookie Policy).
- Contact data: name, email address, and company details you provide when you email us, join a waiting list (via our Tally form), or otherwise contact us.
Within TrueSignal
- Order identifier: a pseudonymous identifier generated per order and embedded in the survey link, used to invite the right customer to the right survey and to prevent duplicate or fraudulent responses. The brand sends the survey link to their customer directly (e.g. via their own email platform, using their own Shopify order and contact data) - TrueSignal does not receive or store the customer's name, email address, or shipping address - that information stays within the brand's own systems (e.g. their Shopify store).
- Survey responses: the answers a customer gives, linked only to the order identifier above, not to directly identifying information.
We do not knowingly collect special categories of personal data.
4. Our role: controller and processor
For website and waiting-list data, we are the data controller: we decide why and how that data is used, and this policy sets out the legal basis for that (see Section 5).
For data processed inside TrueSignal, we are a data processor acting on behalf of our brand customers. The brand is the data controller for its own customers' information: it remains responsible for telling its customers how their data is used (typically in the brand's own privacy policy) and for handling their rights requests. We process that data only on the brand's documented instructions, under a Data Processing Agreement with each brand customer (see Section 15).
If you are a survey respondent, you're welcome to contact us directly using the details in this policy - we will help you or direct your request to the relevant brand, as appropriate.
5. Why we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Understanding and improving site usage | Consent (Art. 6(1)(a)) |
| Responding to enquiries you send us | Legitimate interest (Art. 6(1)(f)) |
| Managing waiting-list sign-ups | Consent (Art. 6(1)(a)) |
| Operating TrueSignal for a brand customer | Processed under the brand's instructions and Data Processing Agreement (Art. 28) - the brand holds its own Article 6 basis for this processing |
6. Who we share data with
We use third-party processors to operate our services: Google Analytics (Google Ireland Limited) and Microsoft Clarity (Microsoft Corporation) for site analytics, Tally for waiting-list forms, and Amazon Web Services (AWS Europe) to host the TrueSignal application. These providers process data on our behalf and under their own privacy terms. We do not sell personal data. Sub-processors used within TrueSignal are also listed in our Data Processing Agreement (see Section 15).
7. International data transfers
TrueSignal application data (order identifiers and survey responses) is hosted on AWS infrastructure in the eu-west-1 (Ireland) region, within the European Economic Area. Some third-party tools used on this website, such as Google Analytics and Microsoft Clarity, may process data outside the EEA; where this happens, we rely on the safeguards those providers put in place, such as the European Commission's Standard Contractual Clauses.
8. How long we keep data
- Analytics data is retained according to the cookie durations set out in our Cookie Policy.
- Contact and waiting-list data is kept for no longer than 12 months after our last interaction with you, or until you ask us to delete it, whichever comes first.
- TrueSignal order identifiers and survey responses are retained according to the relevant brand customer's instructions under our Data Processing Agreement, and are deleted when that brand's data is deleted or the agreement ends.
9. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit, access restricted on a need-to-know basis, and hosting on reputable cloud infrastructure (AWS, eu-west-1). No system is completely secure, but we work to keep personal data appropriately protected.
10. Automated decision-making
We do not use personal data for solely automated decision-making that produces legal effects or similarly significantly affects you.
11. Children's data
Our website and TrueSignal are intended for business use and are not directed at children. We do not knowingly collect personal data from children under 16.
12. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data
- Object to or restrict certain processing
- Request data portability
- Withdraw consent at any time (this does not affect prior lawful processing)
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email hello@agayacloud.com. We will respond within one month, as required by GDPR (this may be extended by a further two months for complex requests, in which case we'll tell you why).
If you are a customer of a brand using TrueSignal, please contact that brand first, since it is the data controller for your information - we will assist the brand with your request as needed.
13. Data breaches
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will inform affected individuals directly where required by law.
14. Supervisory authority
Our lead supervisory authority is Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD). If you are based elsewhere in the EU/EEA, you may also complain to your local data protection authority; a full list is available via the European Data Protection Board.
15. For our brand customers
If your business uses TrueSignal, our processing of your customers' personal data is governed by a Data Processing Agreement (DPA), incorporating Standard Contractual Clauses where relevant. Contact hello@agayacloud.com to request a copy.
16. Changes to this policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do.