Last updated: 25 October 2026
This policy covers yourcloudgroup.com and salesserver.yourcloudgroup.com, operated by Yourcloudgroup Inc, a California
corporation, 2150 Portola Ave, D#141, Livermore, CA 94566. It does not cover 3minutetip.com or
yourcloudblog.com, which have their own pages.
1. What we collect and why
- Account: your email address, your name, your password (stored only as a one-way hash, never in
readable form), whether your email address is verified, your email preferences and the date you registered. Used to
sign you in and to send you account email.
- Subscriptions and billing: your plan, start and end dates and status; your Stripe customer and
subscription identifiers; for refunds, the amounts, dates and Stripe refund identifiers. We never receive or store
your card number. Used to provide and bill your subscription.
- AWS Marketplace purchases: the customer identifier and entitlement details that AWS sends us. Used
to link your AWS subscription to your server.
- Your dedicated server: its hostname, AWS instance identifier, region, public and private IP
addresses and running status. Used to provision, operate and display your server.
- Labs: the email address, name and group size you register with, invitation and purchase records,
attendance and, when you complete a lab, your certificate (name, email address, lab title and completion date). Used
to run the lab and issue and verify the certificate.
- Email records: for each email we send you, its type, the recipient address, the delivery status
and the time. Used to confirm delivery and stop duplicates.
- Security and audit records: actions on your account and on your subscription, and, for payment
notifications and security events, the IP address of the request. Used to detect fraud and abuse and to investigate
faults.
- Server access logs: for every request to this site, our web server records the IP address, the
time, the requested address, the response status and size, the referring page and the browser identification
(user agent). Used to operate the site, block abuse and investigate faults.
- Page counts: for each page address, the number of visits per minute. This count holds no
information about you.
- Website analytics, only if you press Accept: see section 7.
The AI School is not open. Its data practices will be published before it opens.
2. Your dedicated server
Each subscription runs on its own virtual machine in Amazon Web Services. Your files and models stay on that server.
Automated systems access it for health monitoring, security patching, backups and refreshes, and we access it to give
support you request. We do not use the data or models on your server for any other purpose.
3. Legal basis for each use
- Your account, subscription, dedicated server, AWS Marketplace link, labs and certificates:
performance of our contract with you.
- Account email (verification, receipts, server and subscription notices): performance of our
contract with you. We send no marketing email from this site; if we start, we will ask for your
consent first.
- Billing and refund records: our legal obligation to keep tax and accounting records, which we
keep for 3 years.
- Security and audit records, server access logs and page counts: our legitimate interest in
keeping the site and your server secure and working.
- The
ycg_session cookie: strictly necessary to sign you in and to protect forms.
- The
ycg_analytics_consent cookie: strictly necessary to remember your choice.
- Website analytics: your consent, which you can withdraw at any time (section 8).
- A home-page video, if you press play: your request to watch it.
4. Who receives your data
We do not sell your data and we do not share it for advertising. Only these providers receive it, and only what is
listed:
- Amazon Web Services (Amazon Web Services, Inc.): hosts this site, our database, your dedicated
server and all backups, in the AWS region us-east-2 (Ohio, United States). It stores everything in section 1. If you
buy through AWS Marketplace, AWS also handles that purchase and its billing.
- Stripe (Stripe, LLC): processes card payments. You enter your card details on
Stripe's own checkout page; we send Stripe your email address, your name, the plan or lab you chose and our own
reference numbers for your account and order, and Stripe tells us whether the payment succeeded. See the
Stripe Privacy Policy.
- Brevo (Sendinblue SAS, trading as Brevo): delivers our email. It receives your email address, your name and the content of each message we send
you.
- Google (Google LLC): receives website analytics only if you press Accept (section 7). If the home
page shows a video, nothing is requested from YouTube until you press play; the player then loads from
youtube-nocookie.com, and Google receives your IP address, your browser identification and the address of the
page.
- Authorities: only when the law requires us to disclose data.
Every page, style, script, font and preview image on this site is served from our own server. Apart from Google
Analytics after you accept, and a video after you press play, your browser contacts no other site while you read
these pages.
5. Where your data is processed, and international transfers
We store and process your data in the United States, in AWS region us-east-2 (Ohio). We do not send your data to
any AI or large language model service. Apart from the providers listed in section 4, no outside company handles
your data. Stripe and Google process the data they receive in the United States; Brevo processes it in the European
Union (France, Germany and Belgium). If you are in the European Economic Area, the United Kingdom or Switzerland,
your data is therefore processed in the United States. If you would like your server in a different AWS region, we
can accommodate that: please contact
hostmaster@yourcloudgroup.com. Each provider states its own
mechanism:
- Amazon Web Services: covered by Amazon.com, Inc.'s certification to the EU-U.S. Data Privacy
Framework, and certified to the Swiss-U.S. Data Privacy Framework.
- Google LLC: certified to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension,
and uses Standard Contractual Clauses where they are required.
- Stripe, LLC: certified to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK
Extension, and relies on Standard Contractual Clauses for some transfers.
6. Cookies
ycg_session: a first-party cookie set by our server, for sign-in and to protect forms against
forgery. It expires 4 hours after your last request. It cannot be read by page scripts (HttpOnly) and is sent only
over HTTPS.ycg_analytics_consent: a first-party cookie that stores your Accept or Decline choice, so the cookie
banner does not appear on every page. It lasts 180 days._ga and _ga_0VC0X7G24X: set on our domain by Google's Analytics script, and only after
you press Accept. They hold a random identifier for your browser and the state of your visit, which the script
sends to Google. Each lasts 400 days.
We set no other cookies. Stripe's checkout page, on stripe.com, sets its own cookies under the Stripe Privacy
Policy, and a YouTube player you start sets cookies under Google's policy.
7. Website analytics (Google Analytics 4): off unless you accept
Analytics is off until you press Accept in the cookie banner. Until then no Google script is loaded and no
data is sent to Google. Pressing Decline, or making no choice, changes nothing about how you can use this
site.
If you accept, Google Analytics 4 (Google LLC) receives: the pages you view and the page you came from; your
browser, device type, operating system, screen size and language; the random identifier in the _ga
cookie; and the time and length of your visit. Google uses your IP address to work out your approximate location
(country, region and city) and states that Google Analytics 4 does not log or store IP addresses. We have turned off
Google signals and ad personalisation. We use analytics only to count visits and to see which pages are useful.
Google keeps analytics data for the Google default of 2 months.
8. Withdrawing consent
At the bottom of any page, choose Cookie settings, then press Decline. Analytics stops on that page
at once, the Google script is not loaded again, the _ga and _ga_0VC0X7G24X cookies are
deleted from your browser, and your choice is stored for 180 days. Data already sent to Google stays with Google
until the retention period in section 7 ends. Deleting this site's cookies in your browser also removes your choice,
and the banner appears again.
9. Where analytics never runs
Analytics never runs on the free course (/learn), which sets no cookies and makes no request to any
other site, or on AI School pages (/school), whatever you choose.
10. How long we keep data
- Account, subscription, lab and certificate records: while your account exists, and for 3 years
after it closes.
- Backups of our database and site files: our routine schedule keeps them for 14 days. A small number of older
copies made before this schedule are under review and will be deleted.
- Backups of your dedicated server: while your subscription runs, our backup schedule takes an automated backup
every 2 days and keeps it for 7 days. We are fixing a fault that can leave a server out of that schedule, so please
keep your own copy of any data you can't afford to lose.
- When a subscription ends, we take a final backup of the server and then remove the server. We don't yet delete
final backups automatically. Older final backups are under review, and we will update this policy when automatic
deletion is in place.
- Server access logs: no automatic deletion is configured today.
- Analytics data at Google: see section 7.
11. Security
Every page is served over HTTPS (TLS). Passwords are stored only as one-way hashes. Backup files are stored in Amazon
S3, which encrypts every stored object. Server images and disk snapshots are stored in Amazon EC2 in the same
region.
12. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop or limit how we use it, and you can
object to its use. Email hostmaster@yourcloudgroup.com from the
address on your account. We reply within 7 days. You can also complain to the data protection
authority where you live.
13. Children
This site and its services are for people aged 18 or over. We do not knowingly collect data from anyone under 18.
14. Changes to this policy
We publish every change on this page and update the date at the top.
15. Contact
Privacy questions: hostmaster@yourcloudgroup.com.