Privacy Policy

CloudPay is a payroll, attendance, leave and HR service for businesses in Mauritius. It is operated by Cloudbox8 Ltd (“we”, “us”).

For any question about this policy or your personal data, write to info.cloudbox8@gmail.com.

Employee data. When a company (“your employer”) uses CloudPay, your employer decides what information about its staff goes into CloudPay and what it is used for. Under the Data Protection Act 2017, your employer is the controller of that data and we process it on its behalf and on its instructions. If you work for a company that uses CloudPay, please contact your employer first about your data; we help your employer answer.

Our own data. For the information we collect for ourselves (people who request access, our customers' account contacts, and visitors to this website) we are the controller.

Depending on the modules your employer uses and what it chooses to record, CloudPay may hold:

• Identity and contact: name, employee number, email, phone and WhatsApp number, address, date of birth, gender, marital status, nationality, photo, NIC number, and passport and work permit numbers.
• Employment: job title, department, workplace, supervisor, contract dates and type, notice period, salary history and documents your employer uploads.
• Pay: salary, allowances, overtime, loans, bank name and account number, PAYE, CSG, NSF and PRGF figures, payslips and statutory returns.
• Time and attendance: clock-in and clock-out times, your location at the moment you clock in or out (or record a check-point), a selfie at clock-in if your employer requires one, rosters, work-from-home sessions. CloudPay reads your location only at those moments; it does not track you in between.
• Leave and claims: leave requests and balances, expense claims and their receipts.
• Health information: blood type, allergies and preferred hospital, only if your employer records them (usually for emergencies), and sick leave. This is sensitive data under the Data Protection Act 2017 and is only held when your employer chooses to record it.
• Family and emergency: emergency contacts and dependants.
• Performance: KPIs, evaluations and goals, if your employer uses them.
• Messages: team chat messages and notifications.
• Technical: sign-in records, IP address, devices registered for notifications, and an audit log of changes made in CloudPay.

When you request access on this website, we collect your company name, your name, email, phone number, approximate headcount, your message and the IP address the request came from.

• To run CloudPay for your employer: calculate payroll, produce payslips and returns, record attendance and leave, and send the notifications your employer has switched on.
• To keep CloudPay secure: sign-in checks, two-step verification, rate limits against password guessing, and an audit log.
• To support our customers. When a customer asks for help, our support staff may view their account; that access is logged.
• To answer access requests and manage our customers' accounts and invoices.
• To meet our legal obligations.

We do not sell personal data, use it for advertising, or put advertising or analytics trackers on CloudPay.

CloudPay has an optional assistant that answers questions about payroll, leave and attendance. It is off unless your employer switches it on. When it is used, the question and the records needed to answer it (for example leave balances or payslip lines) are sent to our AI provider, Anthropic, to produce the answer.

We share data with these providers only so they can do their part in running CloudPay:

• Railway: hosts the CloudPay application (Singapore region).
• Supabase: hosts the database and stored files such as documents, receipts and selfies (Singapore region).
• Your employer's email server: CloudPay sends emails (for example payslips and leave decisions) through the email account your employer sets up.
• Meta (WhatsApp): only if your employer switches on WhatsApp notifications and you opt in; the message is sent through your employer's WhatsApp Business account.
• Apple, Google and your browser's push service: deliver push notifications to your phone or browser (a device token and the notification text).
• Anthropic: only if your employer switches on the AI assistant (see above).
• OpenStreetMap: map images shown in CloudPay are loaded from OpenStreetMap, which receives your IP address like any website you visit.

CloudPay's application and database run in Singapore, so personal data is stored and processed outside Mauritius. Data travels encrypted between your device, the application and the database.

• Encrypted connections (HTTPS) between your device and CloudPay, and between CloudPay and its database.
• NIC numbers, bank account numbers, passport numbers and work permit numbers are additionally encrypted in the database (AES-256).
• Passwords are never stored in readable form, only as secure hashes.
• Two-step verification for administrators, automatic sign-out after inactivity, and limits on repeated sign-in attempts.
• Each person sees only what their role allows, and changes are recorded in an audit log.

We keep a company's data for as long as it uses CloudPay. Your employer decides how long it keeps records about you, including payroll records it must keep by law.

• When a company leaves CloudPay, it can download a full export of its data first. The download link stays valid for 24 hours by default.
• The company's data is then permanently deleted after a grace period, 30 days by default.
• Read notifications are deleted after 90 days and email/message delivery logs after 30 days, by default.
• Deleted data can remain in our database provider's backups until those backups expire.

Under the Data Protection Act 2017 you can ask to:

• see the personal data held about you and get a copy;
• have inaccurate data corrected (in CloudPay you can also send a profile change request to your employer);
• have data erased or its use restricted, where the law allows;
• object to certain uses of your data.

For employee data, send your request to your employer; we will help it respond. For data we hold for ourselves, write to info.cloudbox8@gmail.com. You can also complain to the Data Protection Office of Mauritius.

CloudPay uses only the cookies it needs to work: keeping you signed in and protecting the sign-in. It also saves small preferences on your device, such as light or dark theme and banners you have dismissed. When installed on your phone, the app keeps its own files on the device so it opens quickly; your payroll and personal data are not stored there for offline use. We use no advertising or analytics cookies.

We will update this page when CloudPay or the law changes, and change the date at the top. Significant changes will be announced to our customers. See also our Terms of Service.