Privacy Policy

Last updated: 27 October 2026

This policy explains what personal data Overclaud collects when you buy and use the product, why we collect it, who we share it with, and the rights you have. We keep the amount of data we hold deliberately small.

1. Who we are

Overclaud ("we", "us", "our") is a digital product operated by Taner Hassan, a sole trader based in the United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal data described here. You can reach us at [email protected].

2. The data we collect

We only collect what we need to sell you a licence, deliver it, and let you activate updates:

Data	Why we hold it
Your email address	To deliver your licence key and provide support.
Your email address, if you sign up for Field notes (with the date and the page you signed up from)	To send you our guides and release notes. Only collected when you subscribe.
Your email address, if you ask for a discount code on the checkout page (with the plan you were viewing, the code, and whether you opened checkout from the email)	To send you the code and at most one reminder before it expires. Only collected when you ask for it.
Stripe identifiers (customer ID, checkout session ID)	To link your purchase to your licence and handle billing queries.
Order attribution (campaign tags such as utm_source and fbclid, your cookie choice, the IP address and browser details of your checkout request unless you declined the Meta Pixel, and the pixel's browser identifiers if you accepted it), stored with your Stripe checkout session	To know which ad or link led to a sale and to report the purchase to Meta, unless you declined the pixel.
Your licence key and its metadata (status, plan, creation date, last-used date, usage count)	To validate the licence when you install or update, and to detect abuse.
Transient rate-limit counters tied to your licence key	To prevent automated abuse of the licence-validation endpoint. Automatically deleted within one hour.

We do not collect or store your source code, your Claude Code conversations, your API keys, or your credentials. The Overclaud configuration runs locally on your machine and does not transmit that information to us.

With your consent, we use the Meta (Facebook) Pixel to measure visits and the effectiveness of our advertising; it only loads if you accept it in the cookie banner. Separately, unless you decline the pixel, our server tells Meta about your visit through Meta's Conversions API: that you viewed a page or opened checkout (with the page address, the plan and price), your IP address and browser details, and, if the page address carries a Meta ad's click id (fbclid), that id. If you buy, it also sends one Purchase event with the order value and your email address in hashed form. This sets and reads nothing on your device; the pixel's cookie identifiers, and the ad click we keep in your browser, are added only if you accepted the pixel. While the cookie banner is unanswered, page events wait until you leave the page. If you decline, none of these events is sent. When you arrive from a tagged link (for example utm_source or fbclid), we keep those tags in your browser for up to 28 days and store them with your order to see which ad or link led to it. We also use Cloudflare Web Analytics, which counts visits without cookies and without identifying you. We set no other cookies of our own. See our Cookies Policy for details and to change your choice.

3. Card and payment data

We never see or store your card details. All payments are processed by Stripe, a PCI-DSS-compliant payment provider. Stripe collects and processes your card information directly under its own privacy policy.

4. Why we are allowed to process your data (legal bases)

Performance of a contract — to take payment, issue your licence, and deliver updates you have paid for.
Legitimate interests — to validate licences, prevent fraud and abuse, and provide support, in a way that does not override your rights.
Legal obligation — to keep transaction records for tax and accounting purposes.
Consent — to run the Meta Pixel and its cookies, which you can change at any time on the Cookies page.
Legitimate interests — to measure which of our ads bring visits and sales, through the server-side events described above. They use no cookies, carry no name or contact details except a hashed email address on a purchase, and stop as soon as you decline the pixel on the Cookies page.
Consent — to send Field notes emails, and the discount code and its one reminder you ask for on the checkout page. You can withdraw consent at any time with the unsubscribe or "skip the reminder" link in any email, or by emailing [email protected].

5. Who we share data with

We use a small number of trusted service providers ("processors") to run the product. We do not sell your data to anyone.

Provider	Purpose
Stripe	Payment processing and billing.
Meta Platforms	Advertising measurement: the Meta Pixel if you accept it, and the server-side events described above unless you decline it.
Resend	Sending your licence-key, support and discount-code emails.
Cloudflare	Website hosting, the licensing API, and secure storage of licence records.
GitHub	Hosting the private product repository. Your licence grants time-limited access to download it; we do not share your email or payment data with GitHub.

6. International transfers

Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as relied upon by the provider concerned.

7. How long we keep it

We keep your licence record and email for as long as your licence is active, so that you can install, validate, and update the product. We retain purchase and transaction records for as long as required by UK tax law (currently six years). Transient rate-limit data is deleted automatically within one hour. Field notes sign-ups are kept until you unsubscribe, then deleted. Discount-code requests are deleted automatically after 30 days.

8. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased, where we are not required to keep it;
restrict or object to our processing;
receive your data in a portable format;
withdraw consent where we rely on it.

To exercise any of these rights, email [email protected]. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

Licence records are stored in Cloudflare's infrastructure and transmitted over encrypted connections (HTTPS/TLS). Access to download the product is granted via short-lived, automatically expiring tokens rather than permanent credentials. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

10. Children

Overclaud is a developer tool intended for adults and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed. Material changes will be reflected here before they take effect.

12. Contact

For any privacy question or request, email [email protected].