QUOME CLOUD PRIVACY NOTICE

Last Updated: November 9, 2026
Approved: November 5, 2026, 1:24 AM PST
Document ID: QUOME-LEGAL-PRIVACY-CLOUD-001
Version: 1.2

Welcome to Quome Cloud — the cloud platform where you sign up, pick a region, and deploy apps, open sandboxes, and run databases on infrastructure that Quome owns and operates. This Privacy Notice explains how Quome, Inc. ("Quome", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal data in connection with Quome Cloud, its websites (including quome.cloud), its command-line tools and APIs, and any other specific product, service, or application that references or links to this Privacy Notice (the "Services").

Quome Cloud is the shared, Quome-operated edition of Quome. Quome Enterprise, in which Quome provisions infrastructure inside a customer's own cloud account, has its own privacy notice. The biggest difference for your privacy is that on Quome Cloud your content lives on hardware we own and operate, not in a cloud account you control. Section 2 describes exactly what that means.

This Privacy Notice does not address our privacy practices relating to Quome job applicants, employees, and other personnel, nor data that is not subject to applicable data protection laws (such as de-identified or publicly available information). This Privacy Notice is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

1. Our Collection and Use of Personal Data

The categories of personal data we collect depend on how you interact with us and our Services. You may provide us your personal data directly when you register for an account, create an organization, deploy an application, or contact us. We also collect personal data automatically when you interact with our Services and may collect personal data from other sources and third parties.

1.1 Personal Data Provided by Individuals

We collect the following categories of personal data that individuals provide to us:

Contact Information, including name, email address, and communication preferences. We use this information to fulfill your requests, communicate with you, and send product updates in accordance with your preferences.

Account Information, including name, email address, display name, the organizations you belong to and your role in each, and the authentication credentials held by our identity service (passkeys, one-time codes, or a sign-in through a third-party identity provider such as Google). We use this information to administer your account, provide the Services, communicate with you regarding your account and usage, and for user support. We do not store passwords in our control-plane database; authentication is handled by our identity service.

Legal Acceptance Records, including the version of the Terms of Service and this Privacy Notice you accepted, when, from which IP address and browser, and in what context. We keep these as evidence of your agreement.

Billing Information, including your organization's credit balance, grants, spending caps, usage, and, when you add a payment method, the token and last four digits our payment processor gives us. Full card numbers are collected and stored by our payment processor, not by us.

Customer Content, meaning any applications, source code, build artifacts, container images, files, databases, caches, bucket objects, secrets, environment variables, sandbox workspaces, terminal sessions, and communications you choose to upload to or create through our Services. We use this content only to provide the Services, as described in Section 2.

Linked Developer-Tool Credentials, meaning the login credential for a coding-agent vendor (such as Anthropic or OpenAI) that you choose to link so that agents inside your sandboxes can use your own account. We store the credential in our secrets manager, record only when it was linked and when it expires, and make it available only inside your own sandboxes. We do not use it for any other purpose.

Feedback and Support Information, including the contents of messages sent through contact forms, chat platforms, email, status-page contact forms, or other channels we make available (including through automated tools). We use this information to investigate and respond to your inquiries, communicate with you, and improve our Services.

If you contact us, we may need additional information to fulfill the request or respond to your inquiry. We may provide additional privacy disclosures where the scope of the request or personal data required falls outside the scope of this Privacy Notice. In that case, the additional disclosures will govern how we process the information you provide.

1.2 Personal Data Automatically Collected

We automatically collect information about how you access and use our Services.

Cookies and similar technologies. The Quome Cloud console sets no third-party cookies, pixels, or scripts. It uses cookies and browser storage set by our own code, in these categories:

• Strictly Necessary — your sign-in session (valid for up to seven days and refreshed as you use the console), a short-lived cookie that protects the sign-in handshake, an action you were in the middle of when you had to sign in again, and the record of your cookie choice itself. These cannot be disabled; the console will not function without them.
• Functional — preferences you set in the console, kept in your browser: terminal theme and font size, sandbox sounds, and which organization you had open. Off until you consent; the console then keeps these for the page only.
• Analytics, Marketing, and Social — we set none today. The categories stay in the banner so that adding anything to them is a visible change that asks for your consent again.

Your cookie choices. On your first visit we show a cookie consent banner that lets you accept all, reject all, or customize non-essential cookies, with "Accept" and "Reject" given equal weight. You can change your choices at any time from the /cookies preference center (linked from the banner, the sign-up page, the consent screen, and every legal page) or with the keyboard shortcut Shift+Alt+C. We honor the Global Privacy Control (Sec-GPC) signal: if your browser sends it, we automatically treat Marketing and Social as rejected without requiring you to interact with the banner. Because our network edge does not yet tell the console where you are, every visitor gets the opt-in treatment the EU's ePrivacy rules require.

A full inventory — every cookie and storage key, its purpose, duration, and storage type — is published at https://console.quome.cloud/cookies and is generated from the code that sets each item. Our Cookie Policy describes all of this in detail.

Evidence of consent. When you make a cookie choice, we record your consent ID, the categories you accepted, your IP address and user agent, the region we derived for you, the version of the Cookie Policy you saw, whether a GPC signal was detected, and which account was signed in at the time, if any. Each change adds a new record and marks the prior one superseded. We retain consent records for five years to satisfy GDPR Article 7 and ePrivacy burden-of-proof requirements. You can view your own consent history and reset your consent ID — clearing the association with your prior choices — from the /cookies preference center.

Device and Network Information, including IP address, browser type and version, operating system, and the hostname you requested. Our network edge records this for every request to the console, the API, and the applications and previews you publish, for security, rate limiting, abuse prevention, and troubleshooting. We derive an approximate country from the IP address using a geolocation database we run locally; no request data is sent to the database vendor.

Usage and Metering Information, including the resources each of your instances consumes (memory gigabyte-hours, disk and object-storage gigabyte-months, network egress gigabytes), when instances start and stop, build durations, and which features and pages of the console you use. Metering records are the basis of your bill.

Audit Records, including who (a user, an agent acting for a user, an API key, or a platform workflow) took which action on which resource, when, and from which IP address. Audit records let you and your organization's administrators review activity, and let us investigate security incidents.

Agent Activity, including the actions software agents take in your organization under a delegation you approved, attributed both to the agent and to you.

We use this automatically collected information to: (a) keep you signed in and secure the sign-in process; (b) meter and bill usage; (c) monitor, secure, and improve the Services; (d) measure aggregate metrics such as active users, instance counts, and error rates; (e) diagnose technology problems; (f) detect and prevent abuse; and (g) plan for and enhance the Services.

1.3 Personal Data from Other Sources and Third Parties

We may receive personal data from the following sources:

Single Sign-On: When you log in through a third-party account (for example, Google), we receive your name, email address, and an authentication token — not your login credentials — to verify your identity and provide access to the Services.

Employers and Organizations: If you interact with the Services in connection with your employment, we may receive your contact information from your employer or from the person who invited you to an organization.

Other Users: Other users may provide us with your personal data, such as your email address when they invite you to join their organization.

Inbound Email: If you or your organization create an inbound email address in the Services, we receive the messages sent to it (sender address, subject, body, and attachments), which may include personal data of the sender. See Section 2.8.

Service Providers: Our service providers that perform services on our behalf (for example, our payment processor) may collect and share personal data with us.

2. Customer Content on Quome-Operated Infrastructure

2.1 We Own and Operate the Hardware

Quome Cloud runs on servers that Quome owns and operates in facilities we control or lease in the United States. There is no public-cloud provider underneath the Services. Your Customer Content is stored on our disks, in our object storage, and runs on our processors. The regions we offer are shown in the console when you create an organization.

2.2 Shared Tenancy, One Virtual Machine per Instance

Many organizations' workloads run on the same physical servers. Every application replica, sandbox, database, cache, and build runs in its own virtual machine with its own workload identity, its own leased credentials, its own egress policy, and its own encrypted disk volume. Workloads of different organizations never share a virtual machine. Workloads are grouped into pools by kind (applications; databases and caches; sandboxes and storage) on separate private network segments, and connections between workloads are allowed only where you bound them together (for example, an app to its database). Secrets are released to a virtual machine only from our infrastructure, only for the secrets bound to that instance, and only while it runs.

2.3 Encryption

All Customer Content is encrypted at rest. Each service's disk volume, snapshots, backups, and bucket objects are envelope-encrypted under a per-service data key held in our secrets manager and rotated on a schedule; the secrets manager's own data is sealed at rest. All traffic between your browser or tools and the Services, and between our sites, is encrypted in transit with TLS. Secret values (environment variables you mark as secret, database credentials, linked developer-tool credentials) are stored only in our secrets manager — never in our control-plane database or logs — and revealing a secret value in the console requires a fresh sign-in and is recorded in the audit log.

2.4 Operator Access to Your Content

Quome personnel do not read the contents of your virtual machines, volumes, databases, caches, buckets, or secrets in the ordinary course of operating the Services. We access Customer Content only: (a) as necessary to provide, maintain, secure, or restore the Services (for example, to move an instance between servers, which copies its encrypted volume without decrypting it for a human); (b) to provide support you have requested; (c) to investigate a suspected violation of our Terms of Service or a security incident; or (d) as required by law or a valid legal process. Any such access by a person is logged in an audit trail. Nobody at Quome has standing access to your secret values.

2.5 Where Your Content Lives

Customer Content (volumes, snapshots, sandbox workspaces, databases, caches) stays in the region you selected for your organization. Object-storage buckets and the snapshots and backups we take may be replicated across our United States sites for durability. Control-plane data — resource names, configuration, deployment status, identity and membership records, audit records, metering and billing records — is replicated across our United States control sites so that no single site is a point of failure. We do not currently operate sites outside the United States.

2.6 How We Process Customer Content

We process Customer Content only as necessary to provide the Services and as directed by you. We do not sell Customer Content, use it for advertising, use it to train machine-learning or artificial-intelligence models, or process it for purposes unrelated to the provision of the Services. We may derive aggregated, de-identified operational statistics (for example, how much memory instances of a given size use on average) that do not reveal the contents of your Customer Content.

2.7 Bring Your Own Device and Community Hardware

If you enroll a computer you own as a node, your organization's workloads placed on it are stored on and run from that computer, under your physical control; Quome's node software on it reports health and usage to us and receives placement decisions from us. If your organization opts into community hardware, your sandboxes and stateless applications may run on a computer owned by another Quome Cloud customer. We encrypt traffic to and from community hardware and release secrets to workloads only from our own infrastructure, and we verify the integrity of what we place there. However, the owner of that computer controls its hypervisor and could, in breach of our Terms of Service, read the memory of a workload running on it. Confidentiality of data in use is not guaranteed on community hardware. Databases, caches, and secret stores are never placed on community hardware. You choose community placement explicitly, per organization.

2.8 Sandboxes, Coding Agents, and Inbound Email

Coding agents. When you run a coding agent (such as Claude Code, Codex, or a similar tool) inside a sandbox, the agent sends your prompts, files, and code to that tool's vendor using the account you linked, under that vendor's terms and privacy policy. That data goes directly from your sandbox to the vendor; we are not a party to that exchange and do not receive it. The egress rules on each sandbox list the vendor hosts it may reach.

Agents acting for you. Agents you connect to your organization act under a delegation you approve, with capabilities you choose and an expiry. Their actions are recorded in the audit log, attributed to the agent and to you.

Inbound email. If you create an inbound email address, messages sent to it are received by our email provider, fetched by an isolated worker, scanned for malware, and stored in our object storage encrypted; attachments that fail scanning are dropped. Messages are available to the members of the organization that created the address and are automatically purged after ninety (90) days. Inbound addresses are for testing and automation within the Services, and we do not read their contents except as described in Section 2.4.

3. Additional Uses of Personal Data

In addition to the uses described above, we may use personal data to:

• Fulfill the purpose for which the information was provided, including contractual obligations;
• Manage our organization and its day-to-day operations;
• Communicate with you via email, chat, social media, or telephone;
• Facilitate our relationship with you and, where applicable, the organization you represent;
• Verify your identity;
• Meter, bill, and collect payment for the Services;
• Administer, improve, and personalize the Services;
• Develop, operate, improve, maintain, protect, and provide the features and functionality of the Services;
• Identify and analyze how you use the Services;
• Create aggregated or de-identified information that cannot reasonably identify you, which we may use for purposes outside the scope of this Privacy Notice;
• Conduct research and analytics on our user base and Services;
• Test, enhance, update, and monitor the Services, or diagnose technology problems;
• Maintain the safety, security, and integrity of the Services, including the shared infrastructure and the other customers on it;
• Defend, protect, or enforce our rights or applicable agreements, resolve disputes, and protect our business interests and the rights of third parties;
• Detect, prevent, investigate, or provide notice of security incidents, fraud, or illegal activity;
• Comply with contractual and legal obligations; and
• Fulfill any other purpose for which you provide your personal data or consent.

4. Our Disclosure of Personal Data

We disclose or make available personal data in the following circumstances:

To Your Organization: If you belong to an organization in the Services, that organization's owners and administrators can see your name, email address, role, and activity in that organization (including audit records and the actions of agents you connect).

To Other Users and the Public: We make available personal data designed for sharing through the Services with other users or the public, based on applicable settings and intended recipients — for example, an application you publish at a public URL.

To Subprocessors and Service Providers: We engage a small number of third parties to perform services on our behalf — for example, delivering transactional email, relaying network traffic to our sites (encrypted end to end; TLS terminates on our own hardware), processing payments, and issuing certificates. These providers may process personal data on our behalf or have access to it while performing services for us. Our current list, with the role and data each one handles, is maintained in our Subprocessor List and at https://quome.cloud/legal/subprocessors. We tell you before adding or replacing a subprocessor.

To Facility Providers: Where our servers are housed in a facility we lease, the facility provider has physical access to the premises for power, cooling, and physical security. It has no logical access to our systems or your data, and our disks are encrypted at rest.

To Developer-Tool Vendors You Choose: When you run a coding agent in a sandbox using an account you linked, data flows from your sandbox to that vendor as described in Section 2.8.

In Connection with a Business Transaction: We may disclose personal data to third parties during negotiation of, in connection with, or as part of a merger, acquisition, joint venture, financing, sale of assets, bankruptcy, receivership, or similar transaction.

To Facilitate Legal Obligations and Rights: We may disclose personal data to third parties, including legal advisors and law enforcement: (a) in connection with legal claims; (b) to comply with laws or lawful requests; (c) to protect our rights, property, and safety, including the security of the shared infrastructure; (d) to detect or prevent fraud; (e) to collect debts owed to us; or (f) as otherwise required by law. Where we are legally permitted to do so, we will notify you of a request for your Customer Content before disclosing it.

With Your Consent or Direction: We may disclose personal data to third parties or publicly with your consent or direction.

5. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law. Factors we consider in determining retention periods include:

• The duration of our relationship with you;
• Whether there is a legal obligation to retain the data;
• Whether retention is advisable given our legal position (such as statutes of limitations, litigation, or regulatory investigations);
• The sensitivity of the data; and
• The purposes for which we collected the data.

Our standard retention periods for Quome Cloud are:

When personal data is no longer needed, we securely delete or de-identify it. Deleting an organization deletes its Customer Content on the schedule above; you are responsible for exporting anything you want to keep before deleting it.

6. Data Security

We implement reasonable and appropriate technical, administrative, and organizational measures to protect personal data and Customer Content against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit using TLS for all communications with the Services and between our sites;
• Encryption at rest of every volume, snapshot, backup, and bucket object under per-service keys held in our secrets manager and rotated on a schedule, with the secrets manager itself sealed at rest;
• Hardware-virtualized isolation: one virtual machine per instance, with its own identity, leased credentials, egress policy, and encrypted disk; workloads of different organizations never share a virtual machine;
• Per-workload identity and least privilege: every virtual machine, node, and service authenticates with its own short-lived credential; a compromised node can reach only the workloads scheduled on it at that moment, and those credentials can be revoked in one call;
• Secrets management: secret values live only in our secrets manager, never in our database or logs; revealing one requires a fresh sign-in and is audited;
• Strong authentication with passkeys and one-time codes, proof-of-possession tokens, and step-up re-authentication for sensitive actions;
• Audit logging of administrative actions, API calls, agent actions, and secret access;
• Network controls: a web application firewall, rate limiting, per-pool network segmentation, default-deny egress for databases and caches, and allowlisted egress for sandboxes;
• Role accounts, not root, for the node software and virtual machines on each server, with the minimum privileged operations allowed;
• Signed, verified platform images for every virtual machine we boot;
• Physical security at our sites, and encrypted disks so that a removed drive is unreadable;
• Regular security assessments and vulnerability management.

While we strive to protect your personal data, no method of transmission over the Internet, electronic storage, or hardware isolation is completely secure, and we cannot guarantee absolute security. In particular, shared processors have had published micro-architectural side channels; we rotate platform-held keys faster than published extraction times and avoid re-placing a sandbox beside the same neighbor, but if your workload cannot tolerate any other customer's code on the same processor, use dedicated placement or Quome Enterprise.

If we learn of a security breach affecting your personal data or Customer Content, we will notify you without undue delay and within the time required by applicable law.

7. International Data Transfers

Quome is headquartered in the United States, and all of our sites are in the United States. If you access the Services from outside the United States, your personal data and Customer Content will be transferred to, stored, and processed in the United States, and may be processed in other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country.

Where required by applicable law, we implement appropriate safeguards for international data transfers, such as Standard Contractual Clauses approved by the European Commission.

8. Your Privacy Choices

8.1 Email Communication Preferences

You can stop receiving product-update and promotional email by clicking the "unsubscribe" link in our emails or by contacting us at legal@quome.com. You cannot opt out of service-related communications (such as sign-in codes, organization invitations, billing and spending-cap notices, security notices, and changes to our terms).

8.2 Cookie Preferences

You can accept, reject, or customize non-essential cookies from the banner on your first visit and at any time afterwards from the /cookies preference center or with Shift+Alt+C. We honor the Global Privacy Control signal. You may also use browser or device settings to restrict cookies, but the console will not keep you signed in without its session cookie. See our Cookie Policy.

8.3 Account Data

You may access and update your account information through the settings pages within the Services. You may also request deletion of your account, or a copy of the personal data we hold about you, by contacting us at legal@quome.com. Deleting your account does not delete an organization that other members still belong to; an organization's owner can delete the organization and its Customer Content from its settings.

8.4 Agents and Linked Credentials

You can revoke an agent's delegation, and unlink a developer-tool credential, at any time from your settings. Revocation takes effect immediately for new requests.

9. Children's Personal Data

Our Services are not directed to, and we do not intend to or knowingly collect or solicit personal data from, children under the age of 13. If a child under 13 has provided personal data to us, we encourage the child's parent or guardian to contact us to request removal. If we learn that personal data has been provided by a child under 13, we will promptly delete it.

10. Third-Party Websites and Services

Our Services may include links to third-party websites, plug-ins, applications, and other services, and the applications you publish on the Services may be operated by you or by third parties. Except where we post, link to, or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to any personal data practices of third parties, including the developer-tool vendors whose accounts you link and the operators of applications hosted on the Services. Please review the privacy notices of any third-party services you interact with through our platform.

11. U.S. State Privacy Rights

11.1 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to: (a) know what personal data we collect, use, and disclose; (b) request deletion of your personal data; (c) correct inaccurate personal data; (d) opt out of the sale or sharing of your personal data; and (e) not be discriminated against for exercising your rights. We do not sell personal data or share it for cross-context behavioral advertising as defined under the CCPA/CPRA.

To exercise your rights, contact us at legal@quome.com.

11.2 Nevada Residents

If you are a Nevada resident, you have the right to opt out of the sale of your personal data. We do not currently sell personal data of Nevada residents as defined under Nevada law. You may submit an opt-out request by emailing legal@quome.com.

11.3 Other U.S. States

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and opt out of the processing of personal data. To exercise your rights, contact us at legal@quome.com.

12. European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR) or equivalent local law:

• Contractual necessity: To perform our obligations under the Terms of Service and provide the Services.
• Legitimate interests: To operate, improve, bill, and secure the Services and the shared infrastructure, provided our interests are not overridden by your rights and freedoms.
• Consent: Where you have given explicit consent, which you may withdraw at any time.
• Legal obligation: To comply with applicable laws.

For Customer Content, you (or your organization) are the controller and Quome is the processor, processing only on your documented instructions. Our subprocessors are listed in our Subprocessor List. A data processing addendum is available on request at legal@quome.com.

You may have the right to: (a) access your personal data; (b) rectify inaccurate data; (c) request erasure; (d) restrict processing; (e) data portability; (f) object to processing; and (g) lodge a complaint with a supervisory authority.

To exercise your rights, contact us at legal@quome.com.

13. Updates to This Privacy Notice

We may update this Privacy Notice from time to time. When we make changes, we will update the "Last Updated" date above. If we make material changes, we will notify you by email to your registered email address, by prominent posting on our website or in the console, or through other appropriate communication channels, and the console may ask you to acknowledge the new version. All changes are effective from the date of publication unless otherwise stated.

14. Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact us at:

Quome, Inc.
8605 Santa Monica Blvd, PMB 109399
West Hollywood, California 90069-4109 US
Email: legal@quome.com
Website: https://quome.cloud/legal/privacy

Document ID: QUOME-LEGAL-PRIVACY-CLOUD-001
Version: 1.0
Classification: Public