Scope and roles
EPR Buddy is a producer-side Extended Producer Responsibility compliance service operated by CloudBuddy Solutions under the applicable customer agreement. This notice applies to the EPR Buddy website, application, support interactions, and related connector services.
For producer compliance data, the customer determines why and how the data is processed, and EPR Buddy generally acts as the customer's service provider or processor. EPR Buddy is responsible for account administration, service security, billing records, and its own business operations.
EPR Buddy is intended for organizations and their authorized users. It is not directed to children, and we do not knowingly collect personal information from children under 16.
Data we handle
| Category | Examples | Typical source |
|---|---|---|
| Account information | Name, business email, role, authentication claims | You, your employer, or an identity provider |
| Producer profile | Company name, reporting states, registrations, reporting periods | Customer administrators and onboarding |
| Compliance inputs | Products, SKUs, packaging materials, weights, sales volumes, supplier files | Uploads, forms, and customer-authorized integrations |
| Compliance work product | Mappings, calculations, scenarios, reports, approvals, filings, source lineage | Generated from customer inputs and user actions |
| Support and AI interactions | Support messages, feedback, prompts, responses, tool calls, citations | Your interactions with enabled features |
| Service and security data | Request logs, correlation IDs, device and browser data, usage, security events | Collected when the service is used |
EPR Buddy is not designed to collect sensitive personal information such as health, biometric, racial, religious, or precise location data. Customers should not upload that information unless it is expressly required and authorized under their agreement.
How we use data
- Provide, secure, maintain, and support the EPR Buddy service.
- Validate producer inputs and calculate, explain, review, and report EPR obligations.
- Create audit trails, calculation lineage, approvals, workpapers, and customer-requested exports.
- Authenticate users, apply producer and role boundaries, and prevent misuse.
- Monitor reliability, diagnose errors, respond to support requests, and improve product workflows.
- Meet contractual, legal, regulatory, accounting, and security obligations.
We do not sell customer data or use it for cross-context behavioral advertising. We do not use one customer's producer data to expose that customer's records to another customer.
Retention
We keep information only as long as needed for the service, the customer agreement, security, dispute handling, and applicable legal or regulatory requirements. Typical periods include:
- Compliance filings, calculation lineage, mappings, approvals, and audit records: 7 years.
- Raw producer uploads: 2 years; processed artifacts tied to filings: 7 years.
- Operational logs: 90 days; security event records: 2 years.
- AI conversation transcripts: 30 days by default, or up to 2 years if the producer enables retention.
- User identity: while active and 90 days after closure; producer profile data: while active and 2 years after closure.
Legal holds or regulator retention requirements may require longer retention. Where deletion is restricted, personal fields may be anonymized while the required compliance evidence is preserved.
Security
EPR Buddy uses administrative, technical, and organizational safeguards designed for regulated producer data. These include encryption in transit and at rest, server-side producer and role boundaries, scoped and revocable connector access, audit logging, input validation, retention controls, vulnerability monitoring, and incident-response procedures.
No system can guarantee absolute security. Customers are responsible for protecting their own accounts, selecting appropriate user permissions, and promptly revoking access that is no longer needed.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information. Customer administrators can correct much of their organization's account and producer information directly. Other requests can be sent to the contact below.
If EPR Buddy processes your information for a customer, we may direct the request to that customer or assist the customer in responding. Some compliance and audit records cannot be deleted before the applicable retention period ends.
Users can disconnect an MCP client or revoke its access from EPR Buddy's Agent access settings. Customers can also disable optional AI features through their account configuration.
International use
EPR Buddy and its providers may process information in the United States and other locations where they operate. When required, contractual and other safeguards are used for cross-border transfers.
Contact us
Questions, privacy requests, and security concerns can be sent to info@cloudbuddyapps.com. Please include enough detail for us to identify the relevant account and request. Do not send passwords, access tokens, or sensitive producer data by email.
We may update this notice as the service, providers, or legal requirements change. Material changes will be posted here with a revised date and communicated as required by the customer agreement or applicable law.