GENERAL ANALYSIS
Zoho and Google are both proprietary software suites, while Nextcloud is a free and open-source software suite. This means that Nextcloud by nature allows for more transparency and community-based auditing. Nextcloud can also be self-hosted, ensuring that the users complete of control over their data and files.
The Privacy Policies of these software suites reflect these ideals, with Google and Zoho offering far too little user control over what data is collected and stored when compared to Nextcloud. Nextcloud’s privacy policy only covers the data that is collected and stored when the user accesses their website, as its service can be self-hosted and no data can be collected by Nextcloud in that case.
Through our comparison of the privacy policies of Zoho, Google, and Nextcloud, and the subsequent analysis, it is clearly seen that Nextcloud offers the most security and privacy to the user’s data. Google’s Workplace suite of products is one of the most popular ones in the market, and offers the benefits that come with such popular adoption like easier collaboration. Nextcloud’s policies are more comprehensive, defined, and robust, offering more user control for specific types of data and maintaining a blanket objection/cancellation policy.
There are some concerns with how Zoho handles user data. Zoho shares user data with a list of partners it considers “authorized experts” to help with onboarding into the Zoho ecosystem, which could prove dangerous if these experts do not ascribe to strict data protection standards. Zoho also provides limited options for user control over data, even when compared to other proprietary suites like Google Workplace. On the encryption front, Zoho provides only the industry-standard level of encryption and data protection, with End-to-End Encryption being something the user has to choose for specific secure emails. Full-disk encryption is only provided by Zoho to data that is earmarked as sensitive, while Google offers it by default.
With regards to the Data Collection policies of these companies, all three-collect information for similar purposes, such as compliance with laws, service delivery, analytics etc. Nextcloud, which only collects data from users accessing its website, provides a robust, detailed list of heads under which it collects data for specific, limited purposes, and does not collect or store data for promotional or commercial use, and allows for users to object to data collection under any head, resulting in its deletion. Google collects the broadest spectrum of data including search history, identifiers, and user activity across services, but it also allows users to retain some control over some specified fields of data collection through its various tools like Privacy Checkup and Activity Dashboard. Zoho collects less data than Google, but it offers significantly less user control in the form of opt-out provisions or optional disclosures. The privacy policy also includes certain ambiguous language when dealing with Service Data, which is concerning.
The same dissonance also shows itself with respect to Data Retention, where Google retains more data for longer time periods, but provides more transparency and deletion options. Nextcloud, once again, retains specific data for limited purposes related to fulfilling contractual obligations or for legal compliance reasons. Zoho, however, has a blanket policy that data will be retained for as long as the services are used, post which the data will be deleted from backups within 9 months.
With respect to Data Sharing, only Nextcloud maintains that it ensures strict data protection and user privacy when sharing or transferring data to jurisdictions that the European Committee does not consider to be having an “adequate data protection regime.” Nextcloud’s policy states that these standards are enforced through standard-clause contractual obligations. Google also adheres to the European adequacy decisions along with other legal frameworks (like Brazil’s for example) when transferring data to another country. Zoho makes no mention of any compliance with adequacy decisions.
It might be easier for the Government of India to keep Zoho accountable and ensure compliance with access requests as Zoho appears to process Indian data on Indian servers, and is headquartered in India. With foreign companies like Google or even Nextcloud, compliance may depend on the Mutual Legal Assistance Treaty (MLAT) that India has with the company’s home country. This problem was seen very recently in M. Moser Design Associates (India) Pvt. Ltd. vs. Union of India & Ors. WP. (C) No. 2358 of 2025 , where Proton Mail denied compliance with specific requests to user data as it was governed by Swiss law.
While none of the privacy policies we analyzed are tailored to the DPDP Act, 2023, they are mostly aligned with the principles of the GDPR. In this respect, Nextcloud makes extensive reference to the GDPR in its policy and Zoho has special provisions in place for users in the European Economic Area. Google does not make any reference to any laws in its policy. It is also worth noting that all users that use Nextcloud are considered data subjects under GDPR by the company’s privacy policy and their rights to erasure, portability, objection, etc. are recognised explicitly, whereas Zoho only recognises these rights for EEA users.
SPECIFIC PRIVACY POLICY COMPARISON
| ZOHO WORKPLACE |
GOOGLE WORKSPACE (formerly G SUITE) |
NEXTCLOUD HUB | Analysis | |
|---|---|---|---|---|
| Nature of Software | Proprietary | Proprietary | Free and Open Source Software | |
| Hosting | Cloud-based hosting | Cloud-based hosting | Can be hosted on premise or with a trusted provider | |
| Products |
|
|
|
Zoho: Also includes a Notes app built-in with Zoho Mail |
| Privacy Policy | Available here | Available here |
Available here The Privacy policy does not cover what happens on individual Nextcloud instances, when users use the software. It explicitly deals only with the data collected and stored when users visit their websites. As Nextcloud offers the user the ability to either self-host or use a trusted provider to host its services, the user retains complete control over their data (in the case of self-hosting) or retains a significant amount of control (depending on the privacy policy of the hosting provider) |
Zoho: Tailored for compliance with European regime,
no mention of the DPDP Act, 2023 or the obligations thereunder. Google: Does not explicitly mention any compliance regime in its privacy policy. Nextcloud: Explicit reference only to GDPR, as Nextcloud is a European company based in Germany. |
| Nature of Data Collected |
A. Information provided by user
B. Information collected automatically
C. Information collected from third-parties
D. Service Data (Information collected through use of services and products) framed in policy as optional and opt-in
|
A. Information provided by user
B. Information collected automatically
C. Information collected from third-parties
|
Nextcloud offers self-hosting of its services, in which case the
user would retain complete control over their data. If Nextcloud is hosted using any of its trusted service providers, in such case, the data collection policies would depend on the provider. Nextcloud collects certain data from users who access their website, however their privacy policy comprehensively outlines what kind of data is collected, for what purpose, and specifies its deletion and objection policies as well in a robust manner. |
Zoho: Vague language in the Service Data section,
where the purposes listed for mobile devices is an inclusive list,
when it ought to be exhaustive. The policy also allows Zoho access
to “other information stored” on mobile devices without specifying
what this information could be. For data collected automatically and
service data, no clear user control mechanism is provided. Google: Provides more methods to erase data, and more settings to opt-out of certain data collection practices. However, the range of data collected by Google through its services is much higher than it is for Zoho. Nextcloud: Self-hosting Nextcloud would mean that no user data is collected by Nextcloud. With respect to website data collected, it provides a robust list of what sorts of data is collected, and collects less data overall than both Google and Zoho. |
| Basis for Data Collection |
Zoho’s privacy policy mentions three bases: – Contractual necessity – Legitimate interests of Zoho or a third party that are not overridden by user’s data protection interests – Consent (which can be withdrawn at any time) |
Does not mention any legal bases explicitly |
Within the framework of the GDPR, and Germany’s Federal Data
Protection Act, State Data Protection Acts, and Telemedia Act. Processing is done under these broad heads related to Article 6, GDPR:
|
Zoho: The legal bases are addressed to EEA users
alone, and are tailored to be compliant to GDPR and other European
regulations primarily. Nextcloud: Legal bases are tied explicitly to GDPR, without any explicit mention of DPDPA. However, the policy grants the rights under GDPR to any user whose data is processed by Nextcloud. |
| Purpose of Data Collection |
|
|
Specific purposes are mentioned for each type of data collected.
Broadly, these limited purposes include:
|
|
| Data Storage |
Service Data is either stored on Zoho servers when using Zoho
services, or transferred/shared to Zoho as part of technical
support/other service request. Data from mobile devices including location data will be stored locally on devices if using products and on Zoho servers if using Zoho services. |
Data is stored on Google’s global, interconnected network of data centers. These data center locations can be found here. | Personal data collected and generated through the website, during the provision of relevant products and services, are stored on Nextcloud servers in the European Union, but may be transferred to or accessed from other jurisdictions by providers of Nextcloud software solutions. If these jurisdictions do not meet the adequacy standards, strict data protection is enforced through standard contractual clauses. |
Zoho: Policy explicitly mentions storage mechanism
for Service Data alone. No clarity on storage mechanism for data
collected under any of the other heads. Google: Notably, none of the data centers listed are located in India. Nextcloud: Maintains that it follows strict data protection standards regardless of the country where data is being processed, ensuring this through contractual obligations. |
| Data Retention |
For as long as Zoho services are used.
On termination, data will be deleted from the active database within 6 months, and from backups within 3 months of deletion from the active database. |
Data is retained according to
this policy, for different periods of time depending on what it is, how Google
uses it, and how the user settings are configured.
|
Data will be deleted or blocked once the purpose of storing that data no longer applies. Data may be retained for longer if required under European and national regulations or laws, and will be deleted or blocked once such storage mandate expires. Data may also be stored for longer if necessary for the conclusion of fulfilment of a contract. |
Google: Retains more data for longer periods of
time, but provides specifically what kind of data it is, and for
what reason it is retained. Also provides more opportunities for the
users to delete specific personal information they have shared with
Google. Zoho: Most of the data that is non-optional and that does not have any opt-out feature will be stored for as long as the services are used. There is no periodic expiration like in Google. Further, even after account termination, this data is not deleted immediately. It may take up to 9 months for the data to be removed from all of Zoho’s servers. Nextcloud: Does not retain any data other than what is required to be stored for specified purposes. This goes hand-in-hand with the extensive user control over what data is stored or collected. |
| Data Sharing |
Details are shared with
Zoho entities
and authorized
partners
(resellers, analytics, marketing, eventorganizers etc.)
|
Information can be shared publicly by the user themselves on certain
services like YouTube. Google shares personal information (with consent) when Google services are used to interface with other services – like using Google Home to book a reservation, or when Google is used to authenticate a log-in. Explicit consent is asked before sharing sensitive personal information If the user’s organization/school uses Google services, the domain administrator and resellers who manage the account will have access to:
Google also shares personal information to affiliates (entities that belong to the Google group of companies) and other trusted businesses to externally process the information. Eg: Data Center operation, product and service delivery, additional support, YouTube content reviewers etc. Non-personally identifiable information (NPII) may also be shared publicly and with partners like publishers, advertisers, developers etc. Specific partners may also be allowed to collect information from browsers or devices for advertising and measurement purposes, eg: YouTube analytics, Merchants that use their own cookies to track data, etc. Google also shares personal information if there is good-faith belief that the information is needed to enforce Terms of Service; Prevent or address fraud, security, technical issues; Respond to applicable laws and regulations or government requests; or Protect against harm to safety, rights, property of Google, users, or public. Data may be transferred to servers around the world for processing. This data transfer will be compliant with certain legal frameworks, like UK, USA, Swiss, European, and Brazilian Adequacy Decisions. |
When self-hosted, Nextcloud does not collect any data to be able to share with partners. User data collected from contracts is shared to ensure contractual obligations are fulfilled, but this is done with express consent of the user, and in accordance with European adequacy decisions. If the countries do not meet these adequacy standards, Nextcloud specifies that it ensures strict data protection through standard contractual clauses and feedback mechanisms. |
Zoho: Shares user information with third-parties
to help users get acclimatised with Zoho services and to optimise
them. It is possible that partners may misuse the information to
contact users unwantedly. This could be dangerous and risky for the
users. Google: Shares the data with more entities, owing to its larger, global user base. Both proprietary systems share data with their entities based in other countries for data processing. Only Google mentions specific legal frameworks overseeing these transfers, but the DPDPA is missing. Nextcloud: Shares information only with explicit user consent for specified purposes, and in accordance with European adequacy decisions. Nextcloud acknowledges that data may be shared to countries that do not meet these adequacy standards and specifies how it ensures strict data protection in those cases. |
| User Control |
Users can opt-out of non-essential communications like newsletters
by unsubscribing. Essential communications include account
notifications, security incident alerts, security and privacy
updates, and transaction and payment related emails.
Users can disable cookies before interacting with Zoho’s sites. Users can also choose to not provide, edit, or delete optional profile information or when filling in forms. Users in the European Economic Area (EEA) are guaranteed rights to access, rectification, erasure, restriction of processing, data portability, objection, and complaint. |
If signed up, users can review and update information by visiting
the services. The Google Account also includes the Privacy Checkup feature which offers an overview of key privacy settings:
|
Users have the ability to object or cancel their consent for all types of data collected by Nextcloud, except that data which is required to be stored for certain legitimate purposes like contractual enforcement or for legal compliance reasons. |
Zoho: There are no explicit opt-out mechanisms put
in place, the policy describes voluntary disclosure of optional
information and unsubscribing from certain kinds of communications
alone. The data collected through application logs and mobile
analytics seems to not be part of any opt-out provision. Further,
only the rights of EEA users are explicitly recognised in the
policy. Google: Provides users with more control over specific types of data and allows users to manage and edit their tracked data in a more structured, compartmentalized manner. However, there are some dark patterns employed here as most of these user control mechanisms are either hidden deep within the privacy settings of the user account, or found in specific sites or pages that are not easily accessible or notified to the users. Nextcloud: Offers the most user control over what data is collected and stored by providing a vast provision to object or cancel the service or revoke consent. |
| Encryption |
Most Zoho
services
provide Encryption at Rest (EAR) and Encryption in Transit (TLS) by
default. This is the basic standard of encryption offered by most
cloud-based email providers. End to End Encryption is not built-in to any service yet, but Zoho Mail has a feature called ‘Secure Mail’ that allows users to send an encrypted email, using S/MIME or PGP encryption. For other services, data marked as sensitive is given full encryption protection. |
Google does not have End to End Encryption built into any of its
services yet.
Google provides default Encryption at Rest (EAR) for all its data. Gmail offers Encryption in Transit (TLS) automatically. This is the basic standard of encryption offered by most cloud-based email providers. Google also enforces full encryption by default for all data. |
Nextcloud offers the industry-standard Encryption at Rest (EAR) on
the server side as well as for local storage. TLS is also employed
for Encryption in Transit.
Additionally, Nextcloud provides End to End Encryption client-side from the Nextcloud desktop client 3.0 on a folder-level option. |
Zoho only provides full encryption by default for
data earmarked as sensitive, but Google does so for all data. Otherwise, both provide the industry standard level encryption for cloud-based services with slightly stronger encryption for certain specific Google services. Nextcloud, on the other hand offers End to End Encryption (E2EE) through the desktop client for folders. |
