Legal
Privacy Policy
Version 3.1 · Effective date: September 2026
1. Scope
This Privacy Policy describes how File-Me (“File-Me”, “we”, “us”) collects, uses and shares personal data when you use our secure file-transfer platform, including the web application, API and any associated services (the “Service”).
File-Me is a business-to-business (B2B) product. The primary users are organisations and the employees, contractors or agents they invite. If you received a secure file link from a File-Me customer, that customer decides why and how the transfer happens. This policy still covers the limited data we process to deliver the file to you.
This policy is information about how we handle personal data. It is not a contract, and you are not asked to agree to it. The Terms of Service govern your use of the Service.
2. Who is responsible for your data
File-Me is operated by [Tillgren Works AB], company registration number [org.nr], [registered address], Sweden. Contact: privacy@file-me.com.
Our role depends on the data:
Data Our role Who decides the purpose
Account and identity data, billing data, security and technical logs, audit logs, download events, webhook delivery records Controller We do
Data about transfers that a customer organisation sends or requests, including recipient e-mail addresses, file names and the encrypted file content Processor, acting for the customer The customer organisation, which is the controller
Where we are a processor, we act only on the customer's documented instructions, under the data processing agreement that forms part of our Terms of Service. If you are a recipient or an employee of a customer and want to exercise your rights over such data, contact that customer first. We will help them respond.
3. Data we collect
3.1 Account and identity data
When you or your organisation creates an account, we collect your name, e-mail address and authentication credentials. Authentication and session management are handled by Clerk. We also store your plan tier (FREE, PRO, ENTERPRISE or VIP) and any API keys you generate. If an organisation gives you access, its administrators can see account-level information about you, such as usage and link metadata. They cannot see the content of files unless they hold the key.
3.2 Transfer and file metadata
When you send or request files we store metadata about those transfers: sender and recipient e-mail addresses, file names, file sizes, expiry settings, transfer status and timestamps. We do not store the content of your files in readable form. All file data is encrypted in your browser using AES-GCM before upload. By design, the encryption key stays in the URL fragment and is not sent to our servers.
3.3 Download events
When a recipient downloads a file we record a download event with a timestamp and anonymised request metadata. These records are kept for 90 days and then deleted automatically.
3.4 Audit logs
We keep a tamper-evident audit log of significant actions (uploads, downloads, deletions, account changes and similar events). Each entry is linked to its actor and a timestamp, and entries are chained using SHA-256 to detect tampering. Entries are kept for 365 days. When an account is deleted, its audit entries are anonymised, with the actor identifier replaced by a placeholder, rather than erased, to preserve the integrity of the chain.
3.5 Billing data
Subscription and payment information is processed by Stripe. We store a Stripe customer ID linked to your account. Card numbers and other payment-card details are held only by Stripe and are never stored on our servers.
3.6 Technical and usage data
We collect standard technical data needed to operate and protect the Service, including IP addresses (used for rate limiting through Upstash Redis), browser type and request timestamps. We do not use this data to build individual profiles.
3.7 Webhook delivery records
If you configure outbound webhooks, we log each delivery attempt: the endpoint URL, HTTP status, response time and a payload hash. Delivery records are kept for 30 days.
4. How we use your data
The table covers data for which we are the controller. For data we process as a processor, we use it only to provide the Service to the customer, on the customer's instructions.
Purpose Legal basis (GDPR)
Providing the Service: delivering file transfers, processing requests, authenticating users Performance of a contract (Art. 6(1)(b))
Billing and subscription management Performance of a contract (Art. 6(1)(b))
Sending transactional e-mails (transfer-ready notifications, secure delivery invites, QR-gated notifications, admin invites) Performance of a contract (Art. 6(1)(b))
Security, fraud prevention, rate limiting and abuse detection Legitimate interests (Art. 6(1)(f))
Keeping tamper-evident audit logs for integrity and accountability Legitimate interests (Art. 6(1)(f))
Complying with legal obligations Legal obligation (Art. 6(1)(c))
Improving the Service through aggregated, anonymised analytics Legitimate interests (Art. 6(1)(f))
5. Encryption and zero-knowledge file storage
File-Me is designed so that we cannot read the contents of the files you transfer. Encryption happens in your browser before any data leaves your device.
For link-mode transfers, files are encrypted in the browser using AES-GCM. The symmetric encryption key is placed in the URL fragment (the part after #), which browsers do not send to the server. Our infrastructure therefore holds only ciphertext. Without the link shared by the sender, we have no means to decrypt a transferred file.
For account-mode (secure delivery) transfers, recipient key pairs are generated in the browser using RSA-OAEP-4096. The recipient's private key is wrapped with a PBKDF2-derived AES key before it is stored. The passphrase and the unwrapped private key stay in the recipient's browser.
For QR-gated transfers, a second physical device must confirm the download before it is authorised. QR session data is kept for at most 24 hours after the QR code expires.
Your browser also keeps your encryption keys and the progress of an unfinished upload in IndexedDB on your device, so that a large upload can resume after an interruption. This data stays on your device.
We store the encrypted file blobs with the storage provider listed in section 6, which acts as our sub-processor. This description of our design is general information. It does not promise that File-Me meets any particular legal, regulatory or industry standard for your use, as the Terms of Service explain.
6. Sub-processors and sharing
We do not sell personal data. We use service providers that process personal data on our behalf (sub-processors) under data processing agreements that meet Article 28 of the GDPR. This is the only list of our sub-processors. Our Terms of Service refer to it. List last updated: [date].
Provider Service and data Location and safeguards Since
[Hosting provider] Server hosting [Data centre location] [date]
[Storage provider for customer files] Storage of encrypted file blobs. We support more than one storage backend, so this row names the one used in production. [Region; set per workspace, see section 9] [date]
Clerk, Inc. Authentication and user management (name, e-mail address, login credentials, session data) United States. Standard Contractual Clauses and Data Privacy Framework certification. No EU data residency is currently offered. [date]
MongoDB, Inc. Database storage of account data and transfer metadata (never file content) [Region]. Standard Contractual Clauses. [date]
Stripe, Inc. Card payments and subscription billing United States and other countries. Standard Contractual Clauses. [date]
Upstash, Inc. Rate limiting through Redis (IP addresses, short-lived counters) [Region] [date]
[E-mail delivery provider] Sending transactional e-mails (recipient addresses and message content) [Region] [date]
Business customers get at least [30] days' notice before we add or replace a sub-processor, and can object by writing to privacy@file-me.com.
We may also disclose personal data if the law, a court order or a public authority requires it, or where necessary to protect the rights, property or safety of File-Me, our customers or others.
7. Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights under the GDPR and equivalent laws. They apply to data for which we are the controller. For data for which a customer organisation is the controller, contact that organisation; we will help them respond.
Access (Art. 15). You can download a machine-readable export of the personal data we hold about you, including account information, transfers, file metadata, file requests, download events, API keys and webhook endpoints, from your account settings at any time. Internal security identifiers, credential hashes and webhook signing secrets are deliberately left out.
Portability (Art. 20). The export is in a structured, commonly used, machine-readable format (JSON).
Erasure (Art. 17). You can delete your account from your account settings. Deletion cancels any active Stripe subscription, removes your metadata and file references, and anonymises your entries in the audit log. Encrypted file blobs are removed from storage, and your Clerk account is deleted last. Records with a fixed retention period (section 8) are deleted when that period ends.
Rectification (Art. 16). You can update your name and e-mail address in your account settings at any time.
Restriction and objection (Arts. 18 to 21). Write to privacy@file-me.com to exercise these rights.
Withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing.
Complain. You may complain to your supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY).
We respond to rights requests within one month.
8. Data retention
Data category Retention period
Account and profile data Until the account is deleted or closed. A free account that has been inactive for [12] months is deleted after we warn you by e-mail.
Encrypted file blobs Until the link expires, reaches its download limit or is deleted, or the account ends. Removed from live systems within [X] days, and from backups within [Y] days after that.
Transfer metadata and file records While the account is active, and for [90] days after a link expires or is deleted. Deleted with the account if that happens earlier.
Links after termination Kept active for at least [14] days after we give notice of termination, unless we suspend or terminate immediately for a serious breach or for security or legal reasons.
Download events 90 days (automatic deletion)
Audit log entries 365 days (automatic deletion). Anonymised when the account is deleted.
Webhook delivery records 30 days (automatic deletion)
QR-gated session data 24 hours after the QR code expires
Billing data (held by Stripe) Under Stripe's retention policy. The subscription is cancelled when the account is deleted.
Rate-limit counters (Upstash Redis) Short-lived, typically minutes to hours
9. International transfers
File-Me is operated from the European Union. Some of our sub-processors, listed in section 6, process personal data in the United States. Where data is transferred outside the EEA, we rely on safeguards approved by the European Commission, such as Standard Contractual Clauses and the EU-US Data Privacy Framework.
The storage region for encrypted file blobs is set per workspace. The default is [the EU/EEA]. Enterprise customers can lock their workspace to EU-only storage, which keeps file blobs within the EEA.
10. Cookies and local storage
File-Me uses cookies and browser storage only for essential service functionality, so we do not ask for cookie consent.
Cookies from our sign-in provider (Clerk) that keep you signed in and protect your session.
Local storage in your browser for settings you choose, such as accessibility options, your last-used workspace and the result of the connection speed test on your dashboard. These stay on your device and are not sent to us.
Browser storage (IndexedDB) that holds your encryption keys and the progress of an unfinished upload, as described in section 5.
When you pay, Stripe may set its own cookies on its checkout pages. We do not use advertising cookies, analytics cookies or third-party tracking scripts. If that changes, we will update this section and ask for your consent first.
11. Security
We apply technical and organisational measures to protect your data, including end-to-end encryption of file content (AES-GCM and RSA-OAEP), tamper-evident audit logging, HMAC-SHA256 webhook signatures, SSRF protection on outbound webhook delivery and rate limiting on API endpoints. No system is perfectly secure. If you find a security vulnerability, please report it responsibly to security@file-me.com.
12. Children
The Service is for business use only and is not directed at anyone under 18. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy. When we do, we will change the version number and effective date at the top of this page. For material changes we will notify account holders by e-mail at least [30] days before they take effect.
14. Contact
Questions, requests or concerns about this policy or how we handle personal data:
File-Me, Privacy
[Tillgren Works AB], company registration number [org.nr]
[Registered address], Sweden
Security reports: security@file-me.com