Legal
Privacy Policy
Version 1.0 · Effective date: September 2026
1. Scope
This Privacy Policy describes how File-Me ("File-Me", "we", "us") collects, uses, and shares personal data when you use our secure file-transfer platform including the web application, API, and any associated services (collectively, the "Service").
File-Me is a business-to-business (B2B) product. The primary users of the Service are organisations and the employees, contractors, or agents they invite. If you are an end-recipient who received a secure file link from a File-Me customer, the organisation that sent you that link is the data controller for the transfer itself; this policy still covers the limited technical data we process to deliver the file to you.
By accessing or using the Service you acknowledge that you have read and understood this policy.
2. Data Controller
The data controller responsible for your personal data is:
File-Me [Legal entity name] [Registered address] E-mail: privacy@file-me.io
For questions about this policy or your rights, contact us at the address above.
3. Data We Collect
We collect the following categories of personal data:
3.1 Account and Identity Data
When you or your organisation creates an account, we collect your name, e-mail address, and authentication credentials. Authentication and session management are handled by Clerk. We also store your plan tier (FREE, PRO, ENTERPRISE, or VIP) and any API keys you might generate.
3.2 Transfer and File Metadata
When you send or request files we store metadata about those transfers: sender/recipient e-mail addresses, file names, file sizes, expiry settings, transfer status, and timestamps. We do not store the content of your files in a readable form. All file data is encrypted in your browser using AES-GCM before upload; the encryption key is embedded only in the URL fragment and is never transmitted to our servers.
3.3 Download Events
When a recipient downloads a file we record a download event that includes a timestamp and anonymised request metadata. These records are retained for 90 days and then automatically deleted.
3.4 Audit Logs
We maintain a tamper-evident audit log of significant actions (uploads, downloads, deletions, account changes, and similar events). Each entry is linked to its actor and timestamp and is chained using SHA-256 to detect tampering. Audit log entries are retained for 365 days. When an account is deleted, audit log entries are anonymised — the actor identifier is replaced with a placeholder — rather than erased, to preserve the integrity of the chain.
3.5 Billing Data
Subscription and payment information is processed by Stripe. We store a Stripe customer ID linked to your account. Card numbers and payment-card details are held exclusively by Stripe and are never stored on File-Me servers.
3.6 Technical and Usage Data
We collect standard technical data necessary to operate and protect the Service, including IP addresses (used for rate-limiting via Upstash Redis), browser type, and request timestamps. This data is not used to build individual profiles.
3.7 Webhook Delivery Records
If you configure outbound webhooks, we log each delivery attempt (endpoint URL, HTTP status, response time, payload hash). Delivery records are retained for 30 days.
4. How We Use Your Data
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service — delivering file transfers, processing requests, authenticating users | Performance of a contract (Art. 6(1)(b)) |
| Billing and subscription management | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional e-mails (transfer-ready notifications, secure delivery invites, QR-gated notifications, admin invites) | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, rate limiting, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Maintaining tamper-evident audit logs for integrity and accountability | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Improving the Service through aggregated, anonymised analytics | Legitimate interests (Art. 6(1)(f)) |
5. Encryption & Zero-Knowledge File Storage
File-Me is designed so that we cannot read the contents of files you transfer. Encryption happens in your browser before any data leaves your device.
For link-mode transfers, files are encrypted in the browser using AES-GCM. The symmetric encryption key is placed in the URL fragment (the part after #), which is never sent to the server by browser design. This means File-Me's infrastructure holds only ciphertext — without the URL shared by the sender, we have no means to decrypt transferred files.
For account-mode (secure delivery) transfers, recipient public keys are generated in the browser using RSA-OAEP-4096. The recipient's private key is wrapped with a PBKDF2-derived AES key before any data is stored; the passphrase and the unwrapped private key never leave the recipient's browser.
For QR-gated transfers, a second physical device must confirm the download before it is authorised. QR session data has a maximum lifetime of 24 hours after QR expiry.
We store encrypted file blobs on our storage backend. File-Me acts as a processor in relation to the storage provider you choose.
6. Data Sharing & Sub-Processors
List last updated [DATE].
We do not sell personal data. File-Me uses service providers that process personal data on our behalf, so-called sub-processors, in accordance with Article 28 of the GDPR. Contact us at privacy@file-me.io if you have objections to the sub-processors we use.
[HOSTING PROVIDER]
Service: Server hosting. From [DATE].
[Provider description — data center location, EU residency if applicable]
Clerk, Inc.
Service: Authentication and user management (name, email, login credentials). From [DATE].
Clerk is a US-based company. Their Data Processing Agreement includes Standard Contractual Clauses (SCCs) and Data Privacy Framework (DPF) certification, which enable GDPR compliance provided File-Me has carried out a risk assessment specific to Clerk. Clerk does not currently offer EU data residency, which should be factored into the risk assessment. Clerk describes its handling of personal data in its Privacy Policy.
MongoDB, Inc.
Service: Database storage (account data, metadata — not customers' file content). From [DATE].
MongoDB is a US-based company with global operations. Their Data Processing Agreement includes Standard Contractual Clauses (SCCs), which enable GDPR compliance provided File-Me has carried out a risk assessment specific to MongoDB. MongoDB describes its GDPR compliance here: MongoDB GDPR.
Stripe, Inc.
Service: Card payments. From [DATE].
Stripe is a US-based company with operations in multiple countries. Their Data Processing Agreement includes Standard Contractual Clauses, which enable GDPR compliance provided File-Me has carried out a risk assessment specific to Stripe. File-Me has concluded that the risk is low. Stripe describes its handling of personal data in its Privacy Policy and also in their Guide to the European privacy and data protection changes.
[STORAGE PROVIDER FOR CUSTOMER FILES]
Service: Storage of customers' uploaded files. From [DATE].
[Provider description — File-Me supports multiple storage backends, so this section should reflect whichever is actually used in production]
We may also disclose personal data if required to do so by law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of File-Me, our customers, or others.
7. Your Rights (GDPR)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR and equivalent legislation:
- Access (Art. 15). You can download a machine-readable export of all personal data we hold about you — including account information, transfers, file metadata, file requests, download events, API keys, and webhook endpoints — from your account settings at any time. Internal security identifiers, credential hashes, and webhook signing secrets are deliberately excluded from the export.
- Portability (Art. 20). The self-service data export described above is provided in a structured, commonly used, machine-readable format (JSON).
- Erasure (Art. 17). You can permanently delete your account and all associated data from your account settings. Deletion cancels any active Stripe subscription, removes all your metadata and file references, and anonymises your entries in the audit log (replacing actor identifiers with a placeholder to maintain chain integrity). Your Clerk account is deleted last. Encrypted file blobs are removed from storage.
- Rectification (Art. 16). You can update your name and e-mail address at any time in your account settings.
- Restriction & Objection (Arts. 18–21). Contact us at privacy@file-me.io to exercise these rights.
- Withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Lodge a complaint. You have the right to lodge a complaint with your local supervisory authority. In Sweden this is Integritetsskyddsmyndigheten (IMY).
We will respond to rights requests within 30 days.
8. Data Retention
| Data category | Retention period |
|---|---|
| Account and profile data | Until account deletion or closure |
| Transfer metadata & file records | Until account deletion; transfers expire per sender's settings |
| Download events | 90 days (automatic TTL) |
| Audit log entries | 365 days (automatic TTL); anonymised on account deletion |
| Webhook delivery records | 30 days (automatic TTL) |
| QR-gated session data | 24 hours after QR code expiry |
| Billing data (held by Stripe) | Per Stripe's retention policy; subscription cancelled on deletion |
| Rate-limit counters (Upstash Redis) | Short-lived; typically minutes to hours |
9. International Data Transfers
File-Me is operated from the European Union. Some of our sub-processors (Clerk, Stripe) process data in the United States. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your personal data in accordance with GDPR requirements.
For file storage, the storage region is configurable per workspace. Enterprise customers may select EU-only storage to keep file blobs within the EEA.
10. Cookies & Local Storage
File-Me uses cookies and browser storage only for essential service functionality: maintaining your authenticated session (via Clerk), storing UI preferences, and enabling the browser-side cryptographic operations described in Section 5. We do not use advertising cookies or third-party tracking scripts.
11. Security
We apply technical and organisational measures to protect your data, including end-to-end encryption for file content (AES-GCM / RSA-OAEP), tamper-evident audit logging, HMAC-SHA256 webhook signatures, SSRF protection on outbound webhook delivery, and rate limiting on API endpoints. No system is perfectly secure; if you discover a security vulnerability please disclose it responsibly to security@file-me.io.
12. Children's Privacy
The Service is intended exclusively for business use and is not directed at children under the age of 16. We do not knowingly collect personal data from children.
13. Changes to This Policy
We may update this policy from time to time. When we do, we will revise the version number and effective date at the top of this page and, for material changes, notify account holders by e-mail. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
14. Contact
Questions, requests, or concerns about this policy or how we handle personal data:
File-Me — Privacy privacy@file-me.io [Legal entity name & registered address]