Privacy policy

Last updated 2026-10-21

This policy explains how Your Company sp. z o.o. ("we") processes personal data when you use CloudFile. We process data in line with the EU General Data Protection Regulation (GDPR).

Controller

Your Company sp. z o.o., ul. Example 1, 00-001 Warszawa, Poland. Contact: [email protected].

Data we process as controller

• Account data: name, email address and password hash, to provide your account (Art. 6(1)(b) GDPR).
• Billing data: company name, address, VAT ID and payment status, to bill you and meet tax obligations (Art. 6(1)(b) and (c)). Card details are handled by our payment provider and never reach our servers.
• Technical logs: IP addresses and connection metadata, kept for up to 30 days for security and troubleshooting (Art. 6(1)(f)).

Data we process on your behalf

Files your users transfer, SFTP usernames and file activity events are processed only on your instructions, as a processor under Art. 28 GDPR. Our data processing agreement forms part of the terms of service. Files are stored in the EU region you choose for each server.

Sub-processors

• Hetzner Online GmbH, Germany: servers and storage in the EU.
• Stripe Payments Europe Ltd., Ireland: payment processing.
• Resend, Inc., USA: transactional email (EU Standard Contractual Clauses).

Retention

Account data is kept while your account is active and deleted within 30 days after closure, except where we must keep invoices for tax purposes. Files are deleted when you delete a server or your account.

Your rights

You can request access, correction, deletion, restriction or a copy of your data, and object to processing, by writing to [email protected]. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

Cookies

We use only strictly necessary cookies to keep you signed in. We don't use advertising or tracking cookies.