Privacy policy

This page explains what information SafeUpload handles, why, and for how long. In short: we collect only what is needed to run the service. We do not sell it, use it for advertising, or track you with analytics.

Who is responsible

When a company asks you for documents through SafeUpload, that company decides what to collect and why, and we store and handle it on their behalf. For questions about those documents, or to see, correct or delete them, contact the company that sent you the request. We are responsible for staff accounts, the website, and how the service itself works.

What we collect

• Customers: the name, email address and phone number the company entered for your request, the files you send, and when you sent them.
• Company staff: your work email address, your name if given, which company you belong to, and when you sign in.
• Security records: a log of actions such as sign-ins, uploads and downloads, with a coded fingerprint of the IP address (not the address itself) and a short description of the browser. These help us prevent misuse and investigate problems.
• Web server logs: like most websites, our hosting provider's servers keep standard access logs (IP address, page and time) for a limited period, for security and troubleshooting.

How we use it

• To run the service: signing staff in, letting customers open their request, and showing what was sent to the company that asked for it.
• To send emails the service needs: sign-in codes, request links, and notices that something was sent or needs changes.
• To keep the service secure, for example by limiting repeated attempts to guess a code.

We never sell or rent personal information, and we never use it for advertising or marketing.

Sign in with Google

Staff can choose "Continue with Google". Google then tells us your email address and whether Google has verified it. We use that only to check that the address is approved and to sign you in. We do not receive your Google password, and we do not store your Google account ID or any Google tokens, or access your Gmail, contacts, files or other Google data. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Cookies and browser storage

• The sign-in page and request pages set one cookie, which keeps you signed in or keeps your request open. It ends after 30 minutes without activity, and after 12 hours at most.
• Your light or dark theme choice is saved in your own browser only.
• There are no advertising, analytics or third-party tracking cookies.

Who it is shared with

• The company that sent the request. Only that company's approved staff can see what you send. Other companies using SafeUpload cannot.
• Our hosting provider, whose servers run the website, database and email.
• Cloudinary, which stores uploaded files for us. They are kept private, with no public web address.
• Google, only if a staff member chooses to sign in with Google.
• Authorities, only if the law requires it.

How long it is kept

• Files and customer details are kept until the company deletes the request, so ask the company if you want yours removed. If nothing has been uploaded when a request's code runs out, the request is deleted automatically.
• Files a customer removes or replaces are deleted for good after 7 days.
• Emails are deleted once sent; a record that one was sent is kept for 30 days.
• Security records are kept for 6 months, and the app's technical logs, which leave out personal details, for 30 days.
• Backups may hold deleted information for a short time, until they are replaced.

How it is protected

• Every page is served over an encrypted connection (HTTPS).
• Files are kept in private storage, never on a public web address, and are shown only to the signed-in staff of the company that asked for them.
• A customer needs both the request link and its authorization code. Codes expire, and repeated wrong attempts are blocked.
• Staff sign in with a one-time code or Google; there are no passwords to steal.

Your choices and rights

Depending on where you live, you may have the right to see the information held about you, to have it corrected or deleted, or to object to how it is used. Customers should contact the company that sent the request, since that company controls their documents; we will help them respond. Staff can contact their company's administrator or us. You can also complain to your local data protection authority.

Children

SafeUpload is meant for businesses and their adult customers, not for children.

Changes to this policy

If we change this policy, we will update this page and the date at the top.

Contact

Questions about privacy: support@safeupload.net.