1. Overview
This policy explains how File Storage ("we", "us") handles personal information when you visit filestorage.io, create an account, use the dashboard, embed the File Storage SDK, or use Managed storage.
2. Information we collect
Information you give us
- Account details: name, email address, password (stored only as a salted hash).
- Billing details: plan, billing address, tax ID, and payment status. Card data is handled by our payment processor; we do not store full card numbers.
- Support messages: anything you send us by email or through the dashboard.
Information collected automatically
- License checks: when the SDK validates an API key we receive the key identifier, the requesting origin, timestamp, and IP address.
- Usage metrics: on Managed plans, storage volume, egress, API operation counts, and image transforms, used for billing.
- Technical data: browser type, device information, and server logs for security and debugging.
3. Files you manage
BYO storage plans: files move between your users' browsers and your own storage or proxy. They do not pass through our servers and we have no access to them.
Managed plans: we store files on your behalf as a data processor. We access them only to provide the Service, keep it secure, or comply with the law. For personal data contained in those files, you are the controller and we act on your instructions. A data processing agreement is available on request.
4. How we use information
- to create and manage your account and provide the Service;
- to validate licenses and prevent unauthorized or abusive use;
- to bill subscriptions and metered usage, and to send invoices and receipts;
- to provide support and respond to requests;
- to send service announcements (product marketing only with your consent, and you can opt out anytime);
- to improve reliability and security, and to meet legal obligations.
5. Legal bases
Where laws such as the GDPR apply, we process personal information to perform our contract with you, for our legitimate interests in running and securing the Service, to comply with legal obligations, and with your consent where required (for example, marketing emails).
6. Sharing and processors
We do not sell personal information. We share it only with:
- service providers that host our infrastructure (including Amazon Web Services for Managed storage), process payments, send email, or provide support tooling, under contracts that limit their use of the data;
- professional advisers and authorities where required by law or to protect our rights;
- a successor entity in the event of a merger or acquisition, subject to this policy.
7. Cookies and local storage
The website uses browser local storage to keep you signed in and to remember your theme preference. We do not use third-party advertising cookies. If we add analytics, we will update this policy and ask for consent where required.
8. Retention
- Account data is kept while your account is active and deleted within 90 days of closing it, unless we must keep it longer.
- Billing records are kept for as long as tax and accounting law requires (typically 7 years).
- License check and server logs are kept for up to 12 months.
- Managed storage files are deleted 30 days after the plan ends, following the export window.
9. Security
We use encryption in transit, hashed passwords and API keys, access controls, and least-privilege infrastructure. No system is perfectly secure, but we work to protect your information and will notify you of a breach affecting your data as required by law.
10. International transfers
We and our providers may process data in countries other than yours. Where required, we use appropriate safeguards such as standard contractual clauses.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Contact [email protected] and we will respond within 30 days. You can also complain to your local data protection authority.
12. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
13. Changes
We will post updates here and change the "Last updated" date. For material changes we will notify you by email or in the dashboard.
14. Contact
Privacy questions or requests: [email protected].