Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Full name (optional)
• Password (stored securely using industry-standard hashing)

File Data

When you use our service, we process:

• Files you upload for transfer
• File metadata (name, size, type)
• Transfer settings (expiry date, recipients)

Automatically Collected Information

• IP address (truncated for privacy)
• Browser type and version
• Device information
• Access times and pages viewed

2. How We Use Your Information

We use collected information to:

• Provide and maintain our service
• Process your file transfers
• Authenticate your identity
• Send transactional emails (transfer notifications)
• Improve our service based on usage patterns
• Detect and prevent fraud and abuse
• Comply with legal obligations

3. Legal Basis (GDPR)

4. Data Sharing

We share data with service providers (subprocessors) listed on our Subprocessors page.

We may also disclose information if required by law or in response to valid legal requests.

5. Data Retention

We retain data as described in our Retention Policy:

• Account data: Until account deletion
• Files: Until expiry or deletion (max 7 days for free tier)
• Audit logs: 90 days
• Backups: 30 days after deletion

6. Your Rights (GDPR)

You have the right to:

• Access - Request a copy of your data via Settings → Privacy & Data → Export
• Rectification - Update data via account settings
• Erasure - Delete your account via Settings → Privacy & Data → Delete Account
• Portability - Export data in JSON format
• Withdraw consent - Manage cookie preferences anytime
• Lodge complaint - Contact your local data protection authority

7. Cookies

We use cookies for authentication, security, and consent preferences. See our Cookie Policy for details.

8. Security

We implement security measures including encryption in transit (HTTPS/TLS), secure password hashing, row-level database security, access controls, and audit logging.

9. International Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards including Standard Contractual Clauses and Data Processing Agreements.

10. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children under 16.

11. Contact Us

For privacy-related inquiries: privacy@starkup.tech