This policy explains how Profectify LLC handles personal data when you use MoveMyFiles, whether you send files, receive them or have an account.
The short version
- We collect what we need to deliver your files, run your account and keep the Service safe. Nothing more.
- Your files are stored in a private bucket in Frankfurt, Germany, and deleted automatically when the transfer expires.
- We don't sell your data. We don't use analytics or advertising trackers, and we only set the cookies the site needs to work.
- We don't routinely look at your files.
- You can ask us for a copy of your data, or ask us to correct or delete it, at any time.
Who is responsible for your data
The controller of your personal data is:
Profectify LLC Email: privacy@movemyfiles.com
What we collect
If you have an account
- Your email address.
- Your password, stored only as a one-way hash. We can't read it.
- Your plan and, for Teams, which team you belong to and who manages it.
- If you pay: your Stripe customer reference, your card brand and the last four digits of your card, your company name if you enter one, and your invoice history. Your full card details go to Stripe and never reach our servers.
When you send a transfer
- Your email address as the sender. If you send without an account, we also send you a short-lived verification code.
- Your recipients' email addresses, if you send by email.
- The title and message you add, if any.
- Your files, and details about them: names, sizes, file types and folder paths.
- Your transfer settings: expiry date, whether download notifications are on, a download limit and a password if you set them. Passwords are stored only as a bcrypt hash.
Files you upload may contain personal data about other people. We handle that data only to store and deliver your transfer. If you send files containing other people's personal data, you're responsible for having a lawful basis to share it.
When you receive a transfer
If someone sends you files by email, we receive your email address from them. We use it to deliver that transfer and keep it as part of the transfer's record until the record is deleted (see How long we keep data).
When a transfer is downloaded, we record the time of the download and a keyed hash of the downloader's IP address. We don't store the IP address itself in this record. The hash lets us count downloads and spot abuse.
When you use the site
- IP address. We use your IP address to apply rate limits (for example, on sign-in, verification codes and downloads) and to prevent abuse.
- Session data. While you use the site, your session record holds your IP address and browser type, plus things like whether you've unlocked a password-protected transfer.
- Cookies. We only use essential cookies. See our Cookie Policy for the full list.
- Server logs. Our servers keep technical logs, which may include IP addresses, for security and troubleshooting. Web server logs (which include IP addresses) are kept for 14 days; application error logs for 8 weeks.
When you contact us
If you email us or use the contact form, we keep your message, your email address and anything else you include. If you report a transfer, we keep the report and any contact details you give us.
Why we use your data, and our legal basis
| What we do | Legal basis under the GDPR |
|---|---|
| Run your account and deliver your transfers | Performance of a contract (Art. 6(1)(b)) |
| Deliver files to the recipients a sender chose | Legitimate interests (Art. 6(1)(f)): getting files to the people they were sent to |
| Verify the email address of senders without an account | Legitimate interests: preventing spam and abuse |
| Send service emails, such as delivery notices, download notifications, expiry reminders and receipts | Performance of a contract |
| Keep the Service secure: rate limits, session records, hashed download records, server logs | Legitimate interests: protecting the Service and its users |
| Handle abuse reports and legal requests | Compliance with legal obligations (Art. 6(1)(c)) and legitimate interests |
| Take payments and keep accounting records | Performance of a contract and compliance with legal obligations |
| Answer your support requests | Legitimate interests, or performance of a contract if you're a customer |
We don't use your data for advertising, and we don't make decisions about you based solely on automated processing.
Who we share data with
We don't sell your personal data. We share it only with providers that help us run the Service, under data processing agreements, or when the law requires it.
| Provider | What they do for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts our website, application and database | Nuremberg, Germany |
| Linode (Akamai) | Stores your files in a private bucket (Object Storage) | Frankfurt, Germany |
| Amazon Web Services (Amazon SES) | Sends our emails, such as verification codes and transfer notifications | Frankfurt, Germany (eu-central-1) |
| Mailgun | Sends our emails if Amazon SES is unavailable | EU region |
| Stripe | Processes payments and manages subscriptions | May process data in the United States |
We may also disclose information when we're legally required to, for example in response to a valid court order, or when it's needed to protect the rights and safety of our users or others.
International transfers
Your files are stored in Germany, our website and application run in Germany, and our emails are sent from Frankfurt (with an EU-region fallback).
Some of our providers are US companies or part of US groups, and Stripe may process payment data in the United States. Profectify LLC is itself a company based in the United States. Where personal data leaves the EU/EEA, we rely on appropriate safeguards, such as the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses.
How long we keep data
| Data | How long we keep it |
|---|---|
| Your files | Until the transfer expires, or sooner if the sender deletes the transfer or we remove it |
| Transfer records (sender and recipient emails, title, message, file names and sizes, settings) | 90 days after the transfer expires or is deleted, then permanently deleted |
| Download records (time and keyed IP hash) | Deleted together with the transfer record, 90 days after the transfer ends |
| Uploads that were never finished | Removed after 24 hours |
| Transfers whose sender never verified their email | Deleted after 24 hours |
| Verification codes | Valid for 30 minutes; deleted a day after they expire |
| Rate-limit counters (IP address) | Only for the short time window the limit applies to |
| Session records (IP address, browser type) | Until the session expires, after 120 minutes without activity |
| Server logs | 14 days (web server), 8 weeks (application errors) |
| Account data | For as long as you have an account; deleted within minutes when you close it |
| Billing and invoice records | For as long as tax and accounting law requires |
| Support messages and abuse reports | As long as needed to handle them |
How we protect your data
- Files travel over TLS (HTTPS) and go straight from your browser to storage, using upload links that expire after a short time.
- Files are kept in a private storage bucket. Download links are signed and expire after a short time.
- Account and transfer passwords are stored only as hashes.
- Sign-in, verification and downloads are rate-limited, and our admin access requires two-factor authentication.
We don't offer end-to-end encryption. If your files need it, encrypt them before you upload. Read more on our Security page.
If a personal data breach is likely to result in a risk to your rights and freedoms, we'll notify you and the relevant supervisory authority within 72 hours, as required by the GDPR.
Your rights
Under the GDPR, you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that's inaccurate or incomplete.
- Erasure: ask us to delete your data, unless we have to keep it by law.
- Restriction: ask us to limit how we use your data in certain circumstances.
- Portability: ask for your data in a structured, commonly used, machine-readable format.
- Objection: object to processing based on our legitimate interests.
- Withdraw consent: where we rely on your consent, withdraw it at any time.
To exercise any of these rights, email privacy@movemyfiles.com. We'll reply within one month. We may need to confirm your identity first, for example by asking you to reply from the email address in question. It's free of charge.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to a data protection authority, in particular in the EU/EEA country where you live, work, or where you think the problem happened. You'll find a list of authorities on the European Data Protection Board's website. In the UK, you can contact the Information Commissioner's Office.
Age
MoveMyFiles is for people who are at least 18 years old, or who otherwise have the legal capacity to enter into a contract (see our Terms of Service).
Changes to this policy
We'll update this policy when our practices change, and we'll change the date at the top.
Contact
Profectify LLC Privacy questions: privacy@movemyfiles.com Everything else: support@movemyfiles.com