%20--%3e%3cdefs%3e%3cstyle%3e%20.st0%20{%20fill:%20%23f5acfe;%20}%20.st1%20{%20fill:%20%23bbfd6b;%20}%20%3c/style%3e%3c/defs%3e%3cpolygon%20class='st1'%20points='.2%2040%2039.9%20.3%2053.7%2014.2%2060.6%2020.9%2044.9%2036.5%2031.4%2035.2%2013.5%2053.2%20.2%2040'/%3e%3cpolygon%20class='st0'%20points='79.9%2040.1%2040.2%2079.8%2026.4%2066%2019.5%2059.2%2035.1%2043.6%2048.6%2044.9%2066.6%2026.9%2079.9%2040.1'/%3e%3c/svg%3e)
FileFlippers Limited ("FileFlippers™", "we", "us", "our"), a company registered in England and Wales (company number 17315774), is the data controller responsible for your personal data.
We are committed to protecting your privacy and handling your personal data in a transparent, lawful manner. This Privacy Policy explains how we collect, use, store, and share your personal data when you use fileflippers.com ("Platform") and our related services.
This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, and profile photo when you register (directly or via Google or Slack sign-in).
- Payment Information: When you subscribe to a paid plan, our payment provider collects and processes your payment details (card number, billing address). We store only a customer reference and subscription reference — we never store your full card details.
- Support Communications: Information you provide when contacting support, submitting bug reports, or providing feedback.
- Team Information: If you use shared workspaces, we process the names and email addresses of team members you invite.
- Referral & Affiliate Data: If you participate in our Referral or Affiliate Programme, we collect your referral link usage, referred user sign-ups, commission amounts, and — for affiliate cash payouts — payment details processed via our payment provider.
- Recipient Payment Data: When a recipient pays via a Payment-Gated Delivery link, their payment is processed by our payment provider. We receive confirmation of payment status and a transaction reference. We do not receive or store full card details.
1.2 Information Collected Automatically
- Usage Data: Features used, files uploaded/downloaded (metadata only — file count, size, type, timestamps), transfer activity, and error logs.
- Device & Browser Information: Browser type and version, operating system, device type, screen resolution, and language preference.
- IP Address: Collected for security, fraud prevention, and approximate geolocation (country/region level only).
- Cookies & Similar Technologies: See our Cookie Policy for full details.
- Referral Tracking: If you arrive at the Platform via a referral link, we set a referral cookie (
ff_ref, 60-day expiry) to attribute your registration to the referring user. We also collect IP address and a hashed device fingerprint solely for referral fraud detection. This data is retained for 90 days from the referral event and is not used for any other purpose.
1.3 Information We Do NOT Collect
- File Contents: We do not manually access, read, or view the contents of your files. Automated security scanning runs on uploads: malware detection (files up to 2 GB), and automated child sexual abuse material (CSAM) hash-matching at our content-delivery layer. Media files over 2 GB (video, audio) are exempt from traditional virus scanning — container formats carry very low executable malware risk. No FileFlippers™ staff routinely access or review file contents. Once scanned, files are encrypted at rest on our storage infrastructure.
- Sensitive Personal Data: We do not intentionally collect special category data (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, etc.) unless you voluntarily include such information in files you upload.
2. How We Use Your Information
We process your personal data on the following legal bases under the UK GDPR:
| Purpose | Legal Basis (Article 6 UK GDPR) |
|---|---|
| Providing and operating the Platform | Performance of contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of contract (Art. 6(1)(b)) |
| Sending transactional emails (receipts, transfer notifications, account alerts) | Performance of contract (Art. 6(1)(b)) |
| Preventing fraud and ensuring security | Legitimate interests (Art. 6(1)(f)) |
| Analysing usage to improve the Platform | Legitimate interests (Art. 6(1)(f)) |
| Responding to support requests | Performance of contract (Art. 6(1)(b)) |
| Complying with legal obligations (e.g. tax records, law enforcement requests) | Legal obligation (Art. 6(1)(c)) |
| Sending marketing communications (only with consent) | Consent (Art. 6(1)(a)) |
| Operating the Referral and Affiliate Programmes (tracking referrals, calculating and paying rewards) | Performance of contract / Legitimate interests (Art. 6(1)(b) and (f)) |
| Referral fraud detection (IP hashing, device fingerprinting) | Legitimate interests (Art. 6(1)(f)) |
3. How We Store & Protect Your Data
3.1 Infrastructure & Storage
- Database & Authentication: Managed PostgreSQL database hosted in the UK (London). User account data and metadata are stored here.
- File Storage: Object storage hosted in Western Europe, AES-256 encrypted at rest.
- Payments: Our payment provider processes and stores payment data in PCI DSS Level 1 certified environments.
3.2 Security Measures
- All data transmitted between your browser and our servers is encrypted using TLS 1.2+.
- Files are encrypted at rest in our storage layer.
- Authentication is managed through our auth service with support for OAuth 2.0.
- We implement access controls so that only authorised personnel can access our infrastructure. No FileFlippers™ staff routinely access or review file contents — automated scanning only.
- We conduct regular security reviews and follow industry best practices.
- Our privacy guarantee is procedural, not cryptographic. We do not offer end-to-end or zero-knowledge encryption. Infrastructure access is restricted to company directors with two-factor authentication enabled, and all access is logged. Our commitment is that no staff member routinely accesses file contents. Flagged content (e.g. CSAM hash matches) may be reviewed per legal obligation and reported to the relevant authority.
3.3 Data Location
Your data may be processed and stored in data centres operated by our infrastructure providers. These providers operate data centres in multiple jurisdictions. Our primary database is hosted in the UK (London). Some service providers operate infrastructure in other jurisdictions. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) in accordance with Chapter V of the UK GDPR.
4. Data Sharing
We do not sell, rent, or trade your personal data. We share your data only in the following circumstances:
4.1 Service Providers
We use trusted third-party service providers who process data on our behalf:
| Service | Purpose | Data Shared |
|---|---|---|
| Database & authentication provider | Authentication, database, serverless functions | Account data, file metadata, transfer records |
| Object storage provider | File storage, server-side encryption at rest | Uploaded files (encrypted at rest), IP address |
| AI processing provider | File enhancement and format conversion | File contents (processed in memory in the EU, not retained after job completion) |
| Stripe (Payments) | Subscription billing, one-time payments, creator payouts | Payment details, email, billing address |
| Stripe Connect (Creator Payments) | Creator payment onboarding, recipient payment processing, affiliate commission disbursement | Creator: payout account details, identity verification data. Recipient: payment confirmation, transaction reference. |
| Transactional email provider | Transactional email delivery | Recipient email address, email subject and body |
| Google / Slack (OAuth) | Authentication | Email, name, profile photo (if you choose Google or Slack sign-in) |
| Malware scanning service | Automated malware detection (files up to 2 GB) | File contents (scanned in memory, not retained) |
| Edge infrastructure provider (CSAM hash-matching) | Automated matching of images against known child-sexual-abuse-material hash databases at the content-delivery layer | Cached image content (matched against hash lists by the provider's edge network, not retained after the check) |
| Product analytics provider (PostHog) | Understanding how the Platform is used (loaded only if you accept analytics cookies) | Usage events and, during the public beta, which pages you visit and which elements you click. We do not record your screen. Page text and form-field contents are stripped in your browser before sending, and share links are stripped from recorded page addresses. For signed-in users, linked to your account ID; we never send your email address or name. Hosted in the EU (Frankfurt). |
| Error-tracking provider (Sentry) | Diagnosing errors and crashes to keep the Platform working | Error and diagnostic logs, which may include IP address, account ID, and request details. Hosted in the EU. |
These providers act as data processors and are contractually bound to process your data only as instructed by us and to maintain appropriate security measures. None of these providers are permitted to use your file contents for their own training, analytics, or any purpose beyond delivering the service described above.
4.2 Legal Requirements
We may disclose your data where required by law, regulation, legal process, or governmental request, including to law enforcement or regulatory bodies.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred to the acquiring entity. We will notify you of any such change.
4.4 With Your Consent
We may share your data with third parties where you have given your explicit consent.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Files & transfers | Until deleted by user, or upon transfer expiry, or 30 days after account deletion |
| Payment records | 7 years (HMRC tax record requirements) |
| Support communications | 2 years from last interaction |
| Server logs (IP, access) | 90 days |
| Usage analytics | 24 months (anonymised/aggregated) |
| Referral tracking data (ff_ref cookie, IP hash, device fingerprint) | 90 days from referral event |
| Affiliate commission records | 7 years (HMRC tax record requirement) |
| CSAM-flagged content metadata | Preserved indefinitely per legal obligation (file metadata, timestamps, IP address, account details). File content blocked from delivery and preserved for law enforcement if required. |
After the retention period, data is permanently deleted or anonymised so that it can no longer be associated with you.
6. Your Rights
Under the UK GDPR and Data Protection Act 2018, you have the following rights:
- Right of access — Request a copy of the personal data we hold about you.
- Right to rectification — Request correction of inaccurate or incomplete personal data.
- Right to erasure ("right to be forgotten") — Request deletion of your personal data, subject to legal obligations.
- Right to restriction of processing — Request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability — Request your personal data in a structured, commonly used, machine-readable format.
- Right to object — Object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
- Rights related to automated decision-making — You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We use automated processes to detect fraud and abuse (including referral-fraud checks) and to screen content and, where necessary, block, quarantine, or restrict access to Content that breaches our Acceptable Use Policy. These processes may result in referral rewards being withheld, or an account or transfer being suspended or restricted. Where such a decision affects you, you can ask a member of our team to review it by contacting privacy@fileflippers.com (or support@fileflippers.com for account suspensions).
To exercise any of these rights, contact us at privacy@fileflippers.com. We will respond within one month, as required by law. We may request verification of your identity before fulfilling your request.
7. Cookies
We use cookies and similar technologies. See our Cookie Policy for full details, including the types of cookies used and how to manage your preferences.
8. Children's Privacy
The Platform is not directed at children under 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child under 18, we will take steps to delete it promptly. If you believe a child has provided us with personal data, contact us at privacy@fileflippers.com.
9. International Data Transfers
Where your data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. This may include:
- Transfers to countries recognised as providing adequate protection by the UK Secretary of State.
- Standard Contractual Clauses (SCCs) approved by the Information Commissioner's Office (ICO).
- Other appropriate safeguards as permitted by law.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on the Platform. The "Last updated" date at the top indicates when the policy was last revised.
11. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
12. Contact Us
Data Controller: FileFlippers Limited
Company number: 17315774
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: privacy@fileflippers.com
General Support: support@fileflippers.com