Privacy policy

PRIVACY NOTICE ON PERSONAL DATA PROCESSING Version 7 — effective from 9 October 2026 This notice explains what personal data we process when you use Poderosa Transfer, why we process it, and how long we retain it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). 1. Data controller. The data controller is Poderosa Studio. For any requests relating to your personal data: privacy@poderosatransfer.com. We have not appointed a Data Protection Officer (DPO): the conditions set out in Article 37 of the GDPR do not apply. 2. Who this notice applies to. We process data from three categories of people: those who register and use the service with their own account; those who send files without registering (guest flow: we ask only for an email address and verification with a code); those who receive a transfer and download it, even without having an account. If you have received a download link and want to know what data we process about you, point 4 applies to you. 3. Data of those who use the service. — Account data: email address, name (if provided), password in encrypted form (hash, never in plain text), preferred language, active plan, account status and registration date. — Login with external providers: if you sign in with Google we retain the identifier returned by the provider, the email address associated with it and the date of your last login. We do not receive your provider's password and do not have access to your other data with that provider. — Transfer data: title, message, file names and sizes, email addresses of recipients, upload and expiry dates, settings chosen. — File content: retained encrypted (AES-256) on servers located in the European Union. No one views the contents. Before encryption, each file is automatically analysed by an antivirus program installed on our servers, without being sent to external services; for password-protected archives, the program also reads the names of the files they contain, to recognise executable programs; of the analysis we keep only the outcome and the date. If a file is flagged as potentially malicious it stays encrypted in quarantine. To assess the report, the staff in charge see, without opening the file's content: the file's name, size and type, its cryptographic fingerprint (SHA-256), the name of the threat detected, the transfer's details (title, message, recipients, other files) and those of the sender's account, including any earlier reports. The fingerprint can be checked against public databases of malicious software: only the fingerprint is sent, never the file. — Upload requests: if you ask someone to upload files for you, we retain the email address of the invited person, the message you send them and the files they upload, under the same rules as other transfers. — Shared workspace: organisation name, email addresses of invited members, role and invitation status. — Personalised web address and graphics: domain or subdomain chosen, technical verification data, images, colours and text uploaded to personalise your delivery pages. — Usage and security data: IP address, user agent, date and time of logins and downloads, log of legal text acceptances (which version, when, from which IP), technical service logs. For every upload and every download we also record the service statistics described in point 9. — Technical cookies: see point 14. 4. Data of those who receive a transfer. If someone sends you files via Poderosa Transfer we process your email address, which is provided to us by the sender, to deliver you the link and any notifications related to that delivery; and the date, time, IP address and user agent of each download, which we show to the sender so they know if and when you received the files. The IP address and user agent from download events are automatically deleted after 30 days: the download count and date remain, without any further link to you. Each download also produces a service statistic as described in point 9 (size, duration, speed, outcome, device category, approximate location down to the city derived from the IP address, without storing the IP address): this statistic is linked to the sender's transfer, not to your email address, and after 30 days that link is removed too. Your email address reaches us from whoever sent the transfer: this is the source of the data under Article 14 of the GDPR. You can request deletion from us at any time by writing to privacy@poderosatransfer.com; if the transfer is still active, this may result in the revocation of your access to the files. 5. Files containing health data. Some file formats are typically used in the healthcare sector (for example DICOM diagnostic images). When we detect one of these formats from the file name or extension alone—not from the content, which no one views: the antivirus check described in point 3 only looks for malicious software—we ask you for explicit and separate consent to process data concerning your health, under Article 9, paragraph 2, letter a) of the GDPR. Without that consent the transmission does not proceed. Consent is revocable at any time from your account settings and revocation does not affect the lawfulness of processing already carried out. We retain the date of consent and any revocation of it. 6. Communications we send you. — Service emails (verification code, delivery and download notifications, space warnings, expiry reminders, support responses): are part of the service and do not require consent. Some can be disabled from the notification preferences in your account. — Promotional communications: only if you give explicit and separate consent, revocable at any time from your settings or from the link at the bottom of each email. — Management of non-working addresses: if one of our messages is returned (non-existent address, full mailbox) or if you report a message as unwanted, we record the event and suspend sending to that address. This is to avoid insisting with those who do not want to hear from us and to protect the reputation of our mailings. 7. Public forms. — Support: name, email address, subject and message text, plus the IP address from which you write. We need the IP to protect the form from automated submissions. — Access request: during the beta phase entry is by invitation; if you fill in the request form we process your email address, name, description of what you need, the language you want a reply in and your IP address. — Abuse reporting: reported link, category, description, optionally the email address of the person reporting and IP address. 8. Purposes and legal bases. — Providing the transfer service, managing accounts and notifications: contract performance (Article 6.1.b). — Delivering files to recipients indicated by the sender: contract performance and legitimate interest towards the recipient (Articles 6.1.b and 6.1.f). — Processing files with health-related data: explicit consent (Article 9.2.a). — Sending promotional communications: consent (Article 6.1.a). — Security, prevention of abuse, fraud and automated submissions: legitimate interest (Article 6.1.f). — Antivirus check of uploaded files and quarantine management: legitimate interest in the security of the service and of those who receive the files (Article 6.1.f). — Responding to support and access requests: contract performance or pre-contractual measures (Article 6.1.b). — Handling reports of unlawful content: legal obligation and legitimate interest (Articles 6.1.c and 6.1.f). — Complying with legal obligations and requests from authorities: legal obligation (Article 6.1.c). — Service statistics, monitoring of operation and capacity planning for our servers: legitimate interest (Article 6.1.f). We do not carry out advertising profiling, do not take automated decisions that produce legal effects on you and do not sell data to third parties. 9. IP address, language and service statistics. We use your IP address for two distinct purposes, both processed on our servers with a database installed locally, without sending it to any external service. The first is showing you the site in the correct language on your first visit: we infer the country you are visiting from from your IP address. You can change language at any time from the selector. The second concerns traffic statistics: for every real upload and download we record the size and duration of the operation, bytes transferred, estimated speed, outcome (completed, cancelled, abandoned, interrupted, error), device category (computer, phone or tablet, derived from the browser's user agent, which is not stored), a network estimate when the browser provides one (connection type, latency, estimated bandwidth) and an approximate location — country, region, city — computed from the IP address at the time of the operation. The location is approximate and sometimes imprecise: it may, for example, indicate the city of your connectivity provider's exchange point rather than your actual city. The IP address itself is not stored in the statistic. The plan of the account that owns the transfer is also recorded in the statistic. These statistics are used to understand how the service is used, to monitor its operation and to plan server capacity; they are visible only to administrators and are not used for advertising or profiling. The link between the individual statistic, the transfer and the account is removed after 30 days; the individual record of each operation — including the approximate location — is instead kept indefinitely, without that link, to analyse the service's trends over time. This processing is based on legitimate interest (Article 6.1.f of the GDPR): you can object to it at any time, under Article 21 of the GDPR, by writing to privacy@poderosatransfer.com. 10. How long we retain data. — Transferred files: deleted automatically and permanently on transfer expiry, with no possibility of recovery. — Metadata of expired or deleted transfers: deleted within 90 days. — IP address and user agent from download events: deleted after 30 days. — Service statistics on uploads and downloads: the link to the transfer and the account is removed after 30 days; the individual record, without that link and with the approximate location, is retained indefinitely. — Files in quarantine: deleted when staff handle the report and in any case within 30 days. The record of the report (file name, file type and fingerprint, threat detected, sender's email address, date, staff notes) is retained for the time needed to demonstrate how the abuse was handled. — Account data: for the duration of the account. — Record of legal text acceptances: for the time needed to prove which text you accepted and when. — Support requests, reports and access requests: for the time needed to handle them and, if they serve as evidence of abuse, for the time needed to defend ourselves. — Technical and security logs: for the time strictly necessary for operational and security purposes. 11. Where data is held and who processes it for us. Data is retained on servers located in the European Union. To operate the service we use suppliers who process data on our behalf, as data processors under Article 28 of the GDPR: cloud infrastructure providers, for application servers and file storage; email service providers, to deliver service communications. All operate on infrastructure located in the European Union and are bound by an agreement that requires them to process data only on our instructions. You can request the updated list of suppliers by writing to privacy@poderosatransfer.com. We do not transfer personal data outside the European Union and do not disclose it to other parties, except where required by law or in response to substantiated requests from competent authorities. 12. Your rights. You can ask us at any time for access to your data, correction, deletion, restriction of processing, portability, and can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time without affecting the lawfulness of processing already carried out. Write to privacy@poderosatransfer.com: we reply within one month, as provided for in Article 12 of the GDPR. If you believe the processing violates the GDPR you may lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it) or with the supervisory authority of an EU Member State in which you reside. 13. Account deletion. From the control panel you can delete your account at any time independently. Deletion is immediate and irreversible: it removes the files from all your transfers from storage and then the account with associated data. Only data that we are obliged to retain for legal reasons remain. 14. Cookies. The service uses exclusively technical cookies, necessary for operation: session cookies, security cookies (CSRF protection) and language preference cookies. We do not use profiling cookies or third-party cookies; for this reason a consent banner is not required. 15. Minors. The service is reserved for adults. We do not knowingly collect data from minors. If we become aware of having done so, we delete the data. 16. Changes. The current version of this notice is always published on this page. Substantial changes are notified to your account email address.