Privacy policy
Who processes your data
The operator of the lawcloud.eu service is SYNERGIX s. r. o., Štúrova 23/11, 811 02 Bratislava, Company ID 56 878 834, registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 188045/B. Please send questions and requests to exercise your rights to info@lawcloud.eu.
Sending files
When you send files, we store:
- the uploaded files and their names,
- the sender’s email and message, if you fill them in,
- the recipients’ email addresses, if we are to send them the link,
- the IP address from which the files were uploaded,
- for each download, the time, the IP address and information about the browser.
We do not read the content of the files. The files are automatically scanned by antivirus; if it finds malicious code in them, it blocks the entire transfer and deletes the files.
The purpose is to provide the service you requested (Art. 6(1)(b) GDPR) and to protect the service and its users from abuse, for example through limits on the number of uploads (Art. 6(1)(f) GDPR, legitimate interest).
Through their private link, the sender sees the time, the IP address and information about the browser for each download and can generate a download receipt from them. We do this on the basis of the sender’s legitimate interest in proving that and when the files were delivered (Art. 6(1)(f) GDPR). The recipient is informed about this on the download page. For each file, we also store its SHA-256 hash, from which the content of the file cannot be determined. For transfers with the Pro plan, we record more data — see the section Delivery receipt (Pro plan).
We delete the files and the transfer data no later than one hour after the link validity chosen by the sender ends, or earlier if the sender deletes the transfer. If the sender sent the transfer while signed in, we delete the files at that time, but we keep the transfer record (file names, hashes and download records including the IP address and browser) in the history of their account so that they can download a delivery receipt later: for 30 days from sending, or 3 years with the Pro plan. Transfer data may remain in database backups for up to 14 more days; the files themselves are not backed up.
Delivery receipt (Pro plan)
If the files are sent by a sender with the Pro plan, we record the following when the page with the link is opened, when the link is checked automatically (for example by an email security scanner) and for each file download:
- the date and time,
- the IP address,
- the internet provider (network by autonomous system number),
- the approximate country and city estimated from the IP address,
- the device type, operating system and browser (including the browser identification),
- which file was downloaded and its SHA-256 hash,
- whether it was probably an automated check, and for what reason.
We determine the internet provider and approximate location on our own server from DB-IP databases (IP Geolocation by DB-IP); we do not send the IP address to anyone in the process. We do not determine the exact location, coordinates or address.
Each recipient to whom we send the link by email gets their own link. We store their email address, a hash of the link (not the link itself) and the time of sending, of the first opening and of the first download. If the sender requires recipient verification, we send the recipient a one-time code to their address (valid for 10 minutes) and record the time of verification; the browser remembers the verification in a cookie for 12 hours. We delete the hash of the code after one day.
Only the sender sees this data — on their transfer management page and in the delivery receipt (PDF). We process it on the basis of the sender’s legitimate interest in proving that and when the files were delivered (Art. 6(1)(f) GDPR); the recipient is informed about this on the download page. We keep it for 3 years from sending the transfer and then delete it; earlier if the sender closes their account. If the Pro plan ends, we delete records older than 30 days once 30 days have passed since it ended. You can object to the processing (see Your rights).
Verification of the sender’s email
Before files are sent, we use a one-time code to verify that the email entered belongs to the sender. We store the email, a hash of the code (not the code itself), the number of attempts and a shortened network address; we delete these records after one day. Your browser remembers the verified address in a cookie for 30 days. The purpose is to prevent abuse of the service for fraud and the spreading of malware (Art. 6(1)(f) GDPR).
Account
If you sign in, we create an account for you. We store your email, the time the account was created and of the last sign-in, the validity of the Pro plan and the list of transfers you sent under the account. The browser remembers the sign-in in a cookie for 30 days; we store only a hash of the sign-in key, not the key itself. We process the data to perform the contract for the use of the service (Art. 6(1)(b) GDPR). You can close your account at any time on the Account page; we delete it immediately together with the transfer history and all files. Otherwise, transfer records are deleted when the history period ends (30 days, or 3 years with the Pro plan).
Reporting abuse
If you report a transfer, we store the reason, your description, your name and email (if you enter them; the email so that we can reply to you), your good-faith statement and a shortened network address. We use the data only to assess the report and to be able to demonstrate how we dealt with it (Art. 6(1)(c) GDPR in conjunction with Regulation (EU) 2022/2065 on digital services). We delete resolved reports after one year.
Password protection
When an incorrect password is entered for a link or for the administration, we record the shortened address of the network from which the attempt came (for IPv6, only the first half of the address) in order to limit password guessing. We delete these records after one day. We do not store the passwords entered.
Interest in paid plans
If you sign up for the list of interested parties on the Pricing page, we store your email, the information you select or write in the form, the time of consent and a shortened network address (to limit bulk sign-ups).
We process it on the basis of your consent (Art. 6(1)(a) GDPR) solely to let you know when the paid plans launch. You can withdraw your consent at any time by email to info@lawcloud.eu; we will then delete your data. Otherwise, we keep it for a maximum of 2 years.
Where the data is stored
The server, the database and the file storage are located in data centres of Hetzner Online GmbH in Germany, which operates them for us as a processor. Neither the files nor the database leave the European Union. We do not use the data for advertising or profiling.
We send emails (the link to recipients, notifications to the sender, verification codes) via Resend, Inc. as a processor, from a data centre in Ireland. In doing so, it processes the email address and the content of the message, not the files themselves. As Resend, Inc. is based in the USA, any transfer of data outside the EU is protected by standard contractual clauses and the EU–US Data Privacy Framework.
We store files encrypted (AES-256). Each transfer has its own key, which the storage provider does not keep; in our database, the key is stored in encrypted form.
Cookies
We use only strictly necessary cookies: to give access to files after the link password has been entered (valid for 1 hour), to remember the sender’s verified email (30 days), to remember the recipient’s code verification (12 hours), to sign in to an account (30 days), to sign in to the administration, and to remember the language you choose (1 year). We do not use analytics or advertising cookies.
Your rights
You have the right of access to your data, to its rectification, erasure, restriction of processing and portability, and the right to object to processing based on legitimate interest. If processing is based on consent, you can withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal. Send your request to info@lawcloud.eu.
If you believe that we are handling your data in breach of the law, you can file a petition to initiate proceedings with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava.