Privacy Policy

Last updated: September 2026

1. Who we are

This policy explains how My Shadow Ltd, trading as "fileCC" (a company registered in England and Wales under company number [COMPANY REGISTRATION NUMBER], registered office [REGISTERED OFFICE ADDRESS]), collects and uses personal data when you use fileCC. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.

2. The personal data we collect

• Sender and recipient email addresses — needed to identify a transfer, send notification and receipt emails, and generate the recipient's download link.
• Account details — if you register, your name, email address, company name (optional), and a securely hashed password. We never store your password in plain text.
• Payment information — handled directly by our payment processor, Stripe; we store a reference to your Stripe customer record and a history of credit purchases, not your card details.
• The files you send — stored only for as long as the retention option you chose requires, then deleted automatically. If a file you send contains personal data about someone else, that data is processed by us on your behalf, under your instructions.
• Approximate location and IP address — when a recipient opens a download link, we look up an approximate location (country, region, city, and coordinates) from their IP address, so a sender can see roughly where and when their transfer was downloaded. We do not collect a recipient's precise location, and this lookup is skipped entirely for local or unresolvable addresses.
• Usage and log data — standard technical logs (such as request timestamps and error reports) generated by running the Service, used for security and troubleshooting.

3. How we use it, and our lawful basis

We use personal data to provide the Service you have asked for (performance of a contract): creating and delivering transfers, running your account, and processing payments. We use it for our legitimate interests in keeping the Service secure, preventing fraud and abuse, and understanding roughly how and where transfers are downloaded. Where we ever need your consent, for example for optional marketing communications, we will ask for it separately and you can withdraw it at any time.

4. Cookies

fileCC uses a single strictly-necessary cookie to keep you signed in to your account. We do not use advertising or cross-site tracking cookies, and we do not sell personal data to third parties.

5. Who we share data with

We share personal data with the following processors, solely to run the Service:

• Cloudflare — object storage for the files you send, and delivery of download links directly to recipients.
• Mailjet — delivery of transactional emails (transfer notifications, receipts, password resets).
• Stripe — processing of card payments for credit purchases.
• ipwho.is — the approximate IP-address lookup described in clause 2, used only when a recipient opens a download link.

We do not otherwise sell or share personal data with third parties, except where required by law, to enforce these terms, or to protect the rights, property, or safety of fileCC, our users, or others.

6. International transfers

Some of the processors listed above may store or process data outside the UK. Where they do, we rely on their compliance with UK-approved safeguards, such as the UK International Data Transfer Addendum or an adequacy decision covering the destination country.

7. How long we keep data

Files are deleted automatically according to the retention option chosen when the transfer was sent, at most 28 days, or sooner once every recipient has downloaded them. Account data is kept while your account is active. Transaction and credit-ledger records are kept for as long as we are required to under UK tax and accounting law, currently up to 6 years. If you close your account, we delete or anonymise personal data that we no longer need to keep for a legal or accounting reason.

8. Your rights

Under the UK GDPR, you have the right to:

• ask us for a copy of the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data, subject to any legal reason we need to keep it;
• ask us to restrict or object to certain processing; and
• ask us to provide your data in a portable format.

To exercise any of these rights, email support@filecc.com. If you are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Security

All traffic to and from fileCC is encrypted in transit (HTTPS). Download links are generated as time-limited, single-purpose URLs rather than permanent public links, and passwords are stored using industry-standard hashing, never in plain text.

10. Children

fileCC is not directed at, and we do not knowingly collect personal data from, children under 18. If you believe a child has provided us with personal data, please contact us and we will remove it.

11. Changes to this policy

We may update this policy from time to time to reflect changes to the Service or to data protection law. We will update the date at the top of this page when we do; where a change is material, we will take reasonable steps to bring it to your attention.

12. Contact us

Questions about this policy, or about how we handle your personal data, can be sent to support@filecc.com.