Privacy Policy

1. Controller

Sendvia GmbH, Hanauer Landstraße 291, 60314 Frankfurt am Main, Germany, is the controller for the processing described in this policy.

2. What we process

The service is designed to minimise personal data:

• Transfer metadata — file name, size, timestamp and download count are retained for the lifetime of the transfer and deleted with it.
• Server logs — truncated IP addresses and request times are kept for 7 days for security and abuse prevention.
• File contents — stored encrypted (AES-256) and never analysed beyond automated malware scanning.

3. Legal basis

Processing is carried out under Art. 6(1)(b) GDPR (performance of the transfer requested by the sender) and Art. 6(1)(f) GDPR (security and abuse prevention).

4. Retention

Files are deleted automatically upon link expiry or once the download limit is reached. Deleted files cannot be recovered. Metadata follows the same schedule; security logs expire after 7 days.

5. Your rights

You may request access, rectification or erasure of your personal data, restrict or object to processing, and lodge a complaint with a supervisory authority. Contact privacy@sendvia.example to exercise these rights.

6. Processors

Hosting and CDN delivery are provided by processors bound by Art. 28 GDPR agreements, with data residency in the European Union.