Privacy Policy
Effective 20 October 2026
This policy explains what personal data Oneloft, Inc. (“Oneloft”, “we”, “us”) collects when you use the Oneloft website and app, why we collect it, who we share it with and what rights you have. We are the “controller” of this data. Our contact details are at the end.
In short: we collect what we need to run your archive and take payment. We do not sell your data, we do not show advertising, we do not use your files to train artificial intelligence, and we keep things only as long as we need to.
1. What we collect
Information you give us
- Account details: your email address, your name and your country (asked once, when you set up your account), and optionally a profile picture. If you sign in with Google, we receive your name and email address from them.
- Your files and what describes them: the files you upload, their names, types, sizes, dates, the folders you put them in, whether you marked them private, and the small previews generated in your browser and uploaded with them. We do not look at what is inside your files.
- Messages you send us, for example to support, and the contents of any request about your data.
Information about payments
- Payments are processed by Stripe. Your card details go to Stripe and are not stored by us. We keep your Stripe customer and subscription identifiers, your plan, the status and dates of your subscription, your billing country and currency, and tax and invoice information needed to account for what you buy.
Information created by using the Service
- Usage records: how much you have stored, how much you have uploaded and downloaded in each month (to apply your plan’s limits), your restore requests and when they were made.
- Your activity feed: short entries such as “312 files added” or “restore ready”, kept for 90 days.
- Sign-in and security data: one-time sign-in links and codes (kept only briefly), the codes used to unlock private files (stored only in a hashed form), session tokens, and records of failed attempts used to prevent abuse.
- Technical logs: our systems and our infrastructure provider’s record requests to the Service, which can include your IP address, browser type, the time and the address requested, and error details. Download delivery also records the file path, time and number of bytes sent, without your IP address, so we can count your allowance accurately.
- Email records: that a service email was sent to you and whether it was delivered, bounced or was marked as spam. If an address bounces or complains we keep a hashed marker so we stop sending to it.
Information from your browser
- When you set up your account we use the country your connection appears to come from to suggest your country. We do not store this unless you confirm it as your country.
- Our website and app store a few things in your browser: see section 6.
2. How we use it, and our legal bases
We use personal data only for the reasons below. If you are in the UK or the European Economic Area, we must have a legal basis for each, which we list.
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account, store your files, make previews, restore and deliver them, apply your plan’s limits | To provide the Service you asked for | Contract |
| Take payment, manage your subscription, send invoices, calculate and account for tax | To charge for the Service and meet our tax and accounting duties | Contract; legal obligation |
| Send service emails: sign-in links and codes, restore ready and expiring, trial ending, failed payment, subscription ending and deletion warnings, changes to our terms | So the Service works and you are not caught out | Contract; legitimate interests |
| Keep the Service secure, detect and prevent abuse and fraud, enforce our terms and limits, fix faults | To protect you, us and the Service | Legitimate interests |
| Respond to your questions and requests, including about your data | To help you and meet your rights | Contract; legal obligation |
| Comply with the law and respond to lawful requests from authorities | To meet our legal duties | Legal obligation |
| Understand how the Service is used in aggregate to run and improve it | To keep it reliable and to plan capacity and costs | Legitimate interests |
We do not use your files or data for advertising, we do not sell or rent your personal data, and we do not make decisions about you by automated means that have legal or similarly significant effects. We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it and you will be able to opt out at any time.
4. Where your data is stored and international transfers
All files and account data are stored and processed on AWS in the United States (US East, N. Virginia). If you are in the UK or the European Economic Area, using the Service therefore involves transferring your personal data to the US. We rely on adequacy arrangements where they exist, such as the EU-US Data Privacy Framework and its UK Extension, in which AWS and Stripe participate, and otherwise on the standard contractual clauses approved by the European Commission and the UK addendum or international data transfer agreement. You can ask us for details of the safeguards we use.
5. How long we keep it
| Data | How long |
|---|---|
| Your files and previews | While your account is open. A file you delete sits in Deleted files for 30 days, then is permanently removed. Our storage keeps a protected copy for up to about 7 days after removal before it is erased |
| Account details and usage records | While your account is open |
| Cancelled accounts | Files and data are kept for 90 days after a subscription ends (7 days if you never paid), then permanently deleted |
| Deleted accounts | You have 7 days to undo. After that your files and account data are permanently deleted |
| Backups | Our database keeps point-in-time backups for up to 35 days, so deleted data can remain in a backup for up to that long before it expires |
| Activity feed | 90 days |
| Technical and security logs | Generally 30 days, longer only where needed for security, debugging a specific problem or the law |
| Payment, invoice and tax records | As long as the law requires us to keep accounts (in the UK, usually six years) |
| Email bounce and complaint markers (hashed) | While needed to avoid emailing an address that cannot receive or does not want email |
We delete or anonymise data when it is no longer needed, unless the law requires us to keep it.
7. Security
Data is encrypted in transit (HTTPS) and at rest (AWS server-side encryption). Access to the systems that hold it is restricted and logged. Private files and folders are hidden from lists and search until you unlock them with a code emailed to you, which provides an extra barrier against someone using your open session.
Your files are not end-to-end encrypted: the encryption keys are managed on our behalf by our infrastructure provider, and we are technically able to access stored data. We access it only as described in our Terms. No system is completely secure. If a personal data breach occurs that is likely to put you at risk, we will tell you and the regulator as the law requires.
8. Your rights and choices
Depending on where you live, you may have the right to: be told whether we hold your data and to get a copy; have inaccurate data corrected; have your data deleted; restrict or object to how we use it; receive the data you gave us in a portable format; and withdraw consent where we rely on it. You also have the right not to be discriminated against for using these rights.
- Many things you can do yourself: change your name or photo in Settings, download your files while your subscription is active, delete files, and delete your account.
- For anything else, email support@oneloft.io. We may need to confirm it is really you. We reply within one month in the UK and EU (we may extend this by up to two further months for complex requests, and will tell you), and within 45 days for California residents.
- There is no charge, unless a request is clearly unfounded or excessive.
If you are in the UK or EEA, you can complain to your data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk). We would appreciate the chance to put things right first.
California and other US states. We do not sell your personal information or share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar laws. In the last 12 months we have collected the categories of personal information described in section 1 (identifiers, commercial information, internet and device activity, and the content you store) for the purposes in section 2, and disclosed them to the suppliers in section 3 for business purposes. You may ask us to know, delete, correct or limit the use of your information as above, and an authorised agent may act for you.
9. Children
The Service is for adults aged 18 or over, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
10. Changes to this policy
We will update this policy when what we do changes. We will tell you by email or in the app about material changes before they take effect, and the date at the top shows when it was last updated.
11. Contact
Oneloft, Inc., [registered address]. Email: support@oneloft.io. We have not appointed a data protection officer; privacy questions are handled at this address.
UK ICO registration: [ICO registration number].