Privacy Policy

1. What we collect

From account owners:

• Email address, name and business name.
• WhatsApp phone number, only if you choose to verify it for alerts. It is stored encrypted.
• Your plan, invoices and payment status. Card and wallet details are handled by PayFast; we do not receive your card number.

From people who upload to a request link:

• The name you enter, and a phone number or email address if the link asks for them.
• The files you upload, with their names, sizes and types.

From everyone:

• IP address, browser type and the time of each request, used for security, rate limits and abuse investigations.
• Abuse reports, including the reporter's email address if one is given.

2. Who can see uploaded files

Files uploaded to a request link are visible only to the owner of that link. Uploaders cannot see each other's files, and nobody can download them without signing in as the owner. Download links are short-lived.

Files shared with SEND can be downloaded by anyone who has the link, until it expires or the owner revokes it.

Our staff do not open your files. The only exception is when a file or link has been reported for abuse or blocked by the malware check; staff access in that case is limited to the reported item and every access is logged.

3. How we use data

• To run the service: store and deliver files, sign you in, and show owners what they have received.
• To send alerts and service emails: new uploads, expiry reminders, invoices and security notices.
• To keep the service safe: scan files for malware, stop spam and automated abuse, and investigate reports.
• To meet legal and accounting obligations.

We do not sell personal data and we do not use it for advertising.

4. How long we keep data

• Files: until the expiry date set by the link owner (7 days by default, up to the limit of the owner's plan). After expiry, or after the owner deletes a file, it is kept for 7 days so it can be restored, and then permanently deleted.
• Uploader details (name, phone, email): kept with the submission, and erased when its files are permanently deleted or its link is deleted, whichever comes first.
• IP addresses recorded with uploads and sign-ins: 90 days.
• Server and security logs, including IP addresses: 90 days.
• IP addresses attached to abuse reports: 90 days.
• Payment records and invoices: as long as tax and accounting law requires.
• When an owner deletes their account, their links close at once and their files are deleted within 7 days.
• Files under an active abuse investigation or legal request may be kept longer, only for that purpose.

5. Who processes data for us

• An object storage provider stores the files, encrypted in transit.
• Our email service sends sign-in links, alerts and invoices.
• WhatsApp carries alerts to owners who have verified their number. Alerts contain no file names or download links.
• PayFast processes payments for paid plans.
• Google Drive, only if an owner connects it: we then copy that owner's received files to their own Drive, with access limited to files upload.pk creates. Copies in Drive are not deleted by upload.pk.
• A bot-protection service checks sign-in, upload and report forms.

Each processor receives only what it needs to do its job.

6. Cookies

We use only the cookies the service needs: one to keep you signed in, one to protect forms against cross-site attacks, and one to remember your language. We do not use advertising or tracking cookies.

7. Your choices and rights

• Owners can see, correct or delete their account data in Settings, and delete files or links at any time.
• Uploaders who want a file removed can ask the link owner, or write to us and we will pass the request on or act on it where the law requires.
• You can ask us for a copy of your personal data, or to correct or delete it, by writing to privacy@upload.pk.

8. Security

Connections to upload.pk are encrypted, download links expire after a few minutes, files up to 1 GB are scanned for malware, and staff access is limited and logged. If we learn of a breach that affects your data, we will tell you without undue delay.

9. Changes

We update the date at the top of this page when this policy changes, and email owners about important changes. See also our Terms of Service.