Privacy Policy

1. What we collect

From account owners:

• Email address, name and business name.
• Only if you connect your own WhatsApp: your WhatsApp number, the linked-device session that lets upload.pk send the alerts and link messages you ask for, and your WhatsApp contact names and numbers, used only to fill the contact picker and never copied elsewhere. We never read your chats. Numbers you send links to are kept encrypted until the message is sent (or the send is cancelled); after that we keep only a masked form for your send history and a one-way code used for sending limits, both deleted after 90 days. Disconnecting WhatsApp deletes the session and the contacts.
• Your plan, invoices and payment status. Card and wallet details are handled by PayFast; we do not receive your card number.

From people who upload to a request link:

• The name you enter, and a phone number or email address if the link asks for them.
• The files you upload, with their names, sizes and types.
• If you give a phone number and the link owner has connected their WhatsApp, the owner may send you a reminder about missing documents, from their own WhatsApp, to the phone number you give.

From everyone:

• IP address, browser type and the time of each request, used for security, rate limits and abuse investigations.
• Abuse reports, including the reporter's email address if one is given.

2. Who can see uploaded files

Files uploaded to a request link are visible only to the owner of that link. Uploaders cannot see each other's files, and nobody can download them without signing in as the owner. Download links are short-lived.

Files shared with SEND can be downloaded by anyone who has the link, until it expires or the owner revokes it.

Our staff do not open your files. The only exception is when a file or link has been reported for abuse or blocked by the malware check; staff access in that case is limited to the reported item and every access is logged.

3. How we use data

• To run the service: store and deliver files, sign you in, and show owners what they have received.
• To send alerts and service emails: new uploads, expiry reminders, invoices and security notices.
• To keep the service safe: scan files for malware, stop spam and automated abuse, and investigate reports.
• To meet legal and accounting obligations.

We do not sell personal data and we do not use it for advertising.

4. How long we keep data

• Files: until the expiry date set by the link owner (7 days by default, up to the limit of the owner's plan). After expiry, or after the owner deletes a file, it is kept for 7 days so it can be restored, and then permanently deleted.
• Uploader details (name, phone, email): kept with the submission, and erased when its files are permanently deleted or its link is deleted, whichever comes first.
• IP addresses recorded with uploads and sign-ins: 90 days.
• Server and security logs, including IP addresses: 90 days.
• IP addresses attached to abuse reports: 90 days.
• WhatsApp send history (masked recipient numbers and one-way codes): 90 days.
• Payment records and invoices: as long as tax and accounting law requires.
• When an owner deletes their account, their links close at once and their files are deleted within 7 days.
• Files under an active abuse investigation or legal request may be kept longer, only for that purpose.

5. Who processes data for us

• An object storage provider stores the files, encrypted in transit.
• Our email service sends sign-in links, alerts and invoices.
• WhatsApp carries the alerts and link messages you choose to send from your own connected number. Alerts to yourself contain no file names, but can include an uploader's name, the link title and the names of missing documents; a message to one of your contacts contains a short text and the link only, never the files.
• PayFast processes payments for paid plans.
• Google Drive, only if an owner connects it: we then copy that owner's received files to their own Drive, with access limited to files upload.pk creates. Copies in Drive are not deleted by upload.pk.
• A bot-protection service checks sign-in, upload and report forms.
• Live chat, on pages that show the chat button: our live-chat service is run by Pakistan IT Solutions (Private) Limited, the company behind upload.pk, not by an outside company. Once the button loads, it receives the address of the page you are on; if you start a chat, it also receives the name, email address and messages you type. Chats are used only to answer you, and you can ask us to delete them by writing to privacy@upload.pk.

Each processor receives only what it needs to do its job.

6. Cookies and browser storage

The service sets three cookies: one to keep you signed in, one to protect forms against cross-site attacks, and one to remember your language. We do not use advertising or tracking cookies.

On pages that show the live-chat button, the chat keeps a visitor token in your browser's local storage so a conversation can continue from page to page. It is not used for advertising, and clearing your browser's site data removes it.

7. Your choices and rights

• Owners can see, correct or delete their account data in Settings, and delete files or links at any time.
• Uploaders who want a file removed can ask the link owner, or write to us and we will pass the request on or act on it where the law requires.
• You can ask us for a copy of your personal data, or to correct or delete it, by writing to privacy@upload.pk.

8. Security

Connections to upload.pk are encrypted, download links expire after a few minutes, files up to 1 GB are scanned for malware, and staff access is limited and logged. If we learn of a breach that affects your data, we will tell you without undue delay.

9. Changes

We update the date at the top of this page when this policy changes, and email owners about important changes. See also our Terms of Service.