Privacy Policy

FileSeal (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, process, and protect your information when you use our secure document sharing platform.

FileSeal provides secure document sharing services, with enterprise-grade encryption, for UK professionals including solicitors, mortgage brokers, accountants, and consultants. Our platform enables secure document collection from clients with encryption in the browser and automatic deletion features.

Sohus Ltd

Company Number: 09369062
Registered Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Email: privacy@fileseal.uk

For all data protection queries, please contact us at: privacy@fileseal.uk

Under the General Data Protection Regulation (GDPR), we process personal data on the following legal bases:

Article 6(1)(b) - Contract Performance

• Processing necessary for the performance of our service contract with professional users
• Providing secure document sharing platform access
• Managing user accounts and service delivery

Article 6(1)(f) - Legitimate Interest

• Ensuring platform security and preventing fraud
• Improving our services and user experience
• Direct marketing to existing customers (with opt-out option)
• Compliance with legal obligations and regulatory requirements

Article 6(1)(a) - Consent

• Marketing communications to prospects
• Non-essential cookies, including Google Analytics and Google Ads cookies
• Optional features requiring explicit consent

Professional User Data

• Account Information: Name, email address, company name
• Authentication Data: Encrypted passwords, authentication tokens (via Auth0)
• Usage Data: Request creation, download activities, login timestamps
• Technical Data: IP addresses, browser type, device information
• Analytics Data: Page views, session duration, user interactions
• Conversion Data: Sign-up and subscription events for advertising effectiveness measurement

Client Data (Document Uploaders)

• Optional Information: Name and email address (when provided by professional)
• Technical Data: IP addresses, upload timestamps, browser information
• Document Metadata: File names, sizes and upload dates

Document Data

• Encrypted Documents: All files are encrypted client-side before transmission
• File Metadata: Original file names, file types and sizes
• Access Logs: Download attempts, timestamps, success/failure status

Important: Documents are encrypted on your device before transmission. In the default Email them option FileSeal holds the key so it can email a working link and prepare your download, so it is able to decrypt those files; in the Get a link (Most private) option the key stays in the link and FileSeal cannot read the files.

Service Provision

• Creating and managing user accounts
• Processing document upload requests
• Facilitating secure file sharing
• Sending service notifications and confirmations
• Providing customer support

Security and Compliance

• Detecting and preventing fraudulent activities
• Validating uploaded files by type and size
• Maintaining audit trails for compliance
• Responding to legal requests and regulatory requirements

Service Improvement

• Analyzing usage patterns to improve functionality
• Conducting user research and feedback collection
• Developing new features and services
• Performance monitoring and optimization

Analytics and Marketing

• Understanding website usage through Google Analytics (its cookies are set only with your consent)
• Measuring advertising campaign effectiveness through conversion tracking
• Optimizing user experience based on analytics data
• Improving platform performance and identifying technical issues
• No remarketing, retargeting, or invasive advertising practices

We only share personal data with trusted third-party service providers necessary for our service operation:

Essential Service Providers

• Auth0 (Authentication): User authentication and account management
• Vercel (Hosting): Platform hosting, compute and encrypted file storage
• Neon (Database): Secure data storage and management
• Resend (Email): Transactional email delivery
• Stripe (Billing): Subscription payments (card details handled by Stripe, not stored by us)
• Sentry (Error monitoring): Diagnostics, with personal-data scrubbing

Analytics and Advertising Providers (Cookies Only With Consent)

• Google Analytics: Website analytics with IP anonymisation and privacy controls
• Google Ads: Conversion tracking for advertising effectiveness measurement only

Cookieless Analytics

• Vercel Analytics: Page-view statistics that store nothing on your device, so they run without a consent prompt

All third-party providers are:

• Bound by contracts with us that cover data protection
• Located within the UK or have adequate data protection measures

If you use FileSeal to process personal data on behalf of your clients, our Data Processing Agreement (UK & EU GDPR, Article 28), incorporated into our Terms of Service, sets out the processor terms, sub-processor list and security measures. A counter-signed copy is available on request.

We Do NOT Share Data With:

• Data brokers
• Social media platforms (beyond necessary authentication)
• Marketing companies or lead generation services

Document Retention

• Uploaded Documents: Deleted from our servers once they are downloaded, or when the link expires. Files a professional attaches to a request stay until the request expires. A clean-up that runs every four hours removes anything left after a link expires.
• Request Records: Kept for as long as the account exists

User Account Data

• Accounts: Kept until you ask us to delete your account, including accounts that are no longer used
• Deletion Requests: Personal data is deleted or anonymised within one month of a verified request, except records we must keep by law, such as financial records
• Records Without an Account: Public sends, and the email addresses of recipients who have no account, are kept until someone asks us to delete them

Audit and Compliance Data

• Activity Logs: Upload, download and collection events, including file names and sizes, are kept for as long as the account exists
• Error Reports: Kept by our error-monitoring provider for its standard retention period
• Financial Records: Invoices and payment records are kept for at least the six years UK tax rules require

Under GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

Request a copy of the personal data we hold about you.

Right to Rectification (Article 16)

Request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17)

Request deletion of your personal data in certain circumstances.

Right to Data Portability (Article 20)

Request your data in a structured, machine-readable format.

Right to Object (Article 21)

Object to processing of your personal data for direct marketing or legitimate interests.

Right to Restrict Processing (Article 18)

Request restriction of processing in certain circumstances.

Response Time: We will respond to all data protection requests within one month. For complex requests, we may extend this by up to two further months with explanation.

FileSeal protects your personal data with these measures:

Technical Safeguards

• Client-Side Encryption: Encryption on the client's device before any network transmission, with an optional Most private mode in which the key never reaches FileSeal
• AES-256-GCM Encryption: Enterprise-grade encryption for documents, applied before upload; all connections use TLS
• File Validation: File type and size checks to block unsupported files
• UK Hosting: The application, database and file storage are hosted in London

Operational Safeguards

• Access Controls: Authenticated, role-based access; multi-factor authentication is available on every account, and team owners can require it
• Monitoring: Error monitoring with personal-data scrubbing
• Incident Response: A written procedure for handling incidents and notifying affected customers

Compliance Standards

• Designed for UK GDPR, with data protection by design and by default
• Data Processing Impact Assessment completed to ensure high-risk processing is properly managed
• ISO 27001 and SOC 2 Type II: not held by FileSeal (our hosting providers, Vercel and Neon, publish their own SOC 2 Type II reports)

Our hosting, document storage and database are all located in the UK.

Data Location

• Primary Data Storage: United Kingdom
• Backup Systems: UK-based data centres only
• Processing Locations: UK infrastructure; supporting sub-processors (email delivery and error monitoring) run in the UK or EEA

FileSeal uses cookies to enhance your experience and ensure platform security:

Essential Cookies (No Consent Required)

• Authentication: Secure login and session management
• Functionality: Remembering your cookie choice, and which page referred you to sign up

Optional Cookies (Consent Required)

• Google Analytics: Website usage statistics with IP anonymisation and privacy controls
• Google Ads: Conversion tracking cookies for measuring advertising effectiveness

You can manage your cookie preferences at any time through our cookie settings. Disabling non-essential cookies will not affect core platform functionality.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of significant changes by:

• Email notification to registered users
• Prominent notice on our website
• In-app notifications for material changes

Continued use of FileSeal after changes constitute acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

For questions about this Privacy Policy or our data practices, please contact us:

Regulatory Authority:
Sohus Ltd is registered with the UK Information Commissioner’s Office (ICO) under registration number ZC111701. If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the ICO.

ICO Website: https://ico.org.uk
ICO Helpline: 0303 123 1113