Data Processing Agreement
Controller and Processor
For all Filesq toolkit sites (filesq.link, photo2kb.com), the operator is both data controller (for account data) and data processor (for files you upload to uqidata.com, which are isolated and never indexed).
Personal Data We Collect
| Category | Examples | Legal basis (GDPR Art 6) | Retention |
|---|---|---|---|
| Account | email, password hash, sign-up date | (b) contract — to operate your account | Until you delete your account |
| OAuth link | GitHub/Google user id, display name | (a) consent — you click "Sign in" | Until you disconnect the provider |
| Email codes | 6-digit verify codes | (b) contract — to operate your account | 10 minutes, then deleted |
| Payment | PayPal order id, capture id, amount | (b) contract — to fulfill your purchase | 7 years (tax law) |
| Anonymous analytics | visit counts, country (CF-IPCountry) | (f) legitimate interest — product improvement | 14 months |
What We Never Collect
- File contents uploaded to
uqidata.com— files are streamed to disk, served by direct download, deleted on expiry; never read, indexed, or used for training. - Browser compression on
photo2kb.com— runs entirely in your browser, nothing leaves your device. - Precise location — only country-level via Cloudflare IP header.
Sub-Processors
We use the following sub-processors, each under a written DPA:
| Processor | Purpose | Country | Data |
|---|---|---|---|
| Cloudflare | CDN, WAF, DDoS | EU/US | IP, request metadata |
| PayPal | Payment | EU/US | Order id, amount, capture id |
| GitHub (for OAuth) | Sign in only when you choose it | US | GitHub user id, public email |
| Google (for OAuth) | Sign in only when you choose it | US | Google sub, email |
| Hosting provider | Server, storage | EU (Frankfurt) | All runtime data |
A sub-processor change requires 30 days' notice and the right to object.
Your Rights (GDPR Art 15-22, CCPA)
You can request: access, rectification, erasure, restriction, portability, objection. Email [email protected] from the address on your account. We respond within 30 days. No automated decision-making is used.
Breach Notification
Personal-data breaches affecting your rights get notified to the supervisory authority within 72 hours and to you without undue delay, per Art 34.
Last updated: 2026-09-20.
Questions? Email [email protected] (data), [email protected] (refunds), [email protected] (reports).