Legal
Privacy Policy
Last updated: 10 November 2026
In short
- We collect only what we need to move your files and run your account: mainly email addresses and details about each transfer.
- We don't look inside your files, and we delete them when the transfer expires (at most 14 days).
- No ads, no analytics, no tracking, and we never sell data.
- A few trusted providers help us (servers in the EU, Cloudflare storage, email, Paddle for payments). Each is listed below.
- You can see, correct or delete your data: email privacy@botransfer.com. You can also complain to the ICO.
Contents
1. Who we are
BoTransfer is run by [TO FILL: company legal name] (company number [TO FILL: company number], registered office [TO FILL: registered office address]). We are the controller of the personal data described in this policy, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO) under number [TO FILL: ICO registration number].
For anything about privacy, email privacy@botransfer.com. We are a small company and have not appointed a data protection officer, because the law does not require one for a service like ours; the founder is responsible for data protection and reads every message to that address.
Our representative in the European Union under Article 27 of the EU General Data Protection Regulation is [TO FILL: EU representative name and address]. People in the EU, and EU data protection authorities, may contact our representative instead of us, about anything to do with our processing of personal data.
This policy covers botransfer.com, app.botransfer.com and the emails we send. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, for people in the EU, the EU General Data Protection Regulation.
2. What we collect
When you send a transfer
- Your email address, confirmed with a one-time code (Free) or through your account (Pro).
- Recipients' email addresses, if you ask us to email the transfer.
- Transfer details: the title and message you add, the names (including folder names), sizes and types of the files, the expiry date, whether it has a password (we store only a scrambled "hash" of the password, never the password itself), when it was sent, and how many times it and each file were downloaded.
- The files themselves — see section 3.
When you have an account
- Your email address, a securely hashed password (or, if you log in with Google, your Google account identifier, and the name and email address Google shares with us), and when you joined.
- Your plan and subscription details: status, monthly or yearly, renewal date, and the customer and subscription references Paddle gives us. We never receive or store your card details.
- If you set up branding (Pro): the business name, short message, website link, logo and background picture you add. We show them on your download pages and in the emails your recipients get. Pictures are resized and their hidden details (such as camera and location data) removed, then kept in our database with your account.
When you download, browse or use any part of the service
- Technical data: your IP address (which we also store with each transfer you create and each report you make), the date and time, the page or file requested, and your browser type. We use it for security, to apply our limits and to stop abuse.
- Cookies and browser storage: only those the service needs to work — see our Cookie Policy.
- Bot check: when you use the Free plan, Cloudflare Turnstile collects signals from your browser to tell people from bots, and tells us only whether the check passed.
When you contact us or report a transfer
- Your email address (if you give it), what you tell us, and our replies.
We do not collect special category data (such as health or religious beliefs) about you, except to the extent that you choose to put it in a file, title or message.
3. Your files
Files go straight from your browser to our storage provider, and downloads go straight from storage to the recipient's browser over encrypted connections. We do not open, read, analyse or scan the contents of your files, and we do not use them for any purpose of our own — including training any kind of artificial intelligence. We show image thumbnails on the download page, created in the recipient's browser.
A person at BoTransfer will only look at a transfer's details, and in exceptional cases its files, when it has been reported to us as illegal or abusive, or when the law requires us to. We do not open material reported as child sexual abuse material: we disable it, preserve it securely if required, and report it to the National Crime Agency.
If files you send contain other people's personal data, you are responsible for having a lawful reason to share it. If you use BoTransfer for your organisation and the files contain personal data your organisation controls, we process that data on your behalf as your processor, under the data processing terms in the Schedule to our Terms of Service.
4. Why we use it, and our legal bases
| What we do | Data | Legal basis |
|---|---|---|
| Store and deliver your transfers; send transfer emails, download notifications and email codes | Your and recipients' email addresses, transfer details, files | Contract — needed to provide the service you asked for (UK GDPR Article 6(1)(b)). For recipients' addresses: our and the sender's legitimate interest in delivering the transfer (6(1)(f)). |
| Run your account and Pro subscription; transfer history | Account and subscription details | Contract (6(1)(b)) |
| Keep the service secure: bot check, email codes, rate and daily limits, preventing misuse of the Free plan | Email address, IP address, technical data, bot-check result, block list | Legitimate interests — keeping BoTransfer safe and available and preventing fraud and abuse (6(1)(f)) |
| Handle reports, remove illegal content, decide appeals, keep records of what we did | Report details, transfer details, sender details | Legal obligation under the Online Safety Act 2023 (6(1)(c)); legitimate interests in enforcing our terms (6(1)(f)) |
| Report child sexual abuse material to the National Crime Agency; respond to lawful requests from the police and courts | Transfer details, sender details, technical data | Legal obligation (6(1)(c)); for criminal offence data, the conditions in Schedule 1 to the Data Protection Act 2018 for preventing or detecting unlawful acts and for safeguarding children |
| Answer your questions and complaints | Your messages and contact details | Legitimate interests in helping you (6(1)(f)); contract, where it is about your subscription |
| Keep business and tax records | Subscription and payment references | Legal obligation (6(1)(c)) |
| Tell account holders about important changes to the service, these policies or their subscription | Email address | Contract (6(1)(b)) |
Where we rely on legitimate interests, we have checked that our interests are not overridden by yours. You can ask us for a copy of that assessment. We do not send marketing emails. If we ever want to, we will ask for your consent first.
5. If someone sent you a transfer
If you received an email from transfers@botransfer.com, the sender gave us your email address so that we could deliver their files. We use it only to send you that transfer, and keep it only as long as the transfer's record (section 8). We never add you to a mailing list. If you do not want to receive transfers through BoTransfer, or think your address was given to us wrongly, email privacy@botransfer.com. If a transfer looks suspicious, do not open the files — report it.
6. Who helps us run BoTransfer
We share personal data only with the providers below, and only what each needs. Processors act only on our instructions under a contract that meets Article 28 of the UK GDPR.
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH (Germany) — processor | Hosts our application server and database (accounts, transfer details, reports) | European Union (Germany or Finland) |
| Cloudflare, Inc. (USA) — processor | Stores your files (Cloudflare R2), runs the Turnstile bot check, and provides our domain name system (DNS) | Your files: the European Union (an EU-only storage location). Bot check and DNS: Cloudflare's global network, including the USA |
| Zoho Corporation — processor | Our email mailbox: sends transfer emails, codes and notifications, and holds our support and abuse correspondence | the United States |
| Paddle.com Market Limited (UK) — independent controller | Our reseller and merchant of record: takes payment, handles tax, invoices, refunds and fraud checks, under Paddle's privacy notice | UK, with Paddle's own providers |
| Google — independent controller, only if you choose "Log in with Google" | Confirms your identity and shares your name and email address with us, under Google's privacy policy | Global, including the USA |
We also disclose personal data:
- to the police, the National Crime Agency, courts, regulators and other authorities, where the law requires it, or where it is necessary to prevent or detect crime or protect someone's safety, following the process on our Legal page;
- to a person who sends a valid copyright counter-notice or notice, limited to what our Copyright Policy describes;
- to our professional advisers (lawyers, accountants) under a duty of confidence; and
- to a buyer of our business, if BoTransfer is sold, who must keep to this policy.
We do not sell or rent personal data, and we do not share it for advertising.
7. Data outside the UK
Our database and the files you send are stored in the European Union, which the UK recognises as giving adequate protection. Where a provider handles data outside the UK and the EU — for example Cloudflare's bot check and DNS in the USA, or Zoho, which hosts our mailbox in the USA — the transfer is protected by one of these safeguards: the UK–US "data bridge" (the UK Extension to the EU–US Data Privacy Framework) for providers certified under it, or the standard contractual clauses approved by the European Commission with the UK's International Data Transfer Addendum, included in the provider's data processing agreement. You can ask us for a copy of the relevant safeguard at privacy@botransfer.com.
For people in the EU: the European Commission has decided that the UK gives adequate protection to personal data, so data can flow from the EU to us without extra safeguards.
8. How long we keep it
| Data | How long |
|---|---|
| Files in a transfer | Until the transfer expires (at most 14 days) or is deleted early, then deleted from storage within 15 minutes. A storage rule also deletes any file older than 15 days, in case anything is missed. |
| Uploads started but never sent | Deleted 2 hours (Free) or 24 hours (Pro) after the last upload activity |
| Files of a transfer switched off after reports | Kept for up to 7 days while a person reviews it, then either restored or deleted |
| Transfer details (sender and recipient emails, the IP address used to create it, title, message, file names and sizes, download counts) | 12 months after the transfer expires or is deleted, then deleted. This lets Pro users see their history and lets us investigate abuse reported after a transfer has expired. |
| One-time email codes | 10 minutes, then deleted at the next clean-up |
| Login sessions | 30 days, or until you log out |
| Counters of how much an email address or IP address has sent, used for our daily limits | 3 days |
| Block list (email addresses, email domains and IP addresses blocked for abuse) | While the block is in force. We review blocks every year and lift those no longer needed. |
| Server logs (IP address, time, request, browser type) | Up to 30 days |
| Account details | While you have an account. When you close it, deleted within 30 days. |
| Subscription and payment references | 6 years after the end of the financial year they relate to, as tax law requires. Paddle keeps its own records under its own policy. |
| Reports (including the reporter's IP address), removal decisions, our log of moderation actions, statements of reasons and appeals | 2 years after the case is closed, so that we can apply our repeat-infringer policy and answer complaints |
| Reports to the National Crime Agency | The report reference for 5 years and the related data for 1 year, as the law requires — or longer if an authority asks us to preserve it |
| Emails to and from us | 2 years after the last message in the conversation |
We keep data longer only where the law requires it, or where we need it to establish or defend a legal claim, and only for as long as that need lasts.
9. Security
All connections to BoTransfer are encrypted (HTTPS). Files are stored encrypted by our storage provider. Upload and download links are signed and short-lived (download links last 10 minutes). Passwords are stored only as strong one-way hashes. Our servers are protected by a firewall, receive security updates, and only the founder can access them. Our providers are bound to keep data secure. No system is perfectly secure: if we suffer a breach that is likely to put you at high risk, we will tell you without undue delay. If you think your account or a transfer has been compromised, email support@botransfer.com at once.
10. Your rights
You have the right to:
- access — get a copy of your personal data and information about how we use it;
- rectification — have inaccurate data corrected;
- erasure — have your data deleted, where there is no good reason for us to keep it;
- restriction — ask us to stop using your data while a concern is looked into;
- objection — object to our use of your data based on legitimate interests; we will stop unless we have compelling grounds;
- portability — receive data you gave us, under our contract, in a machine-readable format;
- withdraw consent — at any time, where we rely on consent (we currently do not).
To use any of these rights, email privacy@botransfer.com from the email address you use with BoTransfer, or write to us at our registered office. If we cannot be sure who you are, we may ask for a little more information, only enough to confirm it. We reply within one month. If your request is complex we may extend this by up to two more months, and will tell you why within the first month. Using your rights is free, unless a request is clearly unfounded or excessive.
You can delete a transfer early yourself (Pro), and you can close your account by emailing support@botransfer.com.
11. Complaints
If you are unhappy with how we have handled your personal data, please complain to us first at privacy@botransfer.com. We acknowledge every data protection complaint within 30 days (in practice within two working days), look into it without undue delay, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the EU, you may complain to the data protection authority in your country.
12. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our automatic limits and bot check can stop a transfer from being sent, but they do not decide anything about you beyond that moment; if you think one has stopped you wrongly, contact us and a person will look at it.
13. Children
BoTransfer is only for people aged 18 and over (see our Terms of Service). We do not knowingly collect data about children. If you believe a child has used BoTransfer, email privacy@botransfer.com and we will delete their data.
14. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how we use your data, we will email account holders before it takes effect.