Privacy Notice

1. Scope and controller

OWNER REVIEW DRAFT — NOT ATTORNEY-REVIEWED OR LEGALLY APPROVED. This notice explains how FileFit processes personal data. OWNER DECISION REQUIRED: legal entity or controller name, registration details, postal address, privacy contact, effective date, and any representative or data-protection officer required by law.

2. Data FileFit collects

Account and authentication data can include email address, managed authentication identifiers, session data, account profile fields, organization or tenant identifiers, API-key metadata, and security events. FileFit stores API keys in hashed form rather than recoverable plaintext.

Job and service metadata can include selected destinations and actions, job state, validation results, file type and size, workflow or preset configuration, timestamps, attempts, object references, usage and credit records, provider status, audit transitions, and static failure categories.

3. Local-only processing

When FileFit identifies an eligible local execution path and no upload occurs, file bytes remain in your browser or device. Account, page-request, security, or aggregate operational data can still be processed when you use online FileFit services.

4. Optional cloud processing and uploaded files

Cloud processing requires explicit consent or a lawful saved preference before upload. FileFit then processes uploaded files and generated outputs only to perform the requested work, validate results, provide access, secure the service, and complete deletion. Files may pass through temporary object storage, queues, a Cloudflare Worker, and managed compute.

Uploaded file bytes are not stored in PostgreSQL. The database stores metadata and object references. FileFit does not use customer files for model training.

5. Purposes and legal bases

FileFit processes data to provide requested services, authenticate users, secure tenants and infrastructure, prevent abuse, support users, maintain audit and credit integrity, diagnose failures, meet legal obligations, and improve reliability without using customer files for training.

OWNER DECISION REQUIRED: qualified legal review must map contract, consent, legitimate-interest, and legal-obligation bases to each processing purpose and jurisdiction.

6. Cookies and sessions

FileFit uses necessary HTTP-only session, access, and refresh-token cookies for authentication and account access. In production they are marked Secure and use SameSite protections. FileFit does not currently implement advertising cookies in the reviewed application.

7. Logs and operational records

Logs and alerts may contain correlation or job identifiers, timestamps, request and status information, latency, provider state, and static failure categories. FileFit is designed to exclude authorization headers, credentials, signed URLs, filenames, file contents, OCR text, and extracted text from logs.

8. Service providers and subprocessors

Supabase provides managed authentication and PostgreSQL infrastructure. Cloudflare provides R2 object storage, Queues, and Workers. Google Cloud provides Cloud Run managed compute and web hosting, Secret Manager, and operational infrastructure. GitHub provides source control and automated build and release workflows.

These providers process data under their own infrastructure and contractual terms as needed to deliver FileFit. OWNER DECISION REQUIRED: approve the final subprocessor list, processing locations, contracts, and any legally required notice or change mechanism.

9. Payments and AI providers

Lemon Squeezy acts as merchant of record for paid subscriptions and processes payment details, taxes, checkout, and billing portal activity. FileFit stores provider customer, checkout, subscription, billing-period, and event identifiers needed for access, support, reconciliation, and fraud prevention, but does not store complete payment card details.

Paid AI is disabled by default. Customer files are not sent to paid AI providers in the launch configuration. Future AI activation requires intentional provider configuration, policy and privacy approval, and updated disclosures where required.

10. Retention and deletion

Cloud objects are temporary. Current job creation records a one-hour object expiry target; users and application workflows can delete objects earlier, application cleanup processes expired objects, and storage lifecycle rules provide a safety net. A failed deletion remains retryable and is not falsely marked complete.

Account, job, audit, security, credit, and legally required metadata may follow different retention periods. Backups and provider lifecycle processes may delay final erasure. OWNER DECISION REQUIRED: approve and publish the complete retention schedule, backup periods, account-deletion timetable, and legal-hold exceptions.

11. Security

FileFit uses controls including encrypted HTTPS transport, server-only secrets, tenant isolation and row-level security, hashed API keys, short-lived signed object access, random tenant-prefixed object keys, input validation, bounded retries, authenticated callbacks, origin checks, audit transitions, and restricted logging. No system is perfectly secure, and FileFit cannot guarantee prevention of every incident.

12. International processing

FileFit providers may process data outside your country. OWNER DECISION REQUIRED: identify actual production regions, controller establishment, applicable transfer mechanisms, safeguards, and country-specific disclosures before launch.

13. Your privacy rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent, and complain to a regulator. These rights may be limited by lawful exceptions and identity-verification requirements.

To request deletion or exercise a privacy right, contact OWNER DECISION REQUIRED: privacy contact and request process. OWNER DECISION REQUIRED: regulator-specific wording, response deadlines, appeal process, and supervisory-authority details.

14. Children

FileFit is not intentionally directed to children. OWNER DECISION REQUIRED: minimum user age, parental-consent rules, and jurisdiction-specific child-privacy language. If FileFit learns that it processed child data unlawfully, it will take appropriate deletion and restriction steps.

15. Changes and contact

FileFit may update this notice when products, providers, legal requirements, or processing practices change. Material changes will be communicated in an owner-approved manner with a revised effective date.

Privacy contact: OWNER DECISION REQUIRED: privacy email and postal address.