Privacy Policy
Effective Date: September 15, 2026
How ParaFile collects, secures, processes, and respects your personal data and creative media assets in accordance with international data protection standards (GDPR, CCPA).
1. Information We Collect We adhere strictly to data minimization principles. We only collect information essential to providing reliable, uncompressed media storage and authenticated sharing: - Account Credentials: Email address, unique username, and salt-hashed passwords (bcrypt). We never store plaintext passwords. - Uploaded Media & Metadata: Photos, images, videos, and albums you upload, along with intrinsic technical metadata (EXIF tags, camera model, color space, dimension, file size, duration, and MIME types) required to render galleries and deliver original-quality downloads. - Security Keys: 6-digit Private Vault PINs stored strictly as one-way SHA-256 cryptographic hashes. Passcode album protection strings are encrypted in transit and at rest. - Transactional & Subscription Records: Order IDs, payment method tokens, subscription tier status, and billing renewal dates. Complete payment card numbers and CVV codes are handled exclusively by PCI-DSS Level 1 payment processors and never touch our servers. - Technical Diagnostic Logs: Anonymized client IP addresses, browser user agent strings, API rate-limiting tokens, and timestamped request headers collected for fraud prevention, server diagnostics, and platform security.
2. Legal Basis & Purpose of Processing (GDPR Article 6) Under the European Union General Data Protection Regulation (GDPR) and comparable global data protection statutes, we process your personal data under the following lawful bases: - Contractual Performance: To provision your storage quota, process upload requests, generate presigned object URLs, process subscription upgrades, and enforce tier parameters. - Legitimate Interests: To safeguard the platform against distributed denial-of-service (DDoS) attacks, detect automated bot abuse, monitor storage integrity, and optimize CDN delivery latency. - Legal Compliance: To comply with mandatory accounting, financial auditing, tax reporting regulations, and valid judicial discovery orders.
3. Zero Selling & Strict Non-Monetization of Personal Data We do not sell, rent, lease, trade, or monetize your personal information or media assets. We run zero third-party advertising networks, deploy zero cross-site behavioral tracking scripts, and will never broker your data to data brokers.
Crucially, your uploaded media is never utilized to train generative artificial intelligence, computer vision algorithms, or machine learning models. Your creative work belongs solely to you.
4. Infrastructure & Security Safeguards All media objects are housed in high-availability, encrypted cloud object storage equipped with TLS 1.3 in transit and AES-256 encryption at rest. Multi-region redundancy ensures your master files are safeguarded against hardware failure or geographic outages.
Payment transactions are securely handled by authorized payment processing partners under strict PCI-DSS Level 1 standards.