Privacy Policy

FilePenguin (“FilePenguin”, “we”, “us”, “our”) provides a digital-delivery service that lets sellers share downloadable files and template links with their buyers through a permanent, branded access page, and notify those buyers when a file is updated.

FilePenguin is operated as a sole trader trading under the name FilePenguin. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the data controller for the personal data described in this policy.

You can contact us about privacy at privacy@filepenguin.app (or hello@filepenguin.app).

This policy applies to two groups:

• Sellers: people who create a FilePenguin account to deliver their digital products.
• Buyers:people who open a seller's access page and, optionally, give their email address to receive update notifications.

From sellers:

• Account details: your email address, your name, and your shop name.
• Sign-in identifiers: if you sign in with Google, a Google account identifier and your basic Google profile (email, name); if you sign in by email, a one-time sign-in link.
• The files and template links you upload, and the product information and branding (colours, logo, text) you set.
• Usage and technical data: log data, IP address, and device/browser information, generated when you use the service.

From buyers:

• Your email address, only if you choose to opt in to update notifications for a product.
• Access activity: when you open an access page or download a file, and a first-party cookie used to recognise you on a return visit (see section 11).

We do not collect payment card details. The service is currently provided free of charge; if we introduce payments in future, they will be handled by a third-party payment processor and this policy will be updated.

Where we rely on consent (buyer notifications), you can withdraw it at any time using the unsubscribe link in any notification email or the controls on the access page.

• Seller account data and uploaded files: for as long as your account is active, and for up to 90 days after you close your account, after which it is deleted (except where we must keep it longer to meet a legal obligation or handle a dispute).
• Buyer email addresses: until you unsubscribe, or until the seller deletes the product or closes their account, whichever is first.
• Logs: for up to 90 days for security and troubleshooting.

• Sellers can see the buyer email addresses and access activity associated with their own products, so they can manage their buyer list and update notifications. A seller cannot see another seller's data, and cannot see your data for a product you have not engaged with.
• FilePenguin accesses personal data only where necessary to operate, support, or secure the service.
• Our service providers (subprocessors) process data on our behalf. They are listed in section 7.

We do not sell your personal data, and we do not use it for third-party advertising.

We use the following providers to run the service. Where possible we host data in the European Economic Area.

• Vercel: application hosting (EU region).
• Neon: database hosting (EU region, Frankfurt).
• Cloudflare R2: file storage (EU jurisdiction).
• Resend: sending transactional and notification emails (EU region, Ireland).
• Upstash: rate limiting and background message queueing.
• Google: seller sign-in (Google OAuth), where the seller chooses it.
• Vercel Web Analytics: aggregate, cookieless page-view analytics (no individual profiling, no third-party cookies).
• Sentry (EU region): error monitoring with personal data scrubbed from reports.

We aim to store and process personal data within the UK or EEA. Some providers may process limited data outside the UK/EEA; where they do, that transfer is protected by appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict or object to processing; data portability; and to withdraw consent at any time where we rely on it.

To exercise any of these, contact privacy@filepenguin.app. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO)at ico.org.uk, though we'd appreciate the chance to resolve your concern first.

We protect your data with encryption in transit, access controls, and EU-region hosting. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data we hold.

We use two background services to keep the product healthy. Neither builds an individual profile of you, and neither is used for advertising.

• Vercel Web Analytics: aggregate, cookieless page-view counts. No third-party cookies, no cross-site tracking, no individual identification. Used to understand which pages get visited and how often.
• Sentry (EU region): automatic capture of application errors so we can fix them. Reports are scrubbed of email addresses and the authenticated user object before they leave our servers; cookies and request headers are dropped.

Legal basis: legitimate interests (keeping the service working and improving it), with the safeguards above applied so the processing stays proportionate.

We use only the cookies needed to run the service:

• A sign-in session cookie so sellers stay logged in.
• A first-party cookie on the access pagethat recognises a returning buyer so they don't have to re-enter details. This cookie is not required to download files. If it's blocked, the file still works.

We do not use third-party advertising or cross-site tracking cookies. Our analytics provider (Vercel Web Analytics) is cookieless.

FilePenguin is intended for sellers aged 18 or over and is not directed at children. We do not knowingly collect personal data from children.

We may update this policy from time to time. We'll change the “last updated” date above and, for significant changes, take reasonable steps to let affected users know.

Questions about this policy or your data: privacy@filepenguin.app.