Privacy Policy
Privacy Policy
Last updated: March 2026
1. Data Controller
THEMIOT Informatique
Contact: simon.themiot@informatiquenevers.fr
Website: www.stprive.net
2. Data We Collect
When you use PrivCloud_Sharing, we may collect:
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account creation, notifications | Until account deletion |
| Username | Authentication, display | Until account deletion |
| IP address | Security logs, abuse prevention | 90 days |
| Uploaded files | File sharing (core service) | Until share expiration or manual deletion |
| Browser user-agent | Security monitoring | 90 days |
3. How We Use Your Data
Your data is processed exclusively to provide the file sharing service. We do not:
- Sell or share your data with third parties
- Use your data for advertising or profiling
- Transfer your data outside the European Union
- Access the content of your shared files
When end-to-end encryption (E2E) is enabled, the encryption key exists only in the share URL fragment and is never transmitted to the server. We have zero knowledge of the file contents.
4. Legal Basis (GDPR Art. 6)
- Consent (Art. 6(1)(a)): Account creation
- Contract performance (Art. 6(1)(b)): Providing the file sharing service
- Legitimate interest (Art. 6(1)(f)): Security monitoring, abuse prevention
5. Data Security
We implement industry-standard security measures including:
- TLS 1.3 encryption for all connections
- AES-256-GCM end-to-end encryption (optional, per share)
- Hardened infrastructure (CIS benchmarks, regular vulnerability scanning)
- Intrusion detection and monitoring (Wazuh, Zabbix)
- Automated backups with Restic (encrypted, off-site)
- Compliance with NIS2 (EU 2022/2555) and ISO 27001:2022 best practices
6. Your Rights (GDPR Art. 15-22)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability (receive your data in a structured format)
- Object to processing
- Lodge a complaint with the French DPA (CNIL): www.cnil.fr
To exercise your rights, contact: simon.themiot@informatiquenevers.fr
7. Cookies
PrivCloud_Sharing uses only strictly necessary cookies for authentication and session management. No tracking cookies, analytics, or third-party cookies are used.
8. Data Breach Notification
In the event of a personal data breach, we will notify the CNIL within 72 hours and affected users without undue delay, as required by GDPR Art. 33-34.
9. Changes to This Policy
We may update this privacy policy from time to time. The latest version is always available on this page with the "Last updated" date.
See also