Privacy policy

Data controller

Alltransfers, a service published by Kevin Ragonneau EI, 38, rue des Mathurins, 75008 Paris, France.

For any question about your data: contact@getalltransfers.com.

Our two roles

• For your account, support and visits to the Alltransfers website, Alltransfers is the data controller.
• For the files you send and the statistics of your transfers (visits and downloads by your recipients), you are the data controller. Alltransfers processes this data on your behalf, as a processor, only to provide the service.

Data processed and purposes

Your account

Email address, name, password (stored hashed, never in plain text), language, time zone and preferences. If you sign in with Google, we receive your name and email address from that service. This data is used to create and manage your account (performance of the contract).

Account security

A sign-in log (IP address, browser, system, device type) helps detect suspicious access. It is kept for 90 days (legitimate interest: security of the service).

Your transfers

The files you send, their name and size, as well as the title, message and settings of the transfer (password, expiry date). They are only used to make your files available to the people you give the link to. We do not open your files, except to handle a report or at the request of an authority.

Without an account, a fingerprint of your IP address is stored with the transfer, so you can find and manage it right after sending.

Support

Messages sent through the contact form are used to answer your requests and to handle reports.

Emails

We send you the emails required for the service to work: sign-up, account security and important information about the service (incident, changes to the terms). They are sent as long as your account exists.

Transfer statistics (on behalf of users)

For each visit to a download page and each download, we record: country, region, city and time zone (derived from the IP address using a geolocation database installed on our servers), browser, system, device type, language, referring website and UTM parameters. The IP address is not stored. A 24-hour cookie is used to count unique visitors. These statistics are kept for the period set by the sender's plan.

Recipients

Your data is never sold. It is accessible to Alltransfers and, where relevant, to our providers:

• OVH SAS (France): hosting of the website, files and data, sending of emails;
• Google Ireland Limited (Ireland): sign-in with Google, if you choose this option.

We may disclose data to authorities when required by law.

Transfers outside the European Union

Google may transfer data to the United States. These transfers are covered by the safeguards provided by the GDPR, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Retention periods

• Files: until the expiry date of the transfer (14 days without an account, 30 days with a free account, unless the sender chose a shorter date), then deleted automatically. The sender can delete them earlier.
• Account: as long as it is open. You can delete it at any time from your account settings: its data and transfers are then deleted.
• Sign-in log: 90 days.
• Transfer statistics: 90 days with a free account. No detailed statistics are kept for transfers sent without an account.

Cookies

Alltransfers uses cookies that are required for the service to work:

• session: keeps you signed in while browsing;
• user_id, token_code, user_password_hash: "Remember me" option, 30 days;
• set_language: chosen language;
• transfer_password_…: remembers access to a password-protected transfer, 30 days;
• transfer_statistics_…, transfer_downloads_…: counting of unique visitors and downloads of a transfer, 24 hours;
• rate-limiting cookies: protection against repeated sign-in or sign-up attempts.

The website shows no ads and sets no advertising cookies.

Security

Exchanges with the website are encrypted (HTTPS), passwords are hashed and access to data is limited to what the service needs.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions for its use after your death. To exercise them, write to contact@getalltransfers.com. We reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr).

Changes

This policy may change along with the service. The date of the last update is shown at the top of the page. In case of a significant change, we will inform you by email or on the website.