What we do with your data, written so it can actually be read to the end.
1 - Who handles your data
You Store Cloud is a file hosting and sharing platform, operated by WIN – Web Innovation, which is the controller of the personal data described in this policy. For anything related to privacy, use the support form on this site — you do not need an account.
2 - What we collect
Account: name, email address, password (stored hashed, never in plain text), language and, when you buy a plan, country, region, tax number and billing address.
What you store with us: the files and folders you upload, their names, sizes, dates and a fingerprint of their content; the thumbnails generated for previews.
Shares: the links created, the expiry date, the share password (also hashed) and the email address of anyone you ask us to send a file to.
Usage: IP address, date and time of the last access, open sessions, failed sign-in attempts and the verification codes sent by email.
Payments: the transaction identifier and status returned by PayPal, and the billing details needed to issue the invoice.
Support: the messages you send us and any images attached to them.
Sync: the identifier of the authorised device and the names of the synchronised folders.
Referrals and advertising: who referred whom, the commissions generated and the ads purchased.
3 - What it is used for, and on what basis
Account, file, sharing and sync data are processed to provide the service you signed up for (performance of the contract). Billing data is processed to meet a legal obligation. Access logs and sign-in attempts protect your account and the platform (legitimate interest in security). Messages about news and campaigns depend on your consent, which you can withdraw at any time, as explained in the Terms and Conditions.
4 - Your files are yours
We do not open, scan or sell the content of the files you store. We do not use them for advertising or to train any system. We access them only when it is indispensable to answer a support request of yours, or when a legally competent authority requires it.
5 - Cookies and browser storage
We use a session cookie, which is essential to keep you signed in, and we store preferences such as the theme, the colour and the number of rows per page in your browser. We do not use behavioural advertising or cross-site tracking cookies.
6 - Who we share it with
Only with those the service cannot work without: PayPal (payment processing), Moloni (invoicing), the hosting where the platform runs and the service that sends the platform's emails. Each one handles only the data its function requires. We do not sell personal data to anyone, nor do we pass it to marketing tools.
7 - Where it is kept
Files and the database are held on servers in the European Union. Some of the providers above may process data outside the EU under the safeguards provided for in the GDPR, such as the standard contractual clauses approved by the European Commission.
8 - For how long
Account data and files are kept for as long as the account exists. Invoicing documents are kept for the legal period of ten years. Access logs are kept for twelve months and support requests for three years from the last message. When you delete a file it is removed from storage; when an account is closed we delete or anonymise whatever we are not required to keep.
9 - Security
The connection to the site is always encrypted. Passwords are stored with hashing algorithms designed for the purpose and cannot be read by us. Files and support attachments live outside the folders served directly over the web and are only released after permission checks. Accounts can be protected with two-step verification.
10 - Your rights
You have the right to access your data, correct it, delete it, receive a copy in a machine-readable format, restrict or object to certain processing, and withdraw any consent you have given. To exercise any of these, use the support form; we answer within thirty days at most. If you believe your data is not being handled as it should be, you may lodge a complaint with the supervisory authority in your country — in Portugal, the CNPD.
11 - Minors
The service is intended for people aged 18 or over. We do not knowingly collect data from minors; if we become aware of such an account, we delete it.
12 - Changes to this policy
If this policy changes, the new version is published on this page. Changes with a material impact on how your data is handled are announced by email or inside the platform.
To access your data, correct it, delete it, ask for a copy or object to a given processing, use the support form — you do not need an account for that. We answer within thirty days at most, as the GDPR requires.
If you believe your data is not being handled as it should be, you have the right to lodge a complaint with the supervisory authority in your country. In Portugal it is the CNPD, at www.cnpd.pt.
