Privacy policy

1.Who we are

Fyle is provided by [Company name] Ltd, registered in England and Wales, company number [number], registered office [Registered office address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].

For privacy questions or to use your rights, email privacy@fyle.sh. We have not appointed a Data Protection Officer because the law does not require one for our processing; [Name or role] is responsible for data protection.

2.When we are the controller, and when your organisation is

Data protection law treats the organisation that decides why and how data is used as the controller, and an organisation that handles data on its behalf as a processor.

We are the controller

for your account, sign-in and security records, billing, emails we send you, support requests and visits to our website.

Your organisation is the controller

for the files, folders, version history, agent activity and audit records in a team organisation. We process that data on its instructions under our data processing agreement. If you are a member of someone else's organisation, ask its admins about how they use your data; we will pass requests on to them.

In your personal organisation

you decide what goes into your files; we store and process them only to provide Fyle to you.

3.What we collect

Account details

name, email address, password (stored only as a salted hash), two-factor settings (the authenticator secret is stored encrypted) and backup codes, and, if you sign in with Google, GitHub or Microsoft, your name, email and account identifier from that provider.

Organisation data

organisations you belong to, your role, groups, invitations and organisation security policies.

Files and metadata

the content of files you store, file and folder names and paths, sizes, checksums, every version and who made it (person, device, agent session), branches and review decisions.

Sessions and devices

sign-in times and method, IP address, browser or device type, approved desktop devices and when they were last seen.

Agent activity

for agent sessions: the agent's name, the command used to start it, the task description if you give one, the device, and the changes it made. On Enterprise plans with download audit turned on: the first time each device downloads a file.

Usage

storage used, numbers of uploads, downloads and other operations per organisation, used for quotas and billing.

Billing

billing name and address, VAT number, plan and invoices. Card details are collected by Stripe; we never see the full number.

Communications

support emails and the emails we send you, with delivery status.

Website

standard request logs from our hosting provider (IP address, browser, pages requested). Planned: aggregated, cookieless visit statistics (see the cookie policy).

Your desktop app keeps a local cache of files you have opened. Reading a cached file happens on your device; we don't see it.

4.How we use it, and our lawful basis

We don't sell personal data, don't use it for advertising, and don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We will only send marketing emails if you opt in, and you can unsubscribe at any time.

5.Who we share it with

• Service providers who process data for us under contract, listed on our subprocessors page: hosting and storage, database, email and payments.
• People in your organisation, according to their role: for example admins can see members, version history and audit records.
• Sign-in providers (Google, GitHub, Microsoft) if you choose to sign in with them. They have their own privacy policies.
• Authorities when the law requires it. We will tell you unless the law forbids us.
• A buyer or successor if Fyle's business is sold or reorganised, under the same protections.

6.International transfers

Our database is in London. Some providers process data outside the UK: Cloudflare's network is global, Resend is in the United States, and our planned API hosting with Hetzner is in Germany or Finland. Where data leaves the UK we rely on UK adequacy regulations (for example for the EU, or the UK–US data bridge for certified US companies) or on the ICO's International Data Transfer Agreement or Addendum.

Enterprise customers can keep data in a chosen region, including UK-only residency using their own UK bucket and a UK-hosted Fyle coordinator.

7.How long we keep it

• Files and versions: while your subscription is active, according to your plan's version history. After a subscription ends: read-only for 30 days, locked until day 60, deleted at day 90. Details in our data retention policy.
• Account details: until you delete your account, then deleted within [period].
• Sessions: until they expire or you sign out; expired session records are removed within [period].
• Billing and accounting records: as long as UK tax and company law requires (up to 6 years).
• Security and audit logs: [period], or as set in an Enterprise contract.
• Support emails: [period] after the request is closed.

8.How we protect it

All connections use TLS. File content is stored encrypted at rest. File transfers go directly between your device and storage using short-lived, narrowly scoped signed requests, so file bytes don't pass through our application servers. Passwords are checked against known breaches and stored only as salted hashes, two-factor authentication is available, and organisations can require it. Access by our staff is limited to what is needed to run and support Fyle. More detail, including what is still being built, is on our security page.

9.Your rights

Under UK data protection law you have the right to:

• get a copy of your personal data (access);
• have inaccurate data corrected;
• have data deleted, where we don't need to keep it;
• restrict or object to our use of it, including where we rely on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, where we rely on consent.

Email privacy@fyle.sh. We will reply within one month. For data in a team organisation's files we will refer you to that organisation, as it decides how that data is used.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10.Children

Fyle is not intended for anyone under 18 and we don't knowingly collect their data.

11.Cookies

We only use cookies that are strictly necessary or that remember a choice you made. See the cookie policy.

12.Changes to this policy

We will update this page when our use of data changes and tell account holders by email about significant changes.