GetSFTP Privacy Policy

Effective date: November 11, 2026

This policy explains how NoteWord, LLC, 300 W Valley Blvd #3022, Alhambra, CA 91803 ("we", "us"), which provides the GetSFTP service, handles personal data in connection with GetSFTP, the website at getsftp.com, the portal and web file client at app.getsftp.com, the API at api.getsftp.com and the SFTP/FTPS service at sftp.getsftp.com.

Contact for privacy questions and requests: [email protected] (subject "Privacy request"). We do not currently direct the Service at people in the European Union or the United Kingdom, and we have not appointed a representative under Art. 27 of the GDPR or the UK GDPR. If you use the Service from there, sections 5 and 8 still describe how we protect your data and your rights.

1. Two roles: controller and processor

We are a controller for personal data we collect to run our business: website visitors; people who sign up, including individuals who use the Service for their own business or profession; account users (owners, admins, members, read-only and billing users), for their login, security and account settings; billing contacts; people who contact support or use chat; and recipients of our own emails. This policy covers that data.

We are a processor (a "service provider" under California law) for the content our customers manage in the Service ("Customer Data"): files and folder names, customer folders, SFTP users and their logins, permissions, notification rules, and the organization's audit log, including what account users do inside the organization. The customer, meaning the business or professional whose account it is, is the controller. We process Customer Data only on its instructions, under our Data Processing Addendum. If you are an SFTP user, a client of one of our customers, or anyone else whose data is in Customer Data, please contact that customer to exercise your rights. If you contact us, we will pass your request on to it.

2. What we collect (as controller) and why

Category	Examples	Source	Purpose	GDPR legal basis
Account data	Name, email, password hash, 2FA status, federated login identifier (Google, Microsoft or SSO), company name (optional), organization name, role, locale, timezone; when you sign up, a record that you accepted the Terms (time, version and IP address)	You, or the sign-in provider you choose	Create and secure your account, provide the Service	Contract (Art. 6(1)(b))
Security and usage logs	IP address, login time and result, protocol, user agent, actions in the portal and API, rate-limit and abuse signals	Automatically	Security, fraud and abuse prevention (including trial abuse), troubleshooting	Legitimate interests (Art. 6(1)(f))
Billing data	Billing name and address, email, tax ID, plan, invoices, payment status, last four digits and brand of card (from Stripe)	You and Stripe	Billing, tax, accounting	Contract; legal obligation (Art. 6(1)(c))
Usage metering	Storage used, number of SFTP users, download volume per organization	Automatically	Enforce Plan limits	Contract
Support and chat	Messages, attachments you send us, chat widget identifiers	You	Answer questions, improve support	Contract; legitimate interests
Service emails	Email address, delivery, bounce and complaint status	Our email provider	Send account, security, billing and lifecycle emails; protect deliverability	Contract; legitimate interests
Marketing	Email address if you opt in to product news	You	Product updates	Consent (Art. 6(1)(a)); you can withdraw at any time
Website cookies	See the Cookie Policy	Automatically	Site operation; chat (if you consent)	Necessary: legitimate interests; non-essential: consent

We do not collect payment card numbers. Card details go straight to Stripe through Stripe Checkout and the Stripe Customer Portal, and we never see them.

We do not intentionally collect special categories of personal data, and we do not use personal data for automated decisions that have legal or similarly significant effects on you.

You must give us your name, email address and a password or sign-in provider to create an account, and billing details to buy a paid Plan. Without them we cannot provide the Service. Everything else is optional.

Do Not Track and Global Privacy Control. We do not track visitors across other websites, and we do not let third parties do so on our sites. Our chat provider, Crisp, sets cookies on our sites only to run the chat for us. We treat Global Privacy Control signals as an opt-out request. There is no common standard for Do Not Track signals, so we do not respond to them differently, but we do not track you across sites either way.

3. How we handle Customer Data (summary)

Full terms are in the DPA. In short:

We store files in object storage and process them only to provide the Service: transfer, storage, notifications, automations the customer configures, and automated malware scanning of uploads. No person at NoteWord, LLC looks at file contents unless an owner of the organization grants a time-boxed support session.
We never log file contents. The audit log records events (who, what, when, IP address, protocol, file path and size), not what is inside files.
A "read" means a completed download. Directory listings are not recorded as reads.
Organizations can redact filenames in notifications, so that emails, chat messages and webhooks do not reveal file names.
Audit events are kept for the audit retention period of the organization's Plan, then deleted automatically. Retention by Plan, in days: 60 (Starter) / 180 (Team) / 365 (Pro) / 730 (Business) / 730 (Max) / 730 (Ultra).
If a trial is not converted, the organization is locked and its data is deleted 90 days after the lock. Locked paid organizations are deleted 90 days after the lock.

We share personal data only with:

Subprocessors and service providers that help us run the Service, listed with their purpose, data and location on our Subprocessors page: Oracle Cloud Infrastructure (hosting), Cloudflare (file and backup storage), Stripe (payments and tax), Amazon Web Services (email delivery) and Crisp (chat widget on our website and portal).
Destinations our customers choose, such as a customer's Slack or Microsoft Teams workspace, webhook URL, identity provider or own storage bucket. These are not our subprocessors. The customer decides to send data there.
Authorities or other parties when required by law, to protect rights, safety and security, or in a merger or acquisition (with notice to you).

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

5. International transfers

We are based in the United States and host the Service in Oracle Cloud region us-sanjose-1 (United States). If you are in the EEA, the UK or Switzerland, you give your personal data directly to us in the United States, and the GDPR or UK GDPR applies to how we process it. When we pass personal data to service providers in countries without an adequacy decision, we use the EU Standard Contractual Clauses (Decision (EU) 2021/914), the UK International Data Transfer Addendum, or the provider's certification under the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. Customer Data is covered by the DPA. You can ask us for a copy of these safeguards.

On request, we can store an organization's files in a Cloudflare R2 bucket in Cloudflare's EU jurisdiction. Such files are stored in the EU, but they pass through our compute region in the United States during upload, download and processing.

6. How long we keep it

Data	Retention
Account data	While the account exists. Deleted, or anonymized where records must be kept, when you delete your account or your organization is deleted
Organization data (controller side, e.g. owner and billing contacts)	Until the organization is deleted, following the lock periods above
Security logs	90 days, then deleted. Kept longer only while needed to investigate a specific security incident or abuse case. Logins and actions inside an organization are also recorded in that organization's audit log (section 3)
Billing and tax records	As long as tax and accounting law requires (for example 7 years)
Support and chat messages	Up to 24 months after the conversation, unless needed for a dispute
Marketing consent	Until you withdraw it, plus proof of consent and opt-out
Encrypted database backups	Expire automatically within 35 days
Deletion record	A record that an organization was deleted, with no personal data, kept indefinitely as evidence

7. Security

We encrypt data in transit (TLS 1.2 or later, modern SSH ciphers, FTPS with explicit TLS only) and at rest, require multi-factor authentication for our staff, limit staff access, and keep an append-only audit log. See the Security Overview.

If GDPR or UK GDPR applies, you have the right to access your personal data, correct it, delete it, restrict or object to processing (including direct marketing), receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Many of these you can do yourself in the portal (profile, data export, account deletion). Otherwise email [email protected]. We answer within one month, extendable by two months for complex requests. We may need to verify your identity.

You also have the right to complain to a supervisory authority, for example the authority in the EU country where you live or work, or the UK Information Commissioner's Office.

9. Notice for California residents (CCPA/CPRA)

This section applies to California residents to the extent the CCPA applies to us, and supplements the rest of this policy.

Categories collected in the last 12 months (as controller), with the sources and purposes in section 2:

Identifiers (name, email, IP address, account identifiers);
Customer records and commercial information (billing address, plan, invoices, payment status);
Internet or network activity (logins, portal and API activity, website interactions);
Professional information (organization name and role);
Sensitive personal information: account login credentials (email or username with password or key). We use it only to authenticate you and secure the Service, which California law permits without a right to limit.

We disclose these categories for business purposes to the service providers listed in section 4.

We do not sell or share personal information. We have not sold or shared personal information (as those terms are defined in the CCPA/CPRA) in the last 12 months, and we do not knowingly sell or share personal information of consumers under 16. We honour Global Privacy Control signals as a request to opt out, though we have nothing to opt you out of.

Your rights. You may request to know what personal information we collect, use and disclose; to access a copy; to delete it; and to correct it. You will not be discriminated against for exercising these rights. Send requests to [email protected]. We verify requests by confirming control of the account email and may ask for more information where needed. An authorized agent may submit a request with your signed permission. We respond within 45 days, extendable by 45 days with notice.

We do not offer financial incentives for personal information.

For Customer Data, we act as a service provider. Please send requests to the organization that controls the data.

10. Children

The Service is for business and professional use, by companies and by individuals working on their own, and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes

We will post changes here and update the effective date. For material changes we will email account owners before they take effect.

12. Contact

NoteWord, LLC, 300 W Valley Blvd #3022, Alhambra, CA 91803. Email: [email protected].