Privacy policy

Last changed 2026-09-01

Not in force yet. This policy is missing the controller's name, registration number and address. GDPR article 13 requires them, so the policy is incomplete until they are filled in.

Data controller

Responsible for processing your personal data:

Data protection questions: support@driive.cloud.

What we collect

Email address and password (the password is handled by Firebase Authentication; we never see it).
Which plan you have, subscription status and payment history.
File names, folder structure, file sizes and timestamps — what it takes to show you your drive.
How much space you use and how much you have transferred this month.
Devices you have connected: a name you chose, platform, app version and when they were last used.
Security logs: IP address and time at sign-in and on denied access.

Why, and on what legal basis

To deliver the service you bought — account, storage, access. Basis: contract.
To take payment and manage subscriptions. Basis: contract.
To protect accounts against intrusion and abuse. Basis: legitimate interest.
To send operational notices about your account, such as warnings before deletion. Basis: contract.
To meet bookkeeping and tax requirements. Basis: legal obligation.

We send no marketing, sell no data and use no tracking cookies.

The contents of your files

What is inside your files is yours. We do not read it, analyse it or use it for any purpose. Without an encrypted vault the storage is not end-to-end encrypted: technically we can reach content, and may do so where operation or security requires it, or where the law obliges us. With an encrypted vault, contents and file names are encrypted in your browser and the key never leaves your device — then we cannot read any of it.

Where the data is

Files are stored with Cloudflare R2 in a European region. Account and subscription data is in Google Firestore in the EU (eur3). Servers run in Google Cloud in the Netherlands (europe-west4).

Transfers outside the EU

Some of the providers below are US companies that may process data outside the EU for support and operations. Such transfers rely on the European Commission's standard contractual clauses.

Who processes data for us

Cloudflare — storage of your files (R2, European region).
Google Cloud and Firebase — servers, database and sign-in.
Stripe — payments and subscriptions. Stripe is itself a controller for payment data.
Resend — sending operational email about your account.
Inleed — email for the driive.cloud domain.

How long we keep it

Files: as long as the account is active. After the subscription ends they are kept for the retention window and then deleted, after notice.
Deleted files sit in the trash for 7 days and are then removed automatically.
Account data: until you delete the account.
Accounting records: seven years, as Swedish bookkeeping law requires.
Security logs: twelve months at most.

Your rights

You have the right to know what data we hold about you, to have it corrected, to have it erased, to object to certain processing, to restrict processing, and to receive your data in a machine-readable format.

You can delete the whole account yourself under Settings. That cancels the subscription and schedules all your files for permanent deletion.

You can download your files from the app at any time, as originals and without conversion.

Write to support@driive.cloud and we answer within a month.

If you are unhappy

You can complain to the Swedish Authority for Privacy Protection, imy.se, which is the supervisory authority in Sweden.

If something goes wrong

In the event of a personal data breach likely to result in a risk to you, we report it to the Swedish Authority for Privacy Protection within 72 hours, and tell you directly where the risk is high.

Changes

If this policy changes materially, you will be told by email before the new version takes effect.

Contact

Write to support@driive.cloud.