GDPR and your data

upload.am is operated by Leads.am, based in Armenia. For the personal data of account holders we are the data controller. For files and data that business customers put into a Team, we act as a processor on their instructions — see the Data Processing Agreement.

Account data: name, email address, password (stored only as a hash), language, plan. Security data: IP address, country, device and browser type, sign-in history and the devices that opened your account. Service data: the files, folders and links you create, their sizes, names and download counts, messages in your Inbox and messages to support. Payment data: the plan, amount and status of orders; card payments are handled by our payment processor and we never see or store your card number. Optional data: a payout wallet address if you join the partner programme.

To provide the service you asked for (contract): storing and sharing your files, running your account, taking payments. To keep the service safe (legitimate interest): preventing abuse and fraud, rate limiting, sign-in alerts, handling abuse and copyright reports. To meet legal duties: accounting and tax records. We do not sell personal data and we do not use the content of your files for advertising or profiling.

We do not read your files or analyse their content. Files are stored in object storage and can be reached only through links and sessions you control. A file you protect with a password, an email lock, a download limit or an expiry date is protected as you set it. The Windows app can encrypt files on your device before upload (Vault) so that we cannot read them.

Files are stored on object storage in Sweden (European Union). The application servers that run the website are located in the United States. Where personal data is processed outside the European Economic Area, we rely on appropriate safeguards. The current list of providers is in the Data Processing Agreement.

Files are kept according to the retention rules of your plan shown on the pricing page, and removed from storage when they expire or when you delete them (deleted files stay in the trash for a few days first). Security logs are kept for a short rotating period. Payment records are kept as long as accounting law requires. When you delete your account, your files, folders, links, devices and messages are deleted immediately and permanently; payment records are kept without any link to you.

You can ask us for access to your data, correction, deletion, restriction, a portable copy, or object to processing. Most of this you can do yourself: in Account → Your data you can download a copy of your data (JSON) and delete your account and all files. For anything else, write to us through the contact page and we will answer within one month.

Connections to the site are encrypted. Access to files is controlled by links, passwords and sessions. We offer two-step sign-in by email, alerts about sign-ins from new devices or countries, confirmation of new devices, a list of devices you can sign out, an audit log for Team accounts, and client-side encrypted storage in the Windows app. No system is perfectly secure; if a breach affects your data we will tell you and the supervisory authority as the law requires, without undue delay.

Child profiles on shared family plans are created and supervised by the plan owner (a parent or guardian), who can see the names, sizes and dates of the child's files. The service is not directed at children who are not part of a family plan managed by an adult.

If you think we handle your data unlawfully, please contact us first through the contact page. You also have the right to complain to your local data protection authority.