Privacy Policy & UK GDPR Notice

Attach & Send acts as data controller for account registration, billing records, and operational security telemetry, and as data processor for files and recipient metadata uploaded by workspace customers.

In accordance with the UK GDPR storage limitation principle, uploaded transfer objects are retained strictly until their configured expiration timestamp (3 days for Guest, up to 90 days for Business) or earlier manual revocation, after which objects are permanently purged from DigitalOcean Spaces.

Core infrastructure is hosted in the London (UK) region via DigitalOcean (Spaces Object Storage, Managed MySQL, Managed Valkey), Stripe (UK/EU payment processing), and Brevo (transactional email delivery). We never sell personal data or run third-party ad networks on recipient download pages.

We use strictly necessary HttpOnly session cookies to authenticate guest uploaders and signed-in accounts. We do not load non-essential advertising pixels on transfer or recipient routes.