Privacy Policy

How 500files processes personal data. This policy applies to 500files.com.

Created: 2026-02-26
Last updated: 2026-10-24

1. Controller (Art. 4 GDPR)

2. What we process

Server access logs

The web server records: IP address, timestamp, requested URL, HTTP status, referrer and user agent. Access logs are rotated daily and the most recent 14 days are kept. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in service stability and abuse prevention).

File requests

When you create a file request we store: title, description, your email (if provided for upload notifications), settings (max file size, expiry, password, allowed file types, branding) and your IP address (for abuse prevention). Legal basis: Art. 6(1)(b) GDPR.

Uploaded files

When someone uploads to a request we store: the file itself, original filename, file size, SHA256 checksum and uploader IP address. Optionally collected if the request creator enabled it: uploader name and email. Files are stored on a server we operate (no third-party cloud storage like S3 is used). Default expiry is 7 days, maximum 14 days. After expiry files are automatically and irreversibly deleted. Legal basis: Art. 6(1)(b) GDPR.

Automated malware scanning

Uploaded files are scanned by ClamAV, an open-source antivirus engine that we run on our own server. Files are not sent to any third party for scanning. We store the scan result (clean / flagged), the name of the matched ClamAV signature and a timestamp. A flagged file is not deleted: it is delivered to the recipient with a "possible virus" warning, it is not shown in the page's public photo gallery and it is not copied automatically to connected cloud storage (Google Drive, Dropbox, OneDrive). We may open a flagged file only to check whether the warning was correct. If the scanner is unavailable or fails, the file is delivered and recorded as not scanned. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting recipients and infrastructure from malware). Scanning is automated and best-effort, not a guarantee: no scanner detects every threat, and a file larger than the scanner can read is recorded as not scanned rather than clean.

Google sign-in (OAuth, optional)

You can sign in with Google to attach anonymous requests to a "My requests" dashboard. Google LLC (Mountain View, USA) transmits your email, name, avatar URL and a profile identifier. We store these only while your account exists. Legal basis: Art. 6(1)(a) GDPR (consent) plus (b) (contract). Transfer to Google in the USA relies on the EU-U.S. Data Privacy Framework (C(2023) 4745).

Transactional email (Maileroo)

Notification emails are sent through Maileroo Inc. as our processor (Art. 28 GDPR). Maileroo handles the recipient address and the message body on our behalf. We do not send marketing emails.

Analytics (first-party, cookieless)

Page views are recorded by an analytics service run by the same operator named in section 1. No third party receives this data. Per view we store the page URL, the referring page, an approximate location derived from your IP address (country, region, city), browser, operating system, device class, screen width and language. The IP address itself is not stored: it is used for the location lookup, and together with the browser user agent it goes into a salted hash whose salt is replaced every day, which lets us count repeat views within one day without recognising you across days. No cookies are set. Legal basis: Art. 6(1)(f) GDPR.

Error tracking (self-hosted)

Crashes are recorded by our own self-hosted error tracker. Stack trace, request URL, IP address and (if signed in) user email may be stored. No third party receives this data. Retention 90 days. Legal basis: Art. 6(1)(f) GDPR.

Backups (Backblaze B2)

Our database is backed up nightly to Backblaze B2, operated by Backblaze, Inc. (San Mateo, USA) as our processor (Art. 28 GDPR). Backups are encrypted on our server before upload and do not contain uploaded files. They do contain the database records described above, including filenames, checksums and IP addresses. A deleted record remains in older backups until they rotate out, at most 6 months later. Backups are used only to restore the service after a failure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in recovering from data loss). Transfer to Backblaze in the USA relies on the Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3. Third-country transfers

The service runs on a VPS server outside the EU. The operator is based in Vietnam. Transfers to non-EU countries rely on Art. 49(1)(b) GDPR (necessary for the performance of a contract).

4. Your rights (Art. 15-22 GDPR)

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Portability (Art. 20)
• Objection (Art. 21)
• Withdraw consent at any time

Email legal@500files.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

5. Retention

Server logs: 14 days. Uploaded files: until the request expires (max 14 days); uploaded files are never included in backups. Request and upload metadata (titles, filenames, checksums, IP addresses): deleted together with the request - by its creator, or automatically 3 days after expiry. Account data: until account deletion. Analytics: 12 months. Error events: 90 days. Encrypted backups: at most 6 months.

6. Security

HTTPS for all connections. Hashed credentials where applicable. No security measure is perfect; you use the service at your own risk.

7. Cookies

No tracking cookies. Only a strictly-necessary session cookie is used (consent-exempt under § 25(2) TTDSG / EU ePrivacy Directive).