This notice explains what filedone collects, why, who processes it and how long it is kept. In short: files you upload are scheduled for deletion 2 hours after upload, we do not use them to train AI models, and they are sent only to the providers named on the sub-processors page, for the job you asked for. Afterwards we keep a fingerprint of the file and a record of the job, not the file.
Who is responsible
Sarmad Bashir Zargar, sole proprietor, trading as filedone, Down Town, Sopore, Baramulla, Jammu and Kashmir 193201, India, is the data fiduciary under India's Digital Personal Data Protection Act 2023 and the controller under the GDPR and UK GDPR. Questions, requests and complaints about personal data go to the grievance officer, Sarmad Bashir Zargar, at grievance@filedone.ai. We have not appointed a representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR; if you are in the EU, EEA or UK, contact us directly at the address above.
Your files
- Upload. Your browser uploads the file to our object storage over a short-lived signed link. We check its type, size and page count and compute its fingerprint (a SHA-256 hash), which is compared against a list of files that have been reported and blocked. Tools marked as running in your browser do not upload the file at all.
- Processing. Our workers are designed to handle files in memory rather than on persistent disk, and they send the file, or only the part a step needs, to the providers required for the job.
- Deletion. Uploads, working copies and results are scheduled for deletion2 hours after upload, whether or not you downloaded anything. An automatic sweep runs every few minutes to remove them and to ask providers to delete any copy their file store holds. The instruction you typed for the job is cleared at the same time. You can delete an upload earlier yourself.
- Providers. We use AI providers on terms that do not allow them to train on your files. Some keep request logs for up to 55 days to detect abuse, longer for a request they flag. We do not send user files to providers whose terms allow training.
- Saved results. If you are signed in and choose to keep a result, it stays until you delete it, your account is erased, or it has not been opened for 30 days.
- Faces. Where a design contains a face, the face is detected so that region can be protected from editing; no face data is stored. A tool that works from a selfie keeps its inputs no longer than its tool page says, and at most seven days.
What we keep after your file is gone
- File hashes — not files — are kept for one year, to answer fraud reports and to block known-bad content, and because Indian rules require logs of processing to be kept for a year.
- The automated decision made about each document — the class it was assigned (for example "bank statement"), whether the edit was allowed or refused, and why — is kept for one year with the hash.
- Job records (which tool ran, when, how many pages, what it cost) are anonymised after one year: the link to your account, the file names and the hashes are removed, and what remains is accounting.
- Payment records are kept for as long as the law requires — currently eight years for the accounting records Indian tax law makes us keep.
- Reports made to the grievance officer, and what we did about them, are kept as a record of the complaint.
Your account
- We hold your email address, the time you signed up, a one-way hash of the network address you signed up from, and your credit balance and its history.
- Sign-in is by a link or code emailed to you. Sessions last 14 days; each session stores a hash of the network address it was opened from.
- For each job we keep the tool, the pages or images counted, the credits quoted and spent, the outcome, a hash of your instruction and a coarse network bucket — not your full address.
- When a design edit involves a person's face you are asked to confirm that you have the right to use the image and the consent of the people in it. That confirmation is recorded with the time, the job, your network address and your browser's identifier, so we can show it was given.
Cookies and local storage
We use no advertising or cross-site tracking cookies. Our two cookies are first-party and needed for the service:
fd_session— keeps you signed in for 14 days. Not readable by scripts.fd_device— a signed, random identifier set when your browser first sends something to our servers (running a server tool, signing in, joining the waitlist), for free-tier limits and abuse prevention. It lasts up to 400 days and identifies a browser, not a person.
Your browser's local storage holds a few things that stay on your device: your cookie choice, the page to return to after a sign-in link or a checkout, a file you picked on the homepage until the tool page opens it, and, if you are signed in, the run you last started on a page (its number, the tool and the file's name, never the file) so that a reload brings it back. Each is kept for a short time — from a minute to two hours — except your cookie choice, which is kept for a year. Only if you accept analytics, local storage also holds a random analytics ID and the ID of your current visit; both are deleted when you reject or withdraw. A browser we mark as our own, so that our own use of the site is not counted, keeps that mark there until it is cleared.
Your choice is kept in this browser.
Analytics
- For everyone: Cloudflare Web Analytics. Every page counts the visit with Cloudflare's counter, which sets no cookie and stores nothing in your browser. It shows us totals — pages, referring sites, browser, device type, country and load time — not people.
- For everyone: page and step counts. We count how many times each page is viewed and each step of a tool is used — no cookie, no ID, nothing about your file.
- Until you accept, and if you reject: PostHog without an ID. Unless you have chosen "Accept", PostHog, our analytics service hosted in the EU, receives page views (the same details as below), when you leave a page with how long it was open and how far you scrolled, and when a tool run starts, ends and is downloaded (the tool, whether the run worked, its credits and whether you were signed in). No ID is sent and nothing is stored on your device for this — no cookie, nothing in local storage. To tell visits apart, PostHog makes a code from your IP address, your browser's user-agent string and our site's address, mixed with a random value that it replaces every day and then deletes, so the same browser cannot be recognised from one day to the next. PostHog deletes the IP address and the user-agent string from the event once the code is made, before any other processing (so it does not look up your country), and keeps no profile of you. Nothing sent contains a file, a file name, an instruction or text from your documents.
- Only if you accept: PostHog with an ID. Nothing below happens until you choose "Accept" in the cookie banner. If you do, PostHog, our analytics service hosted in the EU, receives page views (the address without query strings other than campaign tags, the referring site, screen width and the tool the page is about), when you leave a page with how long it was open and how far you scrolled, and the events our server records about your sign-up, tool runs, downloads and purchases, under your random analytics ID — and, if you are signed in, your account number, never your email address. Tool pages also send a count of visits and runs to our own server. Like any server your browser connects to, PostHog receives your IP address. We have not turned on session recording or click tracking. Nothing sent contains a file, a file name, an instruction or text from your documents. You can withdraw at any time with "Change your choice" above; the ID is deleted from your browser and from then on you are counted only without an ID, as above.
- Error reports go to Sentry with file names, instructions, uploaded text, email addresses, codes, tokens, cookies and IP addresses removed before they leave our servers.
Abuse prevention
To stop one person taking the free tier many times we use the device cookie above, record a shortened version of your IP address (the last part is dropped), run a Cloudflare Turnstile bot check on sign-in, free runs and our forms, and read a coarse fingerprint of your browser where a client sends one, stored only as a hash and not used on its own to identify you. Spending on AI work is capped per account per day. We do not use any of this to profile you or to advertise.
Payments
Purchases are made through Dodo Payments, the merchant of record, under its own privacy terms. We do not receive your card number. Dodo sends us the payment reference, amount, currency, billing country and the card's issuing country (used to apply India pricing correctly), and we record the credits added.
Sign-in emails, the acknowledgement of a report, notices about runs you started and the periodic reminder of the rules of use are sent through Resend. If you join the waitlist we keep your address until paid plans open, email you about it, then delete it; the unsubscribe link in those emails deletes the address straight away. We do not pass email addresses to anyone else for marketing.
Who processes your data, and where
- Uploads and results are stored with Cloudflare R2 under EU jurisdiction; our database is with Neon in Frankfurt; our servers are with Hetzner in Germany.
- AI providers receive a file, or part of it, only for the job you asked for. Some of them are based in the United States, so sending them a file is a transfer outside the EU and India, made under each provider's data processing terms (standard contractual clauses, or the EU–US Data Privacy Framework where the provider is certified). Every provider is listed on the sub-processors page.
- We do not sell personal data. We share it only with the providers on that page, to run the service, and when the law requires it — a court order, a lawful direction from an authority, or a report handled as described on the grievances page. We do not tell a person who reports a file who uploaded it unless the law requires us to.
Why we may process your data (GDPR)
- Processing your file and running your account: performance of our contract with you (Article 6(1)(b)).
- Abuse prevention, security, the hash log and refusal decisions: our legitimate interest in running a safe service and preventing document fraud (Article 6(1)(f)).
- Keeping payment and ledger records, and answering lawful requests: our legal obligations (Article 6(1)(c)).
- Counting visits with Cloudflare Web Analytics, and page views and tool steps with our own counts, neither of which sets a cookie: our legitimate interest in knowing which pages are used (Article 6(1)(f)).
- PostHog without an ID, for visitors who have not accepted, which stores nothing on your device: our legitimate interest in knowing how the site and its tools are used (Article 6(1)(f)).
- PostHog with your analytics ID, the counts sent to our server, and the waitlist: your consent, which you can withdraw at any time (Article 6(1)(a)).
Under India's DPDP Act this notice is the notice for the purposes above. It is in English; you can ask for it in Hindi or any other language listed in the Eighth Schedule to the Constitution of India by writing to the grievance officer.
Your rights
- Access and correction. Ask what we hold about you and have it corrected. Most of it is visible in your account.
- Erasure. You can erase your account yourself or by emailing us from the address on the account. We then delete your account and sign-in data, unlink your job records from you, and schedule your files for deletion. We keep what the law requires — payment and ledger records, attached to a record that no longer identifies you — and file hashes until their year ends, because they identify a file, not a person. If you had accepted analytics, we ask PostHog to delete your events. An erasure cannot run while a job is still running or a subscription is active; cancel the subscription first.
- Withdraw consent for analytics or the waitlist at any time, without affecting anything you already used.
- Object, restrict and portability, where those rights apply to you.
- Complain. To the grievance officer first; then to the Data Protection Board of India, or, if you are in the EU, EEA or UK, to your data-protection authority.
Send requests to grievance@filedone.ai from the address on the account. We acknowledge them within 24 hours, as Indian law requires, and answer within the time the law that applies to you allows (for example, one month under the GDPR). We may need to confirm it is you before acting on a request.
Security
Connections use TLS; storage and the database are encrypted at rest; links to files are short-lived; and deletion is handled by one dedicated process. No system is perfectly secure, so we cannot promise that data will never be exposed. If a personal-data breach happens, we will notify the people affected and the authorities as the law requires.
Children
filedone is not meant for children. Accounts and purchases are for people aged 18 or over (see the terms). If you believe a child has given us personal data, write to the grievance officer and we will look into it and delete it where appropriate.
Changes
We may update this notice. The date at the top is the version in force, and the sub-processors page shows when its list last changed. If we make a material change, we will tell account holders by email or on the site before it takes effect.