Privacy Policy
How Aldoo Transfer handles your data.
of Aldoo Ltd
Barttelot Court, Barttelot Road, Horsham, West Sussex, RH12 1DQ, United Kingdom
support@aldoo.com
(the “Company”, “Aldoo”, “us”, “we”, or “our”)
Last updated: 31 May 2026
Aldoo Ltd operates the Aldoo Transfer website at transfer.aldoo.com and the related Aldoo Transfer applications (together, the “Service”). The Service lets you upload files to our storage, generate a share link, and deliver those files to recipients you choose. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, and what rights you have. It forms part of, and should be read together with, our Terms of Service.
Aldoo Ltd acts as the data controller for the personal data described below. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU GDPR.
1. What we mean by “your content”
“Your Content” means any file, message, title, recipient email address, or other material you upload, type, or otherwise submit to the Service in connection with a share. Your Content is yours. We do not claim ownership of it, we do not sell it, and we do not use it to train AI models. We process Your Content only as needed to deliver the Service to you and the recipients you choose, and as described in this Privacy Policy.
2. Personal data we collect
2.1 Account data
When you create an account we collect: email address, password (stored hashed), display name, optional avatar, language preference, and the plan you select. Where you sign in through a third-party identity provider (for example Google or Apple), we receive the identifiers and basic profile data that provider releases to us.
2.2 Share data
When you create a share we record: the file names, sizes and types you upload, the recipient email addresses you add, any title and message you type, the access password if you set one, the retention window, the download limit, the share token, the IP address of the device used to create the share, and timestamps for creation, access, download and expiry. We also record the IP address and timestamp of devices that open or download the share so that you can see who accessed it.
2.3 File payload
The files themselves are uploaded to encrypted object storage operated by Cloudflare R2 (see §6). We do not open, scan, index, monitor, or otherwise look at the contents of your files except (a) automatically, where required to comply with law, a valid legal request, our Acceptable Use Policy, or a verified take-down notice; or (b) where you give us explicit permission, for example to investigate a support ticket you raised.
2.4 Billing data
If you purchase a paid plan we collect billing name, billing country, VAT/tax number (where supplied), the last four digits and brand of the card used, invoice history, and the Stripe customer/subscription identifiers. Card numbers, CVCs and full PAN data never touch our servers — they are collected and held by Stripe (see §6).
2.5 Technical & analytics data
When you visit the Service we automatically collect: IP address, browser type and version, operating system, device type, referring URL, pages viewed, approximate location derived from IP (city/country level), and timestamps. We use Google Analytics 4 for product analytics (see §7 on cookies).
2.6 Support data
If you contact us we keep the contents of your message, any attachments, and our reply, linked to your account where applicable.
3. Why we use your data (legal bases)
| Purpose | Categories | Legal basis (UK/EU GDPR Art. 6) |
|---|---|---|
| Run and deliver the Service (uploads, share links, downloads, notifications) | Account, share, file, technical | Performance of a contract (Art. 6(1)(b)) |
| Process payments and issue invoices | Billing | Performance of a contract; legal obligation (tax law) |
| Keep the Service secure, prevent fraud, abuse and DDoS, comply with takedowns | Technical, share, file metadata | Legitimate interests (Art. 6(1)(f)) |
| Service emails (share notifications, expiry warnings, receipts, security alerts) | Account, share | Performance of a contract |
| Product analytics and improvement | Technical, analytics | Consent (where required) / legitimate interests |
| Marketing emails about Aldoo products | Account | Consent — you can withdraw at any time via the unsubscribe link |
| Comply with legal obligations and respond to lawful requests | All | Legal obligation (Art. 6(1)(c)) |
4. How long we keep your data
- Uploaded files (the payload). Each file lives in our storage only for the retention window of the plan that created the share. Retention limits, download caps and grace periods are controlled by feature locks tied to your active plan (see your plan’s description on our Pricing page). When a share expires, files are deleted automatically from primary storage; backup and audit copies are purged within thirty (30) days.
- Share metadata (recipients, timestamps, IPs, access log). Retained for the share’s lifetime plus ninety (90) days after expiry, then deleted or anonymised.
- Account data. Retained while your account exists. If you delete your account, we delete or anonymise your account data within thirty (30) days. We may retain a minimal record (email hash, deletion timestamp) for up to six (6) years to prove the account was closed and to enforce abuse blocks.
- Billing & tax records. Retained for six (6) years from the end of the tax year in which the transaction occurred, as required by UK tax law.
- Support correspondence. Retained for two (2) years from the last reply.
- Analytics. Aggregated to non-identifiable form within fourteen (14) months.
- Inactive accounts. If you have no paid plan and have not signed in for twelve (12) months, we may delete or close your account after notice.
5. Who can see your files
Only the people the share is sent to, and anyone they forward the share link to. You decide:
- which recipient email addresses receive the link;
- whether the share requires a password to open;
- whether downloads are capped to a specific number;
- when the share expires.
Aldoo employees do not read your files. Automated systems may scan file metadata (size, type, fingerprint) for abuse detection, malware signatures and known-illegal-content hashes. We will disable a share or account if we are legally required to do so or if we receive a verified take-down notice or court order.
6. Processors and third parties we share data with
We use the following processors to run the Service. Each is bound by a written contract that limits their use of personal data to providing services to us.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare, Inc. (R2 object storage & edge CDN) | File storage, transfer, and delivery | Uploaded files; basic request metadata | EU + global edge |
| Stripe, Inc. | Payment processing and billing | Name, email, billing country, card token, transaction history | EU + USA (under Standard Contractual Clauses) |
| SparkPost (MessageBird) | Transactional email delivery (share notifications, receipts, password reset) | Recipient email address, share metadata used in the email body | EU + USA (under Standard Contractual Clauses) |
| Google Ireland Ltd (Google Analytics 4) | Product analytics | Truncated IP, pseudonymous device/session identifiers, page events | EU + USA (under Standard Contractual Clauses) |
We do not sell, rent, or trade personal data to anyone. We do not share Your Content with advertisers. We do not use Your Content to train any AI or machine-learning model.
We may share information with law-enforcement authorities, courts or regulators where compelled by a legally binding request, or to protect the rights, property or safety of Aldoo, our users, or the public.
7. Cookies and similar technologies
The Service uses a small number of cookies and similar identifiers:
- Strictly necessary — session, authentication, CSRF protection, theme preference, cookie-consent state. These are set without your consent because the Service cannot function without them.
- Analytics — Google Analytics 4 cookies are set only after you consent through the cookie banner. You can withdraw consent at any time from the cookie settings link in the footer.
We do not run advertising cookies or cross-site tracking pixels.
8. International transfers
Aldoo Ltd is established in the United Kingdom. Some of our processors operate in the United States or have global infrastructure. When personal data leaves the UK or the European Economic Area, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision recognised by the UK Information Commissioner’s Office.
9. Security
Files are transferred to and from our storage over TLS 1.2+ and stored on encrypted volumes. Passwords are hashed with industry-standard adaptive hashing. Access to production systems is restricted, multi-factor-authenticated and audit-logged. No system can be guaranteed 100% secure; you remain responsible for sharing links and passwords only with people you trust, and for backing up files you need to keep long-term.
10. Your rights
You have the following rights under UK and EU data-protection law:
- Access — ask for a copy of the personal data we hold about you;
- Rectification — ask us to correct inaccurate data;
- Erasure — ask us to delete your account and associated data (subject to the retention rules in §4);
- Restriction — ask us to limit how we use your data;
- Portability — receive your account data in a machine-readable format;
- Objection — object to processing based on legitimate interests, including direct marketing;
- Withdraw consent — at any time, without affecting prior lawful processing.
To exercise any right, email support@aldoo.com. We respond within thirty (30) days. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.
11. Children
The Service is not directed to children under the age of thirteen (13). We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact support@aldoo.com and we will delete it. Where local law sets a higher age of digital consent, that higher age applies.
12. Subscriptions, refunds and cancellations
Paid plans are billed in advance for the subscription period you select (monthly or annual) and renew automatically until you cancel. You can cancel at any time from your account settings.
- Web subscriptions purchased through Aldoo Transfer directly. On request to support@aldoo.com within fourteen (14) days of the most recent renewal payment, we will refund that last payment, less any overage already consumed. Earlier renewal payments are non-refundable. By starting to use a paid plan immediately after purchase, EU/UK consumers expressly request that we begin performance within the statutory withdrawal period and acknowledge that, once performance has begun, the right of withdrawal under the Consumer Contracts Regulations is lost to the extent of services already supplied.
- Mobile subscriptions purchased through Apple App Store or Google Play. Refunds are handled exclusively by Apple or Google under their store policies. We have no ability to issue or block refunds for App Store / Play purchases.
Cancelling a subscription stops future renewals; it does not retroactively refund prior periods.
13. Disclaimer and limitation of liability
The Service is provided “as is” and “as available”. To the maximum extent permitted by law, Aldoo Ltd disclaims all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will be uninterrupted, error-free, secure against every threat, or that any file you upload will be preserved against loss, corruption, deletion, premature expiry, mis-routing, or unauthorised access by recipients you shared the link with. You are responsible for keeping your own backups of any file you need to retain.
To the maximum extent permitted by law, our total aggregate liability to you for any and all claims arising from or relating to the Service is limited to the greater of (a) the fees you paid us in the twelve (12) months preceding the event giving rise to the claim, or (b) one hundred British pounds (GBP 100). We are not liable for indirect, incidental, special, consequential or punitive damages, loss of profit, loss of revenue, loss of data, or loss of goodwill. Nothing in this Policy or our Terms excludes liability that cannot lawfully be excluded, including liability for death or personal injury caused by our negligence, or for fraud.
14. Your responsibility for what you upload
You confirm that you own Your Content or have all necessary rights, licences and permissions to upload, transfer and share it. You are solely responsible for Your Content and for the consequences of uploading or sharing it. You must not use the Service to upload, transfer or share material that infringes intellectual-property rights, contains malware, depicts child sexual abuse, incites violence or terrorism, breaches export-control or sanctions law, or otherwise violates any applicable law or our Acceptable Use Policy.
We may, without prior notice, remove or disable access to any share, suspend or terminate any account, and report the matter to the relevant authorities, if we receive a credible report of, or otherwise become aware of, unlawful content or use.
15. Changes to this Policy
We may update this Privacy Policy from time to time. When we make material changes we will notify you by email or by a prominent notice in the Service before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy. The current version is always available at transfer.aldoo.com/service/privacy.
16. Governing law and disputes
This Privacy Policy and any dispute arising from or in connection with it are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that consumers resident in the European Union may also bring proceedings in the courts of their country of residence, as required by law.
17. Contact
Aldoo Ltd
Data Protection / Privacy
Barttelot Court, Barttelot Road, Horsham, West Sussex, RH12 1DQ, United Kingdom
support@aldoo.com