# Privacy Policy Last updated: October 13, 2026. This Privacy Policy explains how NORDLANE DIGITAL S.R.L., a company established in Romania operating Filedeck ("we", "us", or "our"), processes personal information. It applies to our websites, accounts, public guides, delivery activity, and support communications. The purposes for which we process information determine our responsibilities under applicable law. ## Our role and customer content Nordlane is the controller for its own account administration, billing administration, support, service security, and optional marketing activities. Business customers decide the purposes and recipients of the personal data they put in uploaded files and delivery rooms. Where we process that content solely on a customer's instructions, we act as a processor and remain subject to the obligations that apply to that role. Customers are responsible for their lawful collection, instructions, required notices, and choice of recipients. This policy does not replace a data processing agreement where one is required. ## Information and sources You provide account and workspace details, email addresses, uploaded content and file metadata, room settings, client notes, consent choices, and support communications. A room owner may provide a client name or other information about a recipient. Visitors may provide review names and messages. Service activity can generate account and session identifiers, IP addresses, browser information and user agents, timestamps, room views, downloads, usage records, and derived identifiers used for rate limiting and abuse prevention. Google sign-in supplies the identity information needed for that sign-in. Stripe handles checkout and supplies the customer, subscription, and payment references and status used by Filedeck. ## Purposes and legal bases Where GDPR applies to our controller activities, necessary account and delivery services and requested pre-contract steps rely on performance of a contract with the individual concerned. Service security, abuse prevention, delivery activity records, support for people who are not contracting customers, and establishing or defending legal claims rely on legitimate interests, subject to the required assessment of individuals' interests and rights. Those interests are operating a reliable service, resolving requests and disputes, and protecting Nordlane and its users. Mandatory accounting, tax, and regulatory records rely on legal obligations. Optional product-update marketing and optional analytics or advertising storage rely on consent where required. Providing essential account, delivery, or billing details is necessary for the relevant service; optional marketing consent is not a condition of an account. ## Uploads, access instructions, and recipient copies Upload and share content only when you have the authority to do so, and use access settings appropriate to the information involved. Room owners choose the content, access links, and available password or expiry controls. A delivery link can be passed to another person; visitor names and possession of a link do not establish a verified identity. Pausing a room or deleting content stops new access controlled by that action. Already issued short-lived access or transfers may finish, and those actions cannot recall downloaded copies or disable separate links that remain active. Keep your own copy of important files. Filedeck is not a promise of indefinite storage or exclusive control over recipient copies. ## Necessary operational access Our systems process content to store, display, deliver, and delete it as instructed. Authorized operational access may be necessary for a specific support request, delivery problem, security incident, suspected abuse, valid legal demand, or dispute. Any such access must have a lawful purpose and be limited to what is necessary. This policy does not promise that all content is routinely inspected, that every threat is detected, or that a hosted service is free of security risk. Nordlane's mandatory data protection and security obligations continue to apply. ## Client delivery reviews When a room owner enables reviews, a visitor can provide a name, approve a delivery, or request changes with a message. Filedeck records the response, its time, and the delivery version reviewed. The supplied name is not verified. Written feedback and review history are available to the room owner and are not shown to other visitors. Room review records are removed with the room or its owner's account. Activity counts and reviews are service signals; they do not by themselves prove a recipient's identity, that every transfer completed, or that a contract was accepted. ## Recipients and lawful disclosures We use Supabase, Vercel, Cloudflare, Brevo, Resend, Google, and Stripe for the relevant hosting, storage, authentication, security, email, and payment functions. Support submissions are stored for handling and emailed to our support inbox. Customers' sharing instructions make content and room information available to the recipients with access. Providers such as Google and Stripe can also have independent responsibilities for their own processing. We may disclose information where necessary and lawful to comply with valid legal process, prevent abuse, protect people or the service, or establish, exercise, or defend legal claims. Such disclosures must be proportionate to their purpose. Provider use does not remove Nordlane's own obligations. - [Filedeck service providers](https://www.filedeck.pro/subprocessors) ## Processing locations and international transfers Filedeck's core Supabase database is currently configured in the Ireland region. This does not mean that every provider, support activity, or advertising operation processes all information only in the European Economic Area. Provider locations and transfer arrangements depend on the service and processing involved. Supabase and Vercel publish data processing terms describing their transfer safeguards, including standard contractual clauses where applicable. A transfer requiring GDPR safeguards must have a mechanism applicable to that transfer and any additional protection required by law. Contact us for information about the locations and safeguards relevant to your data or a copy of applicable safeguards. - [Supabase data processing terms](https://supabase.com/legal/customer-resources/data-processing-addendum) - [Vercel data processing terms](https://vercel.com/legal/dpa) ## Cookies, marketing, and advertising Necessary browser storage supports authentication, security, delivery, and remembering choices. Filedeck's optional analytics and marketing categories require the applicable consent choice. Product updates are sent only after an opt-in, and that choice can be withdrawn. Google AdSense is connected only on the separate public guide domain, guides.filedeck.pro; it is not installed on account or private delivery pages. Ad serving is subject to Google approving the site. Google and advertising partners may receive a page URL, IP address, and browser identifiers for ad delivery, measurement, and fraud prevention, and may use cookies or previous browsing activity for personalized advertising subject to applicable consent requirements. Where available, the guide footer's Advertising privacy choices reopens Google's European message. Filedeck's app cookie settings manage its own categories separately. Withdrawing consent does not invalidate processing already performed lawfully on that consent. - [Filedeck cookie settings and policy](https://www.filedeck.pro/cookies) - [Google Ads Settings](https://adssettings.google.com/) - [How Google uses information from partner websites](https://policies.google.com/technologies/partner-sites) ## Routine retention We keep information for the service and purposes described here, using the nature of the record, account or request status, applicable legal duties, and relevant dispute periods to determine retention. Routine cleanup is configured for download and room activity and optional analytics older than 180 days, Filedeck app cookie-consent history older than 395 days, and privacy request records older than 1,095 days. These rules apply to those record categories, not to all provider data or correspondence. Files in Trash have a 30-day recovery period before scheduled permanent cleanup. Free temporary delivery links are intended to expire after seven days; expiry of a link is not a promise that every associated record or external copy is erased at that moment. ## Deletion and retained evidence Account or file deletion removes user-controlled content and removable app information through the applicable deletion process. We may retain the minimum information needed for mandatory billing and tax records, valid consent or legal acknowledgement evidence, security and fraud prevention, handling unresolved support matters, or establishing, exercising, or defending legal claims. Such records have separate retention criteria and are not all subject to a three-year deletion deadline. Deletion can leave minimized references such as an account identifier, email-derived hash, and deletion date; these are not necessarily anonymous. Support correspondence and data independently retained by a payment or other provider are not automatically erased by closing a Filedeck account. Contact us to request their assessment for erasure. Any exception must have a lawful basis and last only for as long as that purpose requires. ## Self-service controls and exports Settings offers an account-data export and deletion controls. The account JSON export contains the available account records and metadata; it does not embed all uploaded file bytes. Download original files separately while you have access. If an export section fails, or the self-service flow cannot complete your request, contact us for assistance. Destructive self-service actions require the applicable identity checks, and the current account-closure flow requires paid subscriptions to be canceled first. These product checks do not make statutory privacy rights conditional on using the self-service flow: requests can also be made using our contact address. ## Optional problem reports You can choose to send a diagnostic after a problem. It contains a random report identifier, problem category, general page category, and release version. It does not include raw error text, stack traces, account identifiers, file names, or links. Routine cleanup removes diagnostic records after 30 days. Sending a diagnostic does not enable analytics or marketing cookies. ## Your rights and request handling Where applicable, you can request access, correction, erasure, restriction, or portability, object to processing, and withdraw consent. The conditions of each right depend on the processing and legal basis. We may ask for proportionate additional information when there are reasonable doubts about your identity, or redact information to protect others' rights when the law permits. GDPR requests are handled without undue delay and normally within one month. For complexity or number of requests, the law permits an extension of up to two further months, with notice and reasons within the first month. We may charge a reasonable administrative fee or refuse a manifestly unfounded or excessive request only where the law allows and we can justify doing so. We will explain a refusal or lawful retention exception and the available complaint and judicial remedies. For customer-controlled content, we may refer the request to the responsible customer and assist as required; requests about our own processing remain our responsibility. ## Security incidents and policy changes We assess personal data incidents and make the notifications to authorities and affected individuals required by applicable law. We may update this notice to reflect the service, providers, or legal requirements, and update its displayed date. Where the law requires additional notice or consent for a change, that requirement applies before the relevant change takes effect. Reading or accepting this policy does not by itself supply consent for optional marketing, cookies, or advertising, or waive mandatory privacy rights. ## Contact and complaints NORDLANE DIGITAL S.R.L. operates Filedeck. Contact nordlane.digital@gmail.com for privacy questions or requests, including requests from people without a Filedeck account. You can also complain to an applicable data protection authority. In Romania, this is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal). Where GDPR applies, you can also complain to the authority in your place of habitual residence, work, or the alleged infringement; contacting us first is not a condition of that right. - [Romanian data protection authority — ANSPDCP](https://www.dataprotection.ro/) - [Find a data protection authority](https://www.edpb.europa.eu/contact/file-a-complaint_en) Source: [Privacy Policy](https://www.filedeck.pro/privacy).