ProjectSend Cloud — Privacy Policy

DRAFT v0.2 — September 2026. Internal working draft. Have this reviewed by qualified counsel before publication. Bracketed items require business decisions.

Effective date: [DATE]

This Privacy Policy describes how Gallifrey AI Inc. ("Company", "we", "us") processes personal data in connection with ProjectSend Cloud (the "Service"): the marketing site at projectsend.cloud, the customer portal at app.projectsend.cloud, and the ProjectSend sites we host at projectsend.site, including the shared site of the Free plan. It applies to the hosted Service only — not to the open source software available at projectsend.org, which runs on servers we do not operate.

1. Two roles, two kinds of data

Account data (we are the controller). When you create an account we process your name, email, company name, billing information, and usage data needed to operate, secure, and improve the Service.

Customer Content (we are a processor). Files and End User data inside your portal belong to you. We host them on your behalf and on your instructions. We do not access, review, or monitor the content of files in your portal except as described in our Terms of Service (abuse investigation, DMCA, legal requirement). On the Free plan, your account lives on a shared site we run; your files are still yours, private to you and to the people you send a link to, and we treat them the same way. A Data Processing Addendum (DPA) is available on request for customers subject to GDPR or similar laws. [Publish the DPA; see docs/legal-readiness.md §2.1.]

If you connect an AI assistant or another tool to your account, Section 10 applies as well.

2. What we collect

• Account and billing data: name, email, organization, plan, payment status. Card details are processed by Stripe; we never store full card numbers.
• Where your sign-up came from: if the link that brought you to us carried tags (for example which page, campaign or AI assistant it came from), we store those tags with your account to count sign-ups by source. They do not decide anything about your account.
• Instance metadata: portal name, address, storage usage, feature settings, and the version of the Terms you accepted, when, and from which IP address.
• Activity in your portal: who uploaded, shared, downloaded or previewed what, and when, with the origin of each action (web, API, or AI assistant) and the name of the token or assistant involved. This is your portal's activity log, kept for you and shown to you; on the Free plan you see it as your files' download counts.
• Logs and security data: IP addresses, timestamps, and events needed for security, auditing, and abuse prevention.
• Analytics: usage of the marketing site and the customer portal, through Google Analytics (Section 8).
• Waiting list and support communications: the email address you leave to hear from us, and the messages you send us.

We do not sell personal data, and we do not use Customer Content to train AI models or for advertising.

Legal bases (GDPR). [For counsel to confirm:] performance of a contract (account, billing, providing the Service); our legitimate interests (security, abuse prevention, understanding how the Service is used); legal obligations (tax and accounting records, valid legal requests); and consent, where required, for analytics cookies.

3. Subprocessors

We use a small set of service providers to run the Service:

A current list will be published at [projectsend.cloud/subprocessors] and we will give [30] days' notice of additions [with a right to object for customers under a DPA].

4. Retention and deletion

• Account data is kept while your account is active [and for [x] months after, unless a legal obligation requires longer].
• Customer Content on paid plans: after termination it remains exportable for [30] days, is then deleted from active systems, and within [90] days from backups — matching Section 5.4 of the Terms. [Align both numbers with the real backup retention.]
• Files on the Free plan are kept for 30 days after they are uploaded and are then deleted, together with their links, as the Terms describe. We email you before that happens.
• Free plan accounts nobody signs in to (or uses through a connected assistant) for a month are paused and later removed, together with their files [schedule to confirm with the platform team].
• Activity logs of your portal follow the audit history of your plan, as published on the plans page.
• Security logs are kept for [12] months.
• Billing records are kept as long as tax and accounting law requires [7 years].
• AI connector data: see Section 10.

Because ProjectSend is open source, you can export your data and continue on a self-hosted instance at any time.

5. Security

Encryption in transit and at rest, access controls, daily backups on a provider separate from primary storage, and, on paid plans, a database of your own for each portal, with file storage credentials scoped to that portal alone. On the Free plan, accounts share one site; each account's files are private to that account and to whoever holds a link the account holder created. Our team does not access the content of your files. We will notify affected customers without undue delay after becoming aware of a personal data breach affecting their data [within 48 hours for customers under a DPA — to confirm].

6. International transfers

The Service is operated from the United States, and the providers in Section 3 process data there [and, for Cloudflare, in the regions its network uses — confirm where R2 buckets are located]. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of personal data to us rely on the Standard Contractual Clauses [to be included in the DPA] and equivalent mechanisms. [If/when offering EU data residency: describe hosting regions.]

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing (GDPR, CCPA, and similar laws). Write to [[email protected]] and we will respond within the legally required timeframe. End Users of a customer portal should direct requests to the portal owner (the controller); we will assist the owner as processor.

California. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA. [Counsel to confirm the notice at collection and whether the thresholds apply.]

8. Cookies and analytics

We use essential cookies for authentication, session management and security. The marketing site and the customer portal also use Google Analytics 4 to understand how they are used; it sets its own cookies. [Decide with counsel: consent banner where required, IP anonymisation, and whether analytics stays on the portal.] The ProjectSend sites we host for you use only essential cookies. No advertising trackers, anywhere.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

10. AI connectors

You can connect an AI assistant (Claude, ChatGPT, Claude Code, Cursor, an automation tool or an agent of your own) to your account through our connector. When you do, the assistant can see and act on file names, sizes, links, download records and, on paid plans, client details — never the contents of your files — and only within what you approved. The assistant's replies are produced by the AI provider you chose, under its own terms; that provider is not our subprocessor. We store the assistant's registration, the connection's credentials (hashed), when it was last used, and every action in your activity log, marked as done by your AI assistant. Connections expire after 30 days without use, and you can end one at any time from your account.

The full text is the AI connectors section of this Policy, which forms part of it.

11. Changes

We will announce material changes by email or in-app notice at least 30 days in advance.

12. Contact

Gallifrey AI Inc. · [[email protected]]