ProjectSend Cloud — Privacy Policy

Version 1.0 · Effective date: October 6, 2026

This Privacy Policy describes how Gallifrey AI Inc. ("Company", "we", "us") processes personal data in connection with ProjectSend Cloud (the "Service"): the marketing site at projectsend.cloud, the customer portal at app.projectsend.cloud, and the ProjectSend sites we host at projectsend.site, including the shared site of the Free plan. It applies to the hosted Service only — not to the open source software available at projectsend.org, which runs on servers we do not operate.

1. Two roles, two kinds of data

Account data (we are the controller). When you create an account we process your name, email, company name, billing information, and usage data needed to operate, secure, and improve the Service.

Customer Content (we are a processor). Files and End User data inside your portal belong to you. We host them on your behalf and on your instructions. We do not access, review, or monitor the content of files in your portal except as described in our Terms of Service (automated security and abuse checks, abuse investigation, DMCA, legal requirement). On the Free plan, your account lives on a shared site we run; your files are still yours, private to you and to the people you send a link to, and we treat them the same way. A Data Processing Addendum (DPA) is available on request for customers subject to GDPR or similar laws.

If you connect an AI assistant or another tool to your account, Section 10 applies as well.

2. What we collect

• Account and billing data: name, email, organization, plan, payment status. Card details are processed by Stripe; we never store full card numbers.
• Where your sign-up came from: if the link that brought you to us carried tags (for example which page, campaign or AI assistant it came from), we store those tags with your account to count sign-ups by source. They do not decide anything about your account.
• Instance metadata: portal name, address, storage usage, feature settings, and the version of the Terms you accepted, when, and from which IP address.
• Activity in your portal: who uploaded, shared, downloaded or previewed what, and when, with the origin of each action (web, API, or AI assistant) and the name of the token or assistant involved. This is your portal's activity log, kept for you and shown to you; on the Free plan you see it as your files' download counts.
• Logs and security data: IP addresses, timestamps, and events needed for security, auditing, and abuse prevention.
• Analytics: usage of the marketing site and the customer portal, through Google Analytics (Section 8).
• Support communications and the former waiting list: the messages you send us, and the email address you left on our waiting list before registration opened.

We do not sell personal data, and we do not use Customer Content to train AI models or for advertising.

Legal bases (GDPR). Performance of a contract (account, billing, providing the Service); our legitimate interests (security, abuse prevention, understanding how the Service is used); legal obligations (tax and accounting records, valid legal requests); and consent, where the law requires it, for analytics cookies.

3. Subprocessors

We use a small set of service providers to run the Service:

This table is the current list. We will update it here and tell customers by email at least 30 days before a new provider starts to process Customer Content.

4. Retention and deletion

• Account data is kept while your account is active and, after it is closed, for as long as we need it to meet our legal obligations, resolve disputes and enforce our agreements.
• Customer Content on paid plans: when a paid plan ends it is kept for 30 days so that it can be exported, is then deleted from active systems, and within a further 35 days from backups — matching Section 5.4 of the Terms.
• Files on the Free plan are kept for 30 days after they are uploaded and are then deleted, together with their links, as the Terms describe. We email you before that happens.
• Free plan accounts nobody signs in to (or uses through a connected assistant) for more than a month may be paused and, after notice by email, removed together with their files.
• Activity logs of your portal follow the audit history of your plan, as published on the plans page.
• Security logs are kept for as long as they are needed for security, auditing and abuse prevention.
• Billing records are kept for as long as tax and accounting law requires.
• AI connector data: see Section 10.

Because ProjectSend is open source, you can export your data and continue on a self-hosted instance at any time.

5. Security

Encryption in transit and at rest, access controls, and, on paid plans, a database of your own for each portal, with file storage credentials scoped to that portal alone. Databases are backed up every night to a separate cloud project that our servers can add to but cannot delete from, and each backup is kept for 30 days. On the Free plan, accounts share one site; each account's files are private to that account and to whoever holds a link the account holder created. Our team does not access the content of your files; uploads may be checked automatically for malware and abuse, as the Terms describe. We will notify affected customers without undue delay after becoming aware of a personal data breach affecting their data.

6. International transfers

The Service is operated from the United States, and the providers in Section 3 process data there. Files are stored with Cloudflare R2, which selects the storage region of each bucket automatically, and are delivered through Cloudflare's global network. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of personal data to us rely on the Standard Contractual Clauses, which form part of the Data Processing Addendum available on request, and on equivalent mechanisms.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing (GDPR, CCPA, and similar laws). Write to privacy@projectsend.cloud and we will respond within the legally required timeframe. End Users of a customer portal should direct requests to the portal owner (the controller); we will assist the owner as processor.

California. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA.

8. Cookies and analytics

We use essential cookies for authentication, session management and security, and one that remembers your cookie choice. The marketing site and the customer portal also use Google Analytics 4 to understand how they are used. If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics sets its cookies only after you accept them in the cookie notice. Everywhere else they are on unless you turn them off. Either way, you can change your choice at any time from Cookie settings at the foot of projectsend.cloud, and the customer portal follows the same choice. The ProjectSend sites we host for you use only essential cookies. No advertising trackers, anywhere.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

10. AI connectors

You can connect an AI assistant (Claude, ChatGPT, Claude Code, Cursor, an automation tool or an agent of your own) to your account through our connector. When you do, the assistant can see and act on file names, sizes, links, download records and, on paid plans, client details — never the contents of your files — and only within what you approved. The assistant's replies are produced by the AI provider you chose, under its own terms; that provider is not our subprocessor. We store the assistant's registration, the connection's credentials (hashed), when it was last used, and every action in your activity log, marked as done by your AI assistant. Connections expire after 30 days without use, and you can end one at any time from your account.

The full text is the AI connectors section of this Policy, which forms part of it.

11. Changes

We will announce material changes by email or in-app notice at least 30 days in advance.

12. Contact

Gallifrey AI Inc.
1321 Upland Drive, APT 3273
Houston, TX 77043, United States
privacy@projectsend.cloud