Privacy Policy
Last updated: September 2026
Privacy is the point of FileAlloy, not an afterthought. Here is exactly what happens to your files and data.
Data controller
FileAlloy is operated by Sai Shri Ram Saiveeraaswaamy, an individual entrepreneur (micro-entrepreneur) registered in France, who is the controller of the personal data described in this policy. Full identification is in our Legal Notice. For any privacy matter, contact support@filealloy.com.
Your files
Free browser tools. Tools like Merge, Split, and Rotate run entirely on your device using your browser. Your files are never sent to us. Nothing is uploaded.
The API. When you call the API, your file is processed in an isolated, temporary workspace that is destroyed as soon as the response is returned. We do not write your files to permanent storage, we do not log their contents, and we do not keep them.
Account and billing
When you create an account at app.filealloy.com, we store your email address and sign in identity, your API keys (kept only as a one way hash, never the full key), and a monthly count of your requests for metering. This account data is stored with Supabase, our authentication and database provider, hosted in the EU.
Paid plans are processed by Stripe. Stripe handles your card details directly; we never see or store them. We keep only a Stripe customer reference and your current plan. If you subscribe through RapidAPI instead, your account and billing there are handled by RapidAPI under their own privacy policy.
Analytics and consent
To understand how the site is used we use Google Analytics 4 and Microsoft Clarity (which records anonymised interaction data such as clicks and scrolling to build heatmaps). These only run after you accept them in the cookie banner. If you decline, they stay switched off and no analytics cookies are set. You can change your mind by clearing this site's storage in your browser. We also use Cloudflare Web Analytics, which is cookieless and does not identify you.
Cookies
The site stores a local preference for your color theme and your analytics consent choice. Analytics cookies (from Google Analytics and Microsoft Clarity) are only set if you accept them. We do not sell your data.
Third parties
We rely on a small set of providers, each processing data only to provide their part of the service: Supabase (accounts and database, EU), Railway (API hosting, EU region), Stripe (payments), Resend (sign in and transactional email), Cloudflare (hosting, DNS, and cookieless analytics), and RapidAPI (for customers who subscribe there). Each acts as our processor under a data processing agreement. We do not sell your data. The processors that handle personal data on our behalf are also listed in our Data Processing Addendum.
Legal bases
We process personal data on these bases under the GDPR: to provide your account, the API, and billing, on the basis of performance of our contract with you; for analytics, on the basis of your consent; to keep the service secure and prevent abuse, on the basis of our legitimate interests; and to retain invoices and accounting records, on the basis of our legal obligations under French law.
International transfers
Your account data and the processing of your files stay in the European Union (Supabase and Railway, EU regions). Some providers are based in the United States (Stripe, Cloudflare, RapidAPI). Where personal data reaches them, the transfer is covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
How long we keep your data
The files you process are not kept at all; they are destroyed as soon as the response is returned. Account data (your email, sign in identity, hashed API keys, and request counts) is kept while your account is active and deleted within 30 days of account closure or a valid erasure request. Invoices and related accounting records are kept for the period required by French tax and commercial law, even after your account is closed. Analytics data is retained only if you consented, for the limited period set by each analytics provider.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw consent at any time. To exercise any of these, email support@filealloy.com and we will respond within one month. Because we do not store the files you process, there are no processed files for us to return or delete; requests apply to your account data.
Deleting your account. If you want your account and data removed, email support@filealloy.com with the subject "Delete my account" and we will erase your account data within 30 days, except records we are legally required to keep, such as invoices.
You also have the right to lodge a complaint with your data protection authority. In France this is the CNIL.
If you process personal data through our API on behalf of others, our Data Processing Addendum sets out how we handle it as your processor.
Contact
Privacy questions: support@filealloy.com.