Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Smile Mask Technology FZE, a Free Zone Establishment licensed by the Dubai World Trade Centre Authority (licence no. L-3278), with its registered premises at 504-30 TEC, Floor 03, The Offices 3, One Central, Dubai World Trade Centre, Dubai, United Arab Emirates (“we”, “us”, “our”), collects, uses, shares and keeps personal data when you use the Service. Our full company details are on our Legal notice.

“Service” means uploadthefile: the websites at uploadthefile.com, upload.tf, upltf.com and upl.tf, the Published Pages we host, the API (including the MCP and A2A connectors) and the browser extension. A “Published Page” is Your Content made available at an address of the Service, including custom domains and short links; a “Visitor” is anyone who opens a Published Page and is not its owner; “Your Content” is the files, pages and other material you upload or publish. Other capitalised terms, such as Account, Account Holder, Workspace and Paid Plan, have the meaning given in the Terms.

We are the controller of the personal data this policy describes: we decide why and how it is used. We are established in the United Arab Emirates and process it under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”). Where the EU General Data Protection Regulation (“GDPR”) or the UK GDPR also applies to you, this policy says so and adds the GDPR basis and rights.

For personal data inside Your Content, and for personal data of Visitors collected by features an Account Holder switches on (an email gate, a contact form, an email box or a tracked link), we act for the Account Holder, who decides why and how that data is used. The Data Processing Terms govern that processing, and the Account Holder’s own privacy notice applies to it. Section 3.5 explains what this means for Visitors.

This policy is a notice. It is not a term of the agreement between you and us. That agreement is the Terms, which include the Acceptable Use Policy and the Refund Policy.

We have not appointed a data protection officer; contact us at contact@uploadthefile.com.

2. Summary

3. What we collect, why and for how long

3.1 Purposes, legal bases and retention

The PDPL forbids processing personal data without your consent except in the cases listed in its Article 4. The table names the case we rely on for each purpose: Art. 4(9) is processing necessary to perform a contract with you or to take steps you ask for; Art. 4(10) is processing necessary to meet obligations in other UAE laws; Art. 4(3) is processing necessary for legal claims or for judicial or security procedures; Art. 4(6) covers statistical purposes. The PDPL has no “legitimate interests” basis, so we do not use one for people in the UAE. The fourth column applies only where the GDPR or the UK GDPR applies to you, and only there do we rely on legitimate interests (Art. 6(1)(f)).

4. Automated processing and decisions

Some safety checks run automatically when content is uploaded or served. This section says what each one does and what follows from it.

• Known child sexual abuse material (CSAM). Cloudflare’s CSAM Scanning Tool compares images served through Cloudflare’s cache on the domains that serve uploaded content with hashes of known CSAM. When it reports a match, our system blocks the page automatically (HTTP status 451) and places it under legal hold. No person reviews the match before the block. The owner cannot delete a blocked page. A person later reviews the detection and files the reports the law requires. A match on its own does not suspend an Account. For end-users of platform customers, a suspension follows a person’s confirmation of the detection, and a daily job re-applies a suspension that a person has already confirmed. Because the law requires us to preserve and report this material, we may be unable to restore it or to tell you everything about it.
• Adult content. An automated classifier run by OpenAI scores images and frames taken from videos. A high score flags the page for a person to review. The flag does not block or remove the page. A person decides whether to restrict it.
• Unsafe links. We check the page address, and the web links found in the HTML, SVG and ZIP files you upload, against Google Safe Browsing. If Google reports one as unsafe, we refuse the upload and tell you why. No person reviews that refusal first. If the check is unavailable, the upload goes ahead.
• Phishing. We automatically check HTML pages, SVG files and websites uploaded as ZIP archives for signs of phishing, such as a password or payment form that imitates a known brand, or code that sends what a visitor types to a third party. The check only alerts our team for review; it does not block, remove or restrict a page on its own. When a page is flagged as high risk, we keep an evidence record (Section 3.1) so that we can recognise the same phishing kit when it is uploaded again and cooperate with the competent authorities. A person decides what follows.
• Automatic rules. Links expire; pages on a Free account are deleted after the inactivity period and the warning emails described in Section 9; a plan moves to Free when renewal payments fail; we limit request rates and uploads without an Account, and apply bot checks. These apply fixed rules, not a judgement about you.
• PDF chat. If an Account Holder switches on PDF chat for a document, or our support team does so after a request or review, a model running on Cloudflare Workers AI reads the document’s text and answers Visitors’ questions about it. Cloudflare states that it does not keep these inputs and outputs and does not use them to train its models.

These checks do not cover every file, and they can be wrong. We do not serve advertising.

You can ask a person to review any of these decisions where it affects you, and you can object to it (PDPL Article 18; GDPR Article 22(3) where it applies). Reply to our notice about the decision, if we sent you one, or email . A person will review it.

5. Cookies and similar technologies

“Cookies” here means cookies and the similar storage a website can place in your browser (localStorage and sessionStorage). We group them as follows. Strictly necessary items are needed to give you what you ask for (signing in, uploading, opening a protected page) or to keep the Service secure; they are always on and are not behind the cookie banner. Functional items remember a choice you made. Analytics items need your consent.

5.1 Your choice about analytics cookies

The cookie banner offers one choice, Accept or Decline, for Google Analytics, Microsoft Clarity and PostHog’s recordings and events together. We do not offer a separate choice for each tool today. If you decline, or have not chosen, none of the three loads and the Service works in full. If you accept, they load on our own site and app (uploadthefile.com). They never load on Published Pages, and Microsoft Clarity and PostHog never record our administration tools.

To withdraw your consent, use the “Cookie preferences” link in the footer of our website. It resets your choice and shows the banner again, where you can decline. We then delete the cookies and browser storage these tools set. A tool already loaded on the page you have open can keep running until you open another page. Withdrawing is as easy as accepting and does not affect processing carried out before you withdrew. Our feedback questions (Section 6) and Ahrefs (Section 6) are not behind the banner, because they set no cookie and store nothing on your device.

5.2 The cookies and storage we use

6. Analytics and session recordings

This section covers the tools that need your consent (Google Analytics, Microsoft Clarity and PostHog’s recordings and events), the ones that do not (Ahrefs, and PostHog for feedback answers), and what we say to California residents.

6.1 Google Analytics

If you accept, we use Google Analytics 4 to count visits and events on our own site and app. Google acts as our processor. It receives page views, events, the pseudonymous identifier described below and your IP address. Google’s use of this data is described in How Google uses information from sites or apps that use our services. We have set Google Analytics to keep event data for 2 months and user-level data for 14 months.

6.2 Microsoft Clarity

If you accept, Microsoft Clarity also records how you use our public pages (such as the home page, pricing, guides and the sign-in page) and your dashboard: clicks, scrolling, mouse movement and the page as it appeared, so we can see where the Service is hard to use. On public pages, text you type into fields, numbers, email addresses and the upload window are masked before anything leaves your browser. In the dashboard, everything on screen is masked except our own buttons, menus and page headings, so the names of your files, pages and links are not sent; Clarity sees where you click, not what your content is called. It does receive the address of the dashboard page you are on, which can include a search you typed. Clarity never runs in our admin tools, in your account settings, on the screen where you connect an app, on pages reached from an invitation, unsubscribe or report link, or on pages published by our users.

Microsoft processes Clarity data as an independent controller, and Microsoft collects or receives this data to provide and improve its products, including Microsoft Advertising. See the Microsoft Privacy Statement for how Microsoft uses it. Microsoft states that it keeps Clarity recordings for 30 days. Declining or withdrawing consent is how you opt out of this collection.

6.3 PostHog

With the same consent, PostHog also records how you use the Service, on every page except our admin tools and the pages published by our users: clicks, scrolling, mouse movement and the page as it appeared, so we can see where people get stuck. Text you type into fields and the upload window are always masked before anything leaves your browser. In your dashboard, your account settings, the screen where you connect an app, and the pages reached from an invitation, unsubscribe or report link, all text on screen is masked except our own buttons, menus and page headings, pictures are hidden and the names in links and labels are removed, so the names of your files, pages and links are not sent. Page addresses are sent without the part after the question mark, so a search you typed or a code in a link is not sent either. PostHog keeps a first-party cookie and an entry in your browser’s storage (both named followed by our project key) to link the pages of one visit; we delete both if you decline or withdraw consent. Like any server your browser talks to, PostHog receives your IP address. PostHog processes this data for us as our service provider and stores it in its EU region (Frankfurt). So that we do not have to watch every recording ourselves, PostHog’s AI tools (Replay Vision) watch recordings and describe what happened in them, for example whether an upload worked or where a purchase stopped. PostHog runs this on AI models from Google, one of its subprocessors, which may process the recording outside the European Union. We also use PostHog’s AI assistant to analyse this data; it runs on third-party AI models that PostHog engages as subprocessors. PostHog’s terms do not allow its AI providers to train their models on this data, and PostHog checks each description for personal data before it is saved. PostHog keeps recordings for 30 days and events for 12 months.

7. Who receives personal data

We do not sell personal data. We share it only as follows.

7.1 Processors that work for us

These providers process personal data on our instructions. Our Subprocessors page lists them with their legal entities and locations.

• Cloudflare: hosting and delivery of the Service, storage of uploaded files in Cloudflare R2 (four storage buckets that are not pinned to a location), compute, image and video processing for safety checks and thumbnails, Workers AI for PDF chat, the Turnstile bot check, CSAM scanning and DNS.
• Supabase: our database and sign-in (authentication). Files are held in Cloudflare R2, not in Supabase.
• Resend: sending our emails, including notices to Account Holders about messages their Visitors send through a Published Page.
• Google Analytics, PostHog (PostHog Cloud EU) and Ahrefs: analytics, as described in Section 6.

7.2 Independent controllers

These recipients decide for themselves how they use the data they receive.

• Google, GitHub and Microsoft, when you sign in with them. They authenticate you and share your email address and basic profile with us. They are controllers of your account with them, and their privacy policies apply. We do not receive your password from them.
• Microsoft, for Microsoft Clarity (Section 6.2).
• Polar Software, Inc., the Merchant of Record. Polar sells Paid Plans and domains to you as merchant of record and reseller. Your contract for payment is with Polar under its buyer terms. Polar collects your payment details and billing information as seller, and its privacy policy applies. It tells us your subscription status.
• Cloudflare, as registrar, and the domain registries, if you register a domain through us. They keep the registrant data as ICANN and registry rules require and may have to disclose it. WHOIS privacy is on by default.
• Telegram. We send alerts about events in the Service (such as a new abuse report, a safety detection, a failed payment or a completed Account deletion) to our operations team through Telegram. An alert carries the type of event and identifiers such as an Account identifier or a page address, and sometimes a category, a score or a count. We do not put the content of files, file names or text that people type into alerts. Telegram handles these messages as its own controller under its privacy policy.

7.3 Safety services

• Google Safe Browsing (Google LLC) receives web addresses: the address of your page, the web links found in the HTML, SVG and ZIP files you upload, and the destinations of short links.
• urlscan.io (urlscan GmbH, Germany) receives the destination addresses of short links and addresses our administrators choose to check. We submit these scans as “unlisted”. urlscan.io makes unlisted scans visible to vetted security researchers and security companies.

8. International transfers

We are established in the United Arab Emirates, and our providers process personal data in other countries. The PDPL allows a transfer out of the UAE to a country the UAE authority has approved (Article 22). No approved list has been published. We therefore rely on Article 23(1): a contract that binds the recipient to protection equivalent to the PDPL (a); your explicit consent, where you give it (b); legal claims and judicial procedures (c); or a transfer needed for a contract you ask for (d).

The UAE has no adequacy decision from the European Commission or the United Kingdom. The last column shows the transfer tool for personal data covered by the GDPR or the UK GDPR.

9. How long we keep data

9.1 Summary

10. Security

We use technical and organisational measures to protect personal data. They include:

• encryption in transit (HTTPS), with HTTP Strict Transport Security on our hosts, and HttpOnly, Secure session cookies;
• row-level security on every table in our application database, with most tables readable only by our servers;
• administrator tools that only listed administrator Accounts with a verified second factor can use, with each administrator action logged;
• IP addresses stored as keyed hashes (Section 3.4);
• secrets held as Cloudflare Worker secrets and not in our code;
• uploads that land in a quarantine bucket and are validated before they are published;
• separate storage buckets for published pages, quarantine, recovery copies and legal-hold copies;
• media scanning and Office-document conversion in containers without internet access;
• OAuth with PKCE and audience-bound tokens for connected apps, and API keys, tokens and codes stored as hashes;
• masking of typed text, and of customer content in the dashboard, in session recordings (Section 6).

A password you put on a link is stored as a hash and also as an encrypted copy, so that you can see it in your dashboard. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects your rights, we will act without undue delay and notify you and the competent authority where the law requires it.

Who can reach your content. Access to a hosted page is controlled by its link. Links are randomly generated, pages carry instructions asking search engines not to index them where supported, and we do not publish a directory of hosted content. Even so, anyone who has a link can open it, and a custom name you choose yourself is readable by design, so treat it as guessable. You can put a password in front of a link and delete a page at any time. Pages published without an account are removed automatically after 30 days.

We are not a zero-knowledge service. Your Content is not end-to-end encrypted. We hold it in a form we can read, which is what allows us to serve it, to detect and respond to abuse, malware, and illegal material as described in Section 4, and to act on reports and lawful orders as described in our Terms. Our administrators can open any Published Page in full, and see the email addresses captured by an email gate, when needed to handle a report, a legal request, or a security or billing issue. A read-only database role used by our internal tooling can also read upload records, upload failure records, page records, phishing evidence records and the administrator audit log. See our Data Processing Terms. If you need content that we cannot read, encrypt it yourself before uploading.

11. Your rights

11.1 Under the UAE PDPL

Under the PDPL you have the right, free of charge, to: receive the information in Article 13 about what we process, why, who receives it, how long we keep it and how to complain (it is also in this policy); receive the personal data you gave us in a structured, machine-readable form and ask for its transfer to another controller (Article 14); correct inaccurate data and complete incomplete data (Article 15); ask for erasure in the cases the PDPL lists (Article 15); restrict processing (Article 16); object to processing and ask us to stop it in the cases the PDPL lists (Article 17); object to a decision made by automated processing and ask for a person to review it (Article 18); and withdraw your consent at any time (Article 6), which does not affect processing carried out before you withdrew.

These rights have limits in the PDPL itself. For example, we may refuse an erasure request where the request affects investigations or the exercise or defence of legal claims, or where other UAE law requires us to keep the data (Article 15(3)). This is why we cannot delete material held under legal hold (Section 9).

11.2 Under the GDPR and UK GDPR

Where the GDPR or the UK GDPR applies to you, you also have the right to: access your personal data and a copy of it; have it corrected; have it erased; restrict its processing; receive it in a portable form; object to processing based on legitimate interests; not be subject to a decision based on automated processing that has legal or similarly significant effects, or to ask for human intervention in one; and withdraw consent at any time. These rights apply as those laws provide.

11.3 How to use your rights

You can do much of this yourself. From your account settings you can change your email address and display name, download an export of your data (a file in JSON format with your Account, page records, short links, billing summary, usage, API key records, domains, Workspace members and activity, captured visitor emails, uploads, connected apps and agent task summaries, but not the files themselves), and delete your Account with a confirmation code we email to you (it expires after 10 minutes). You can delete any page at any time, switch off optional emails in your notification settings or with the unsubscribe link in each email, and change your cookie choice with “Cookie preferences” in the footer.

For anything else, or if you prefer, email contact@uploadthefile.com. We may ask you to show that you are the person concerned, for example by replying from the email address on your Account. We will answer within 30 days of receiving your request. Where the law allows, we may extend this period, and we will tell you why within the first 30 days. If we refuse a request, we will tell you why. We do not charge for requests. We do not have a self-service way to delete data held by analytics providers; email us and we will ask the provider concerned to delete it.

If you uploaded without an Account. A page published without an Account has no owner login, so there is no self-service way to delete it today. It is removed automatically after 30 days. If you want it removed sooner, or want to use another right, email us the link and tell us how you uploaded it (for example the date, the time and the file name). We may ask for details only the uploader would know, or we may treat your message as a report of the page through our .

12. Children and age

You must be at least 18 to create an Account, upload files or buy a Paid Plan. You do not need an Account to open a Published Page. The Service is not directed to children. If we learn that we hold personal data of a person under 18 from an Account or an upload, we will delete it, unless the law requires us to keep it. If you believe this has happened, email contact@uploadthefile.com.

13. Browser extension

Our Chrome extension, “Upload the File”, sends the file you drop, paste or choose in it to the Service, exactly as the upload box on our website does, and the rest of this policy applies to that file and its link. To show your limits, it asks the Service whether you are signed in, using the sign-in you already have on uploadthefile.com. It keeps a list of your recent links, and whether you ticked the box accepting the Terms and the Acceptable Use Policy, on your device only; removing the extension deletes both. When you upload without an Account, the tick is also sent to the Service, which records your acceptance (Section 3).

The extension does not read the pages you visit, does not collect your browsing history and contains no analytics or advertising. Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

14. Changes to this policy

We may update this policy. Before a material change takes effect, we will tell Account Holders by email and show a notice on our site. We will not use personal data we already hold for a materially different purpose without telling you first and, where the law requires, asking for your consent. The “Last updated” date at the top shows when the current version was published. This policy is effective from the date shown above.

15. Language

We may publish this document in Arabic. If we do, and you are a consumer in the United Arab Emirates, the Arabic version prevails over the English version to the extent of any inconsistency; in every other case the English version prevails.

16. Contact

Smile Mask Technology FZE, 504-30 TEC, Floor 03, The Offices 3, One Central, Dubai World Trade Centre, Dubai, United Arab Emirates, is responsible for your personal data. Questions about your privacy, this policy or your rights: email contact@uploadthefile.com. We have not appointed a data protection officer. To report illegal content or abuse, use our reporting page or email abuse@uploadthefile.com.