Privacy Policy

Last updated: 6 November 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Fairsend GmbH, Beim Braunstall 7, 97980 Bad Mergentheim, Germany
Phone: +49 7931 9680271, Email: info@fairsend.de
Managing Director: Josef Weinmann

We have not appointed a data protection officer, as the statutory requirements for doing so are not met. For all data protection matters, you can reach us at info@fairsend.de.

2. Legal bases for processing

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR (consent)
  • Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures)
  • Art. 6(1)(c) GDPR (compliance with a legal obligation)
  • Art. 6(1)(f) GDPR (legitimate interests, unless overridden by the interests or fundamental rights of the data subject)

3. Encryption (key information)

Fairsend is designed for confidentiality, but implements it differently depending on the function. This is essential for understanding how data is processed:

  • File transfers are encrypted in the sender’s browser with AES-256-GCM before they reach our servers. The key is contained in the fragment (#) of the link. So that you can copy links again later, we additionally store it in encrypted form on our servers; as a result, the operator is technically able to access this content. For transfers with password protection, we do not store a key and cannot decrypt the content without the password. Via the API or the Outlook add-in, the password is sent once in encrypted form to our server, which calculates the protection data from it and stores neither the password nor the key. For transfers via the API without your own key, our server encrypts the data on receipt.
  • Messages and files in file storage are stored in encrypted form on our servers. The key required for decryption is itself stored encrypted with a protected master key known only to us. As a result, this content cannot be read with mere database access (for example, in a backup copy). This is server-side encryption; the operator is technically able to access this content.

4. Deletion and storage period

Personal data is deleted or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations prevent this. The following periods are enforced automatically:

  • Transferred files: set by the sender (24 hours to 1 year), then irreversible deletion
  • Files in file storage: after the selected retention period, automatic deletion
  • Messages: upon expiry or after being read, irreversible destruction
  • Access and server logs: 7 days, then deletion
  • Login attempts: 24 hours
  • Email confirmations and password resets: 7 days
  • Error logs: 30 days
  • Data for abuse and bot detection (see section 11): 30 days
  • Page views (audience measurement): 90 days
  • Email sending log: 90 days
  • Security log (audit log): the IP address is removed after 90 days; the entry itself is retained for security and evidentiary purposes
  • Unconfirmed accounts: accounts whose email address is not confirmed within 30 days are deleted automatically
  • Campaign identifier for an order: together with the order data (see section 14)
  • Google click ID (gclid) with consent: immediately after withdrawal, otherwise no later than 60 days after consent; without consent it is not stored (see section 14)
  • Invoices and payment records: 8 years (statutory obligation, see section 4.2)

4.1 Deletion of your account (Art. 17 GDPR)

When you delete your account, we remove or anonymise your personal data from all areas of the platform. This includes in particular: user profile (name, email address, phone number, billing address, most recently used IP address), address book and contacts, file storage including all folders and files, sent messages and their attachments (received messages are anonymised), transfers including recipient addresses, encryption keys and access IP addresses, the stored file names, two-factor authentication, pending email confirmations and password resets, login attempts and notification settings, team memberships, team contacts and team invitations, API access keys (these are revoked), page views and email sending log. When an account is deleted, any direct debit mandates granted are also revoked with the payment service provider.

In logs that must be retained for security reasons (audit log, error log), the personal reference is removed: IP addresses are set to 0.0.0.0 and the link to your account is removed.

4.2 Exception: statutory retention obligation

We are required to retain invoices, payment records and the associated master data for eight years pursuant to § 147 Abs. 3 AO and § 14b UStG. We cannot remove this data early, even upon your request for deletion. The legal basis is Art. 17(3)(b) GDPR. This concerns: invoice number, billing address, company name, VAT identification number, invoice amounts and payment data. For the same reason, your user account remains as an anonymised record and no longer contains any personal reference after deletion. Once the period has expired, this data is also deleted. The period begins at the end of the calendar year in which the record was created.

5. Server log files

When you access our pages, we automatically collect and store information that your browser transmits: IP address, date and time of the request, page or file name accessed, referrer URL, browser and operating system used, amount of data transferred. This data is deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and stability of the system). The Google click ID (gclid) is made unrecognisable in these logs.

6. User account and registration

When you register, we collect your first and last name, email address and password (stored as a bcrypt hash), and optionally a profile picture and company. The legal basis is Art. 6(1)(b) GDPR. If you do not confirm your email address within 30 days, the account is deleted automatically.

6.1 Sign-in with a company account (Microsoft Entra ID)

If you sign in with your company account at Microsoft, Microsoft transmits your account ID, your name and your email address to us. We use this information only for signing you in and for assigning you to your team. The sign-in itself takes place at Microsoft, where Microsoft's privacy statement applies. The legal basis is Art. 6(1)(b) GDPR.

7. File transfer (core function)

In the course of a transfer, we process: sender email, recipient email(s), a tracking ID, timestamps, encrypted file size, expiry date and the IP address (for abuse detection). We store the file contents only in encrypted form (see section 3). After the retention period has expired, the encrypted files are deleted automatically and irretrievably.

7.1 Webhooks

If you set up webhooks in your account, Fairsend sends status notifications about your transfers to the server address you have specified. The following are transmitted: the transfer number, the type and status of the transfer, the number and total size of the files, the download counter, the creation and expiry time and, in the case of a download, the email address of the recipient who downloaded the files. File names and file contents are not transmitted. Each notification is logged in your account for 30 days for troubleshooting and deleted afterwards. The legal basis is Art. 6(1)(b) GDPR.

7.2 Add-in “Fairsend for Outlook”

With the add-in, you upload files and email attachments directly from Outlook to Fairsend and insert the link to the transfer into your message. In doing so, we process the files and attachments you select, including their size and file type, as well as the settings of the transfer (expiry time, optional password). The add-in does not read the subject, text or recipients of your emails.

To sign you in, the add-in stores a sign-in token in the add-in's storage on your device. You can disconnect at any time via “Sign out” in the add-in or under “Connected apps” in your account. Changing your password also disconnects it.

The add-in runs in Outlook and uses the Office.js program library, which is loaded from servers of Microsoft Corporation. In the process, Microsoft receives technical connection data such as your IP address. Microsoft is certified under the EU-U.S. Data Privacy Framework. Microsoft's privacy statement applies. The legal basis is Art. 6(1)(b) GDPR.

8. Cancellation and withdrawal via form

If you end a subscription via our cancellation form or withdraw from a contract via our electronic withdrawal function, we process the data provided there (name, account email address, confirmation address, details of the contract concerned such as customer number, order or invoice number and order date, type and time of the notice, an optional comment and the IP address) to process the notice and as proof of it. The legal bases are Art. 6(1)(b) and (c) GDPR.

9. Sending emails

We send transactional emails (confirmation codes, delivery notifications, proofs of delivery, account notifications). For the technical sending, we use the mail server of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, with which we have concluded a data processing agreement. No newsletters are sent without express consent. The legal basis is Art. 6(1)(b) or (f) GDPR.

10. Payment processing

Payments are processed via Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands), a PCI-DSS certified payment service provider. Credit card and bank data is processed exclusively by Mollie and never reaches our servers. The legal basis is Art. 6(1)(b) GDPR. Mollie’s privacy policy: https://www.mollie.com/privacy

To check whether a promotion has already been used, we generate a non-reversible check value (HMAC) from your payment method and your customer ID at our payment service provider Mollie and store only this check value in our own database. We do not store the card number or IBAN. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). We delete the check values no later than 30 June 2027, even if your account was deleted before then.

11. Security, abuse and access protection

To protect the platform against attacks and abuse, we use technical protection mechanisms that process personal data:

  • A firewall evaluates the IP address and characteristics of the request and can temporarily block conspicuous or attacking IP addresses.
  • To secure individual content, access may be restricted to certain countries (geo-blocking). For this purpose, the IP address is assigned to a country using a local database. For statistical purposes, we keep access statistics broken down by country.
  • To distinguish search engines from harmful automated access, in individual cases we check by means of a DNS query whether an IP address belongs to a stated search engine operator.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security and trouble-free operation of the service). The data arising in this context is deleted in accordance with the periods stated in section 4.

12. Hosting and server location

Our servers and storage are operated exclusively in Germany. Personal data only reaches a third country if you have consented to the report to Google when placing an order (section 14). We do not use any external CDNs or cloud services; all resources (JavaScript, CSS, fonts) are delivered from our own servers.

13. Cookies and audience measurement

13.1 Cookies. We use only technically necessary cookies: a session cookie (login), a cookie for the preferred display mode (light/dark), a language cookie and cookies for accessibility settings. We do not use any tracking, advertising or marketing cookies and do not embed any analytics or advertising scripts. We only transmit data to Google if you consent during checkout (section 14).

13.2 Own audience measurement (without cookies). To improve our service, we record technical data with each page view, without cookies and without recognising individual persons: page accessed and time, referring website (domain only), browser type and device category, and an anonymised hash value instead of your IP address. For anonymisation, your IP address is first truncated (for IPv4, the last block of digits is set to 0) and only then combined with a random value that changes daily to calculate a hash value. Your full IP address is not stored. As a result, no personal reference can be established, and recognition across days is not possible. Storage period: 90 days. The legal basis is Art. 6(1)(f) GDPR.

14. Performance measurement of Google ads

We advertise Fairsend with ads in Google Search. For this purpose we do not set any cookies on our website and do not embed any scripts from Google.

a) Campaign statistics: Our ad links contain a campaign identifier. If an order comes about through an ad, we store with the order which campaign it came from. We use this information only for our own aggregated evaluations (number of orders and revenue per campaign) and do not pass it on. The legal basis is our legitimate interest in managing our advertising economically (Art. 6(1)(f) GDPR). The information is stored with the order data and deleted together with it.

b) Report to Google with your consent: If you come to us via a Google ad, Google adds a click ID (gclid) to the address. We do not store this ID on your device or in logs. Only if you expressly consent during checkout do we store it with your order and, after successful payment, report to Google the click ID, order number, order value, currency and time. If the order is refunded, we report the retraction. Google matches the report to the ad click; we only receive aggregated figures from Google. Without consent we discard the click ID. Your order does not depend on it.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes this data as an independent controller under the Google Ads Controller-Controller Data Protection Terms and may transfer it to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Information on processing by Google: https://policies.google.com/privacy

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, via the link in your order confirmation or by email to info@fairsend.de. After withdrawal we report nothing further and delete the click ID. Otherwise we delete it no later than 60 days after your consent; we keep the record of your consent for evidentiary purposes.

15. Disclosure to third parties

Personal data is transmitted to third parties only for payment processing (Mollie, section 10), for the technical sending of emails (IONOS, section 9), with your consent for the performance measurement of Google ads (Google, section 14), where there is a legal obligation, or to safeguard legitimate interests in the event of suspected abuse. Data is not sold. Disclosure for advertising purposes takes place only with your consent (see section “Performance measurement of Google ads”).

16. Your rights as a data subject

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17, unless a retention obligation prevents this), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent given at any time with effect for the future (Art. 7(3)). To exercise these rights, please contact info@fairsend.de. In addition, you can export your data or delete your account yourself at any time via the account settings.

17. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de

18. Changes to this privacy policy

We adapt this privacy policy when changes to our services or to the legal situation require it. The current version applies to your next visit.