# Privacy Policy

### Introduction

1. This policy of Mega Privacy (NZ) Limited (Mega) governs our processing of your personal data when you use our file transfer service, transfer.it. You must read and agree to the Privacy Policy below before you use transfer.it.
2. Mega is the data controller of your personal data collected when you use transfer.it. For any question about this Policy, please contact us at privacy@transfer.it.

### Information we collect

1. The personal information we process is the personal information you provide to us (Account Data) and the personal information we collect automatically when you use transfer.it (Usage Data):

##### Account Data

Data
Description
Account information
When you create a file sharing link, if you chose to give those to us, we collect your email address and the email address(es) of the recipient(s). This is so we can send them the link and send you a delivery receipt.
Your Content
We collect your Content when you upload it for sharing.
Communications with you
We collect the information you give us when you contact us with questions or for technical support

##### Usage Data

Data
Description
Access information
We collect certain information about how you access transfer.it, including information about your device and your connection:

- A unique device ID for the device used to log in to our services (this does not include the serial number, brand or model of your device);
- Browser type, device type and/or operating system of the devices from which you have logged in to transfer.it;
- IP address and port information used for: logging in to our services; API usage; file uploads;
- The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database).

Usage information
When you share your Content, we collect certain information about how you use transfer.it, including how often, how much data you use.

### How we use your information (legal bases for processing)

##### Performance of contract with you

1. We process Account Data so that we can provide the services you have contracted to obtain from us, including to enforce our Terms and policies, when necessary.

##### Legitimate interests

1. We collect Usage Data to assist in the operation, maintenance and improvement of our services, which is in our legitimate interest. This includes ensuring the safety, integrity, security, and stability of transfer.it.

##### Other legal bases

1. Complying with legal obligations: we may sometimes process your personal data to ensure we comply with applicable laws (for example in relation to illegal content).

### How we share your information

1. We will not sell your personal data. We will not disclose or otherwise provide your personal data to a third party, or make any other use of any of it for any purpose which is not specifically allowed under this Policy, our Terms or our Takedown Guidance Policy or is not incidental to the normal use of transfer.it, such as providing your Content with the other users you have chose or to law enforcement agencies, intellectual property rights holders or other third parties to comply with applicable laws or protect the rights, property, or safety of Mega, of our other users, of third parties or of the operation of transfer.it.

### Where is your personal data stored

1. We store your Content and other personal data in data centres in the European Union and/or other countries, namely Japan and Canada, that the European Commission has determined have an adequate level of protection under Article 45 of the General Data Protection Regulation. In order to provide our services, personal data may transit or be temporarily stored on servers in other countries, the full details of which can be found on our website.

### Security

1. Unlike Mega, transfers via transfer.it do not use end-to-end encryption (E2EE), meaning the encryption keys are accessible to our systems to enable enhanced functionality and user experience. However, transfer.it is built with strong security principles in mind and is powered by the same trusted cloud infrastructure that has underpinned Mega for over a decade. This proven platform has demonstrated its resilience, reliability and commitment to user privacy, ensuring your data remains highly secure throughout its lifecycle.
2. When you upload content to transfer.it, whether directly from your device or via a linked Mega account, your files remain encrypted at rest. For direct uploads, encryption occurs on the client side before the files leave your device. For uploads from Mega, the associated decryption key is securely transmitted to transfer.it’s custodial infrastructure. In both cases, the key is held only in secure memory during active sessions to enable on-the-fly decryption when accessed via a sharing link, and is never stored on our file servers.

### Data Retention

1. We retain your personal data for as long as we need it to provide our services to you, complying with applicable laws and fulfill our legitimate interests. For example, to resolve disputes or respond to legal requests.

##### Privacy

1. When you upload Content for sharing via transfer.it, it is stored on our servers until the expiry date you set for the link. Free users can retain content for up to 90 days, subject to our Terms of Service (for example, we may remove your Content sooner if you have breached our Terms of Service).
2. MEGA Pro users have the option to create links without an expiry. In such cases, content will be retained for as long as the Pro subscription remains active and for no more than 30 days after the subscription ends, provided the account remains in good standing. Fair use limits apply to Pro users who store excessive amounts of data without expiry (e.g. over 2 TB), as defined in our Terms of Service.
3. 1. Once a link has expired or the retention period has ended, we will permanently delete the Content, and it will no longer be available for download.

##### Email addresses

1. We retain the email addresses of both the sender and recipient(s) of a transfer for as long as the associated link remains active and the Content on our servers.

### Your Rights

1. You have the right to:
   1. access your personal information - you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing.
   2. object to the processing of your personal information, depending on the processing activity - this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data.
   3. rectify - you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed.
   4. erase (also known as the right to be forgotten) - in certain circumstances you can ask for the personal data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law.
   5. request data portability - you can ask to have personal data we hold about you transferred to another organization.
   6. restrict processing your personal information - where certain conditions apply, you have a right to restrict the processing of your personal information.
   7. withdraw your consent at any time - without affecting the lawfulness of processing based on consent before its withdrawal.

### Cookies

We only use session cookies when users who do not have a MEGA account upload Content on transfer.it. Session cookies are small text files that are temporarily stored on your device by your browser when you visit a website. They are automatically deleted when you close your browser. We retain a record of those session cookies for six months so we can link a browser to a specific upload. This ensures we can comply with our legal obligations and helps us provide a safe service for all. Those session cookies are therefore strictly necessary and no consent is required, including for EU users under the ePrivacy Directive. Transfer.it does not use any other cookies or tracking technology for any other reason.

### Changes to this Privacy Policy

1. We may make changes to this Policy in the future. Any changes will be notified to all users.

Last updated and effective 22 April 2025.