Privacy Policy

1. Who we are

Filexco, LLC, a limited liability company formed in Florida, United States ("Filexco", "we", "us"), runs the Filexco cloud storage service at filexco.com and is the controller of the personal data described in this policy. This policy explains what we collect, why, how we protect it and what choices you have.

Contact: [email protected].

This policy covers the website, the web app, the WebDAV service and our API. It does not cover other sites we link to.

Children. The Service is not meant for anyone under 16. If we learn that a child under 16 has given us personal data, we delete the account.

2. What we collect

Information you give us:

  • Account: your email address, your chosen language, and your password in a protected form. Your browser never sends your password as you typed it: it turns it into a verification value, and we store only a hash of that value. When you sign up, we note which website or campaign led you to Filexco, but only if you chose Accept on our cookie bar. Until you sign up, your browser keeps that note in a small first-party cookie for up to 90 days.
  • Encryption keys: your browser creates your encryption keys. We keep them only in wrapped (encrypted) form. We cannot open your vaults with what we hold.
  • Billing: your plan, Add-on and bandwidth credit purchases and payment history. You enter card details on Stripe's pages and Stripe holds them, not us. From Stripe we receive a customer reference, the payment status and amount, the brand and last digits of the card, and a receipt link.
  • Messages: what you write to us through the contact form, in support email and in copyright notices.
  • Your files and settings: the files, folder and bucket names, access keys (we store the key ID and a protected secret; you see the secret once), shares, notes and pages you create. If you use Branded share pages, the logo, headline and message you save are stored with your account and shown to everyone who opens your share links. Names and contents of vault items are encrypted in your browser.
  • Signing records: if you send a document for signature or sign one, the data described under "Signing records" below.

Information we collect when you use the Service:

  • Usage counters: how much storage you use and how much data you transfer each month, per region.
  • Technical logs: IP address, time, the request made, the name of your browser or client, and the result, for security, abuse prevention, rate limiting and fixing faults. Your list of sign-in sessions shows the device type and last use so you can review and end them.
  • Security records: sign-ins, password and key changes, plan changes and administrative actions are written to an append-only audit log.

We do not use the contents of your files for any other purpose, we do not use them for advertising, and we do not train AI models on them.

3. How we use it

We use personal data to:

  • provide, secure and support the Service and manage your account (contract);
  • process payments, prevent fraud, and keep tax and accounting records (contract and legal obligation);
  • protect the Service and its users: detect abuse, attacks and breaches of our Terms, and handle copyright and abuse reports (legitimate interests and legal obligation);
  • send you messages about your account: confirmations, security alerts, plan and payment notices, and warnings before files are removed (contract and legitimate interests). We do not send marketing email unless you ask for it;
  • improve and fix the Service using aggregate counts and logs (legitimate interests);
  • comply with the law and answer lawful requests from authorities (legal obligation).

If we rely on consent for anything, you can withdraw it at any time. We do not sell your personal data, we do not rent it, and we do not use it for advertising.

4. Encrypted vaults

In a vault, files and the names of files and folders are encrypted in your browser before they are uploaded. We store encrypted data and cannot read it, so we cannot hand the contents of a vault to anyone, including authorities, in readable form.

What stays visible to us for a vault: that the vault exists, its size, the number of objects, when objects were created or changed, the shape of the folder tree, who the account holder is, the network address you connect from, and the accounts you share vault objects with. Image and video previews of vault files are encrypted in the same way.

Standard Storage is encrypted at rest with keys managed by Filexco, which our systems use to deliver your files to you. We do not routinely access your files. We limit who inside Filexco can reach them, and only where the Terms and the law allow.

If you lose both your password and your Master Key file, nobody can recover your vault data.

5. Sharing and processors

We do not sell your personal data. We share it only with:

  • Service providers that help us run Filexco (processors), under contracts that require them to protect the data and use it only for us: Stripe (payments), our email delivery provider, and the data centre and network providers that host our servers. The current list is on the Sub-processors page.
  • People you choose: when you share a file or folder, the recipient receives what you shared.
  • Authorities, courts and others when the law requires, to enforce our Terms, or to protect people, our users and the Service. We tell you about a request where we are allowed to. Where all we can produce is encrypted vault data, that is what we produce.
  • A buyer or successor, if Filexco is merged or sold. We will tell you, and this policy will keep applying to your data.

Our website and web app load no third-party scripts, fonts, analytics or advertising: everything is served from filexco.com.

6. International transfers

Filexco is a United States company. Account, billing and security records are stored in the United States. Files are stored in the region you choose for each bucket: the United States or the European Union. If you use the Service from outside the United States, your personal data is transferred to and processed in the United States.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use safeguards the law accepts, such as the European Commission's Standard Contractual Clauses, together with technical measures such as encryption in transit and at rest. You can ask for a copy of the safeguards at [email protected].

7. Signing records

When you send a document for signature with Filexco Sign, or sign one, we keep a signing record. It is the evidence that the people named in it signed that document at that time.

What is kept while the full record exists:

  • the encrypted document and each signer's encrypted signature (we cannot read them);
  • the title of the document, and the names and e-mail addresses of the sender and the signers;
  • the time, IP address and browser of every step: opening the link, confirming the e-mail address, agreeing to sign and signing;
  • the version of the consent text each signer accepted;
  • the seal and the verification code that make the record checkable.

Why: to prove who signed what and when, and to let every signer download their signed copy (contract, legitimate interests and, where they apply, legal obligations).

For how long: the full record is kept while the sender's account has a paid plan and for the grace period of 45 days after the plan ends. It is removed when the sender deletes their account, or when the grace period ends and the account still has no paid plan; we e-mail the sender before then, and the signers can download their copies until then. After that only an anonymous proof is left: the verification code, the fingerprint of the document, the completion time and the seal. It holds no names, e-mail addresses, IP addresses, browsers or titles, so it is not personal data. It is kept for 7 years from completion and then deleted automatically. A signing request that was not finished is deleted 30 days after the sender deletes their account.

If you delete your account, or ask us to delete your data, the full record of every document you sent is removed at once and only the anonymous proof stays. If you signed a document that somebody else sent and ask us to delete your data in it, write to [email protected]: the signing record is also the sender's evidence, so we weigh your request against that interest and the law before we answer.

Who can see it: the sender and the signers of a document see its signing record. Filexco cannot read the document or the signatures; we can see the stored names, e-mail addresses, times, IP addresses and browsers, and use them only to run the service, to answer your requests and as the law requires.

8. Retention

  • Account data is kept while your account is open. When you delete your account we delete your account data and files promptly. Copies in backups are overwritten as the backups expire.
  • Files are kept until you delete them, your plan ends and the grace period passes, or your account is closed. Older versions of files are kept according to your bucket's version setting.
  • Signing records: the full record of a signed document is kept while the sender's account has a paid plan and for 45 days after it ends, and is removed when the account is deleted. An anonymous proof, which is not personal data, is kept for 7 years from completion. See "Signing records".
  • Billing records are kept as long as tax, accounting and payment-card rules require (typically up to seven years).
  • Technical logs are kept only as long as needed for security and to fix faults. The audit log is kept longer because it is an integrity record.
  • Backups of our databases are encrypted, kept for a limited period and then deleted. Data you deleted can remain in a backup until it expires.
  • Copyright notices and counter-notices are kept as long as needed to document the case and to meet the law.
  • Support messages are kept as long as needed to help you and to show how we handled a request.

9. Your rights

Wherever you live, you can ask us to tell you what data we hold about you and give you a copy; to correct data that is wrong; to delete your data (you can also delete your account yourself on the Account page); to limit or stop certain uses; and to give you your data in a portable form (you can download your files at any time, and we can export your account data).

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR or the UK GDPR gives you these rights, and also the right to object to processing based on legitimate interests, to withdraw consent, and to complain to your data protection authority. If you live in California, the CCPA gives you the right to know, delete and correct personal information and not to be treated differently for using your rights; we do not sell or share personal information for advertising.

To use a right, email [email protected] from the address on your account. We may need to check that it is you, and we answer within the time the law requires (normally one month). We cannot give you the contents or names of vault items, because we cannot read them; your own browser can export them.

10. Cookies and local storage

We use only a few small items in your browser. They all come from our own site, and none is shared with other companies:

  • A sign-in session cookie (fx_session) keeps you signed in. It is sent only to our site, scripts cannot read it, and it ends when you sign out or the session expires.
  • Your browser also holds a security token that protects your requests against forgery.
  • Your language and light or dark colour mode are saved in your browser's local storage.
  • Your cookie choice: the first time you visit, a small bar asks whether we may remember where you came from. Your answer, yes or no, is kept in a small cookie called fx_consent, and a copy in your browser's local storage, for up to 180 days, so that we do not ask again. It holds nothing else. It is needed to remember your choice, and we set it only when you choose.
  • Where you came from: only if you choose Accept, the page may keep a small cookie called fx_src, and a copy in your browser's local storage, when you first arrive from another website or from a campaign link. It holds the website or campaign name, the page you landed on, and whether you used a referral link, and no personal data. It is not needed to sign in or to use the Service. It is kept for up to 90 days (some browsers keep it for less), or until you sign up. When you sign up we note it on your account, as described under "What we collect", and remove it from your browser. It is not shared with anyone. If you choose Decline, or have not chosen, we do not keep it.
  • Referral code: if you open a referral link, your browser keeps its code (fx_ref) in local storage for up to 30 days, so that the offer that came with the link reaches your new account when you sign up. It is used only for that, and it is removed when you sign up.
  • While you use vaults, your browser keeps your keys in memory and clears them when you lock the vault or sign out.

We do not use advertising cookies, we do not follow you across other websites, and we do not use third-party analytics. You can change your choice at any time with "Cookie settings" at the bottom of our pages. If you choose Decline, or change your choice to Decline, we remove fx_src and its copy from your browser. You can also block or delete cookies and local storage in your browser settings: if you block the session cookie you cannot sign in, and if you block the other items everything else works as before.

11. Contact

Filexco, LLC
United States
Privacy requests and questions: [email protected]
Security issues: [email protected]

We may update this policy. We will post the new version here and change the date at the top; for a material change we will also tell you by email or in the web app before it takes effect. You can complain to your local data protection authority at any time; we would be glad to help first.