Terms and Conditions
1. Who operates the service
SimpleStorage.cloud (“Service”) is operated by
[FULL LEGAL NAME], registered at
[REGISTERED ADDRESS, COUNTRY], company or registration
number [NUMBER, IF APPLICABLE] (“we”, “us”, “our”).
Contact: [LEGAL EMAIL].
2. Acceptance and eligibility
By uploading or downloading a file, you agree to these Terms and
acknowledge the Privacy Notice. You must be legally able to enter into
this agreement. If you use the Service for an organisation, you confirm
that you are authorised to bind it.
3. Temporary transfer service—no backup
The Service provides temporary file transfer, not permanent storage,
archiving, or backup. Upload and download links are time-limited. Files
are scheduled for automatic deletion approximately 24 hours after upload,
but technical deletion may occur later. Files may also become unavailable
or be deleted earlier because of expiry, maintenance, failures, legal
requirements, abuse prevention, or enforcement of these Terms.
You must keep your own copy. We do not promise that any upload will
complete, remain intact, remain available for the full period, or be
recoverable. Once deleted, a file may not be recoverable.
4. Your files and responsibilities
You retain your rights in files you upload. You grant us only the limited
right needed to host, transmit, secure, scan where legally permitted or
necessary, and delete them to operate and protect the Service.
You confirm that you have the right and lawful basis to upload and share each file. You must not upload:
- illegal, infringing, stolen, fraudulent, or malicious content;
- malware or content intended to disrupt or bypass security;
- content that violates privacy, confidentiality, or intellectual-property rights;
-
special-category, medical, financial, government-ID, child-related, or
other highly sensitive data unless you have independently confirmed
that the Service, safeguards, and required agreements are appropriate.
5. Link security and recipients
Download links function like bearer credentials: anyone who obtains a
link may be able to download the associated file until the link or file
expires. You are responsible for choosing recipients, sending links
securely, and not publishing them unintentionally. Do not use the Service
when stronger recipient authentication is required.
6. Availability, changes, and suspension
We may change, limit, suspend, or discontinue any part of the Service.
We may block requests or remove files reasonably believed to violate
these Terms, threaten the Service or others, or expose us to legal risk.
Where reasonably possible, material changes to these Terms will be
identified by a new effective date.
7. Disclaimer
To the maximum extent permitted by applicable law, the Service is
provided “as is” and “as available.” We disclaim implied warranties of
availability, durability, fitness for a particular purpose,
non-infringement, and error-free or uninterrupted operation. Nothing in
these Terms excludes rights or warranties that cannot lawfully be
excluded.
8. Limitation of liability
To the maximum extent permitted by applicable law, we are not liable for
indirect, incidental, special, consequential, or punitive loss, or for
loss of files, data, profits, business, goodwill, or opportunity arising
from use of or inability to use the Service. Our aggregate liability
relating to the Service will not exceed [CHOOSE A LAWFUL,
REASONABLE CAP]. These limits do not apply where liability
cannot legally be limited, including as applicable for fraud, wilful
misconduct, gross negligence, death, personal injury, or mandatory
consumer and data-protection rights.
9. Indemnity
If you use the Service on behalf of a business, you will indemnify us
against third-party claims arising from your unlawful files, infringement,
or material breach of these Terms, to the extent permitted by law. This
clause does not apply to consumers where prohibited.
10. Governing law and disputes
These Terms are governed by the laws of [JURISDICTION],
and disputes are subject to the courts of [VENUE],
without depriving consumers of mandatory protections or courts available
under applicable law.
Privacy Notice
1. Controller and contact
For personal data processed in operating the Service, the controller is
[FULL LEGAL NAME AND ADDRESS]. Privacy requests:
[PRIVACY EMAIL]. Data Protection
Officer, if appointed: [DPO NAME/CONTACT OR “NOT APPOINTED”].
2. Data we process
-
uploaded file contents, filenames, file sizes, MIME types, generated
object identifiers, and temporary links;
-
source IP address, browser-supplied User-Agent information, approximate
browser, operating-system and device information represented by that
User-Agent, and technical request timestamps;
-
security, diagnostic, and operational records that associate an upload
timestamp, sanitized filename, generated file identifier, source IP
address, User-Agent, account or anonymous owner identifier, owner type,
and verified file size;
- messages and identifiers you provide when contacting us.
We do not currently use advertising or analytics cookies. We use Google
reCAPTCHA on upload and account-registration forms to distinguish normal
use from automated abuse. Google may receive technical information such
as the IP address, browser information, and interaction data under its
applicable terms and privacy documentation. Confirm the appropriate
legal basis and any consent requirements for your users before launch.
3. Purposes and legal bases
-
To provide requested uploads and downloads: performance of the service
contract or steps requested before entering it.
-
To secure, troubleshoot, prevent abuse, and defend legal claims:
our legitimate interests in operating a safe and reliable service,
investigating suspicious uploads, and protecting users and systems.
-
To meet binding legal obligations and respond to lawful requests:
compliance with legal obligations.
Confirm these bases with counsel for your operation and users. We do not
use file contents for advertising or sell personal data.
4. Retention and deletion
Uploaded files are configured to expire after one day. Signed upload
links expire after approximately 15 minutes and signed download links
after approximately 24 hours. Cloud storage lifecycle deletion is
asynchronous, so physical deletion can occur after the stated expiry.
Upload security and operational records, including the IP address,
User-Agent, filename, file and owner identifiers, timestamp, and file
size described above, are retained in AWS CloudWatch Logs for 30 days
and are then automatically deleted. Contact records are retained for
[CONTACT RETENTION PERIOD]. Backups, if introduced, must
be documented here with their deletion schedule.
5. Recipients and international transfers
We use Amazon Web Services (“AWS”), including AWS CloudWatch Logs, for API
processing, private object storage, and security logging in
[AWS REGION AND COUNTRY]. AWS and necessary infrastructure
providers process data on our behalf or as otherwise described in their
terms. Google processes technical information when providing reCAPTCHA
abuse-prevention checks. List any other providers here:
[OTHER RECIPIENTS OR “NONE”].
State whether data leaves the EEA: [TRANSFER DETAILS].
Where required, identify the applicable safeguard, such as an adequacy
decision or Standard Contractual Clauses, and explain how to obtain a
copy. Do not claim that data stays in a region until the full architecture,
support access, and provider terms have been verified.
6. Security
The current architecture uses private S3 storage, encryption at rest,
HTTPS signed URLs, short expiry periods, and automatic lifecycle
deletion. No internet service is completely secure. Recipients do not
authenticate separately; possession of a valid download link can provide
access. Report suspected incidents promptly to
[SECURITY EMAIL].
7. Your GDPR rights
Subject to applicable conditions and exceptions, you may request access,
rectification, erasure, restriction, or portability of your personal data
and object to processing based on legitimate interests. Where processing
relies on consent, you may withdraw it without affecting earlier lawful
processing. You may lodge a complaint with
[NAME AND LINK OF COMPETENT DATA PROTECTION AUTHORITY].
Send requests to [PRIVACY EMAIL].
We may need information to verify your identity. Because this is a
temporary, account-free service, provide the filename, approximate upload
time, link, and other information reasonably needed to locate the data.
8. Files containing other people’s data
If you upload personal data about another person, you are responsible for
having authority and a lawful basis to do so and for providing any
required notice. Business users who need us to act as a processor should
not upload personal data until an appropriate Article 28 data processing
agreement and security assessment are in place.
9. Children
The Service is not directed to children under
[CHOOSE AGE CONSISTENT WITH APPLICABLE LAW]. Do not use
it to collect or share children’s personal data without an appropriate
legal basis and safeguards.
10. Changes
We may update this notice to reflect changes in the Service or law. We
will post the revised version with a new “last updated” date and provide
additional notice where required.