Privacy Policy

Last updated: 3 November 2026

This policy explains what personal data Phoenix Box ("we") processes when you use phoenix-box.cloud and our apps, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Data we collect

Account data: email address and a salted hash of your password.
Transfer metadata: file names, sizes, upload time, expiry date, download count. We do not inspect file contents.
Billing data (paid plans only): handled by our payment provider; we store the invoice record and the last four digits of the card.
Technical logs: IP address, user agent and request time, kept for up to 7 days for security and abuse prevention.

2. Why we process it

To provide the service (Art. 6(1)(b) GDPR), to keep it secure and prevent abuse (Art. 6(1)(f)), and to meet legal obligations such as tax records (Art. 6(1)(c)).

3. Where data is stored

All files and account data are stored in data centres in Germany and France. We do not transfer personal data outside the European Economic Area.

4. Retention

Files are deleted when the link expires or the download limit is reached. Account data is deleted 30 days after you close your account. Invoices are kept for the period required by law.

5. Sharing

We do not sell personal data and do not use advertising or analytics trackers. We share data only with processors that help us run the service (hosting, payments, email delivery) under data processing agreements, or when required by a valid legal order.

6. Your rights

You can request access, correction, deletion, restriction or a portable copy of your data, and object to processing. You also have the right to lodge a complaint with your local data protection authority.

7. Contact

For privacy questions write to privacy@phoenix-box.cloud.