Privacy Policy

Privacy Policy

Effective from 21 October 2026. Bản tiếng Việt. If the English and Vietnamese versions differ, the Vietnamese version prevails.

This policy explains how Transfer file and QR Download (https://qrcodes.download) collects, uses, stores and protects your personal data, and what rights you have. It is based on Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations.

1. Data controller

  • Operator: ...
  • Address: ...
  • Tax code / business registration number: ...
  • Contact email for personal data matters: [email protected]

2. Data we collect

2.1. When you send files (including without signing in)

  • Files, file names and sizes; title and message (if you enter them).
  • Sender email, sender name and recipient emails (when you choose to send by email or turn on notifications).
  • Link password (if set), stored as a one-way hash that we cannot read.
  • Your IP address and a random identifier stored in the guest_uid cookie so you can see and manage your transfers without signing in.

2.2. When you have an account

  • Name, username, email, phone number (if entered), profile picture, password (stored as a one-way hash).
  • Billing address when you buy a paid plan.
  • When you sign in with Google: your Google account ID, name, email and profile picture. When you sign in with Zalo: your Zalo account ID, display name and profile picture. We never receive your Google or Zalo password.
  • Sign-in log: IP address, browser, operating system, country and approximate location based on IP.

2.3. When you pay

  • Plan purchased, amount, billing period, transaction ID, payer email returned by PayPal, bank transfer description.
  • We do not store your card number, card security code or bank login details.

2.4. When you contact us or report abuse

  • Name, email and the content you send; the reason and description in an abuse report, and the reporter's IP address.

2.5. When recipients download files

  • Download time and number of downloads per file (so senders who turn on notifications can be told).

3. How we use data

  • To provide the Service: receive, temporarily store and deliver files; create links and QR codes; email recipients; notify you when files are downloaded or about to expire.
  • To manage accounts, plans, payments and customer support.
  • To keep the Service safe: automatic virus scanning, abuse detection, handling abuse reports, preventing spam and attacks.
  • To comply with legal obligations, including cooperating with competent authorities.

We do not sell personal data and do not use the content of your files for advertising or to train artificial intelligence.

4. Legal basis

  • Your consent when you use the Service, register an account or submit a form. You can withdraw consent at any time (see section 9); withdrawal does not affect processing already carried out.
  • Performance of the service contract between you and us (providing plans, processing payments).
  • Compliance with legal obligations (accounting, tax, requests from competent authorities).

5. About file content

  • Files are scanned automatically by anti-virus software. No person views file content during this process.
  • We only look at content when verifying an abuse report, when the software detects malware, or when lawfully required by a competent authority.
  • Anyone with the link (and the password, if set) can download the files. Set a password for sensitive files and only share the link with intended recipients.

6. Sharing with third parties

We only share data as needed with parties that help run the Service:

  • Server hosting provider running the website (located in Germany).
  • Cloudflare: content delivery and protection for the website (sees IP addresses and traffic passing through).
  • Google: Google Drive (backup file storage), email delivery, Sign in with Google.
  • Zalo (VNG): Sign in with Zalo.
  • PayPal and banks / SePay: processing and confirming payments.
  • Competent authorities: when required by law.

Recipients only see what the sender chooses to share: the files, title, message, and the sender's name or email (if entered).

7. Storage location and transfers outside Vietnam

  • Files are mainly stored on a server located in Vietnam. If that server is unavailable, files may be stored temporarily on the website server or on Google Drive.
  • The website server (including the account database) is located in Germany; Google, Cloudflare and PayPal process data in several countries. Your data may therefore be transferred outside Vietnam. We do so in accordance with the rules on cross-border transfer of personal data.

8. Retention

  • Files: until the link expires or you delete the transfer; the files are then permanently deleted (usually within 10 minutes). Files uploaded without creating a link are deleted after about 24 hours.
  • Transfer information (file names, times, sender/recipient emails, IP): kept as history in your account and for handling abuse, until you ask us to delete it or your account is deleted.
  • Account and sign-in log: while your account is active.
  • Payment transactions: for the period required by accounting and tax law.
  • Abuse reports and virus scan results: as long as needed to handle violations and respond to competent authorities.

9. Your rights

Under personal data protection law, you have the right to:

  • Be informed about the processing of your data;
  • Consent, refuse or withdraw consent;
  • View, edit or request correction of your data;
  • Request a copy of your data, its deletion or restriction of processing; object to processing;
  • Complain, denounce, sue and claim compensation as provided by law.

How to exercise your rights: you can view and edit most information in Account settings and delete transfers from your transfer list. For other requests (a copy of your data, account deletion, withdrawing consent, etc.), contact us via the Contact page or at [email protected]. We respond within 2 working days and act within the time limits set by law. We may need to verify that you are the data subject first.

Some data may have to be kept even if you request deletion, where the law requires it (e.g. payment records) or where there is a pending abuse report or authority request concerning that data.

10. Cookies

The website only uses cookies needed for it to work:

  • Session and form-protection (anti-forgery) cookies;
  • "Remember me" cookie (when you choose it, or when signing in with Google or Zalo);
  • guest_uid: identifies the browser of visitors who are not signed in so they can manage their transfers (1 year);
  • Cookies remembering your language and notices you have closed.

We do not use advertising cookies. If we start using analytics or advertising cookies, we will update this policy and ask for your consent first.

11. Security

  • Connections are encrypted (HTTPS); account and link passwords are stored as one-way hashes.
  • Administrator accounts are protected by two-factor authentication; access to data is limited to people who need it.
  • The file storage server sits in a separate network zone with only the necessary ports open.
  • If a personal data breach occurs, we notify the competent authority and affected users within the time required by law.

12. Children

The Service is not aimed at children. People under 16 may only use it with the consent of a parent or guardian. If you know a child has given us data without such consent, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The new version is posted on this page with its effective date; for significant changes we will notify you on the website or by email.

14. Contact

For any questions about personal data, email [email protected] or use the Contact page. See also our Terms of Use.