Privacy Policy
Last updated: 17 August 2026
ShiftMyFile.com ("we", "us", "our") operates ShiftMyFile.com, an online file conversion service. This policy explains what data we collect, why, how long we keep it, and what rights you have.
We are not a law firm and this document should be reviewed by a qualified lawyer before publication — this draft reflects our actual technical practice as accurately as we can describe it, but it is not a substitute for legal review.
1. Who we are
Data controller: ShiftMyFile.com
Registered address: Belgium
Contact: privacy@shiftmyfile.com
If you have questions about this policy or want to exercise any of the rights below, contact us at the address above.
2. Our approach, in short
Before the details: our conversion tools are built so that your uploaded file is deleted immediately after conversion completes. The converted result is kept only briefly (about one hour) so you can download it, then it is automatically removed. We do not read, scan, or analyze the content of your files beyond what is technically required to perform the conversion you requested.
We also apply specific technical safeguards depending on the tool — for example, SVG files are sanitized and rendered in an isolated, network-disabled process before conversion, and passwords entered for Protect/Unlock PDF tools are never logged or stored, only used once to perform the requested action.
The rest of this policy covers what we do collect (account data, payment data, usage statistics) and why.
3. What we collect
3.1 Files you upload
- Deleted immediately after your conversion completes.
- The converted output is retained temporarily (approximately one hour) to allow you to download it, then automatically deleted.
- We do not keep backups or copies of your files beyond this window.
3.2 File names
- We store the name of the file you uploaded (not its content) in our internal usage records, for troubleshooting and understanding how the service is used.
- If your file name itself contains personal information (for example, a name in the file name), that name is retained as part of this usage record. We do not currently apply an automatic deletion schedule to this data — see Section 5 for what we're evaluating here.
3.3 Account information
If you register an account: your email address, a securely hashed password (we never store your password in plain text), and any name you provide. If you sign in with Google, we receive your email and name from Google and mark your account as verified automatically.
3.4 Anonymous usage (no account)
You can try a few conversions without an account (3 free credits, charged the same as registered users). To prevent abuse of this free trial, we set an httpOnly cookie and also compute a salted, one-way hash of your IP address (we do not store your raw IP address for this purpose) to detect repeated trial attempts from the same origin.
3.5 Payment information
Payments are processed entirely by Stripe. We use Stripe's hosted Checkout page — your card details are entered directly on Stripe's own page and never pass through our servers. We store your Stripe customer ID and subscription status so we know which plan you're on, but never your card number or other payment card data.
3.6 Usage and diagnostic data
For each conversion, we log: which tool was used, the file size, how long the conversion took, whether it succeeded or failed (and an error code if it failed), how many credits it cost, and your plan at the time. This is tied to your account (if logged in) or an anonymous identifier (if not), and is used to operate, price, and improve the service — for example, to understand which tools need performance improvements.
3.7 Cookies
We use:
- An authentication/session cookie (if you're logged in).
- The anonymous trial cookie described in 3.4.
Both are strictly necessary for the service to function and are not used for advertising or cross-site tracking. We do not currently use analytics or advertising cookies that would require a cookie-consent banner under applicable law — if that changes, we will update this policy and add appropriate consent controls.
4. Why we process this data (legal basis)
- Performing our contract with you — processing your file to deliver the conversion you requested; managing your account and subscription.
- Legitimate interest — fraud/abuse prevention (the IP-hash trial check), maintaining service security and reliability, and improving the product based on usage patterns.
- Legal obligation — retaining payment records as required for tax and accounting purposes.
5. How long we keep data
| Data | Retention |
|---|---|
| Uploaded source file | Deleted immediately after conversion |
| Converted output file | ~1 hour, then automatically deleted |
| File name (usage record) | Currently indefinite — under review, see note below |
| Account data | Until you delete your account |
| Payment/subscription records | As required by applicable tax and accounting law |
| Usage/diagnostic logs (excluding file name) | [DEFINE RETENTION PERIOD, e.g. 12-24 months] |
Note on file names: we are aware that indefinite retention of file names is broader than necessary for most of the purposes we use this data for, and we are evaluating a fixed retention/anonymization schedule for this specific field. This policy will be updated once that is implemented.
6. Who we share data with
We share data with the following processors, each solely to the extent needed to provide the service:
- Stripe (payments) — processes your payment; see Stripe's privacy policy.
- Resend (transactional email) — sends account verification and related emails; see Resend's privacy policy.
- Hostinger — hosts our servers and database.
Some of these providers are based outside the European Economic Area (EEA). Where that is the case, we rely on their standard contractual clauses or equivalent safeguards for the transfer.
We do not sell your data, and we do not share it with advertisers.
7. Your rights
If you are in the EEA/UK (or a jurisdiction with similar protections), you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data ("right to be forgotten"), subject to our legal retention obligations (e.g. payment records).
- Restrict or object to certain processing.
- Port your data to another service in a structured format.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, contact us at privacy@shiftmyfile.com.
8. Children's privacy
ShiftMyFile.com is not directed at children under 16, and we do not knowingly collect personal data from children under that age.
9. Changes to this policy
We may update this policy as the service changes. We'll update the "Last updated" date above, and for material changes, we'll make this reasonably prominent on the site.
10. Contact
Questions about this policy or your data: privacy@shiftmyfile.com