Legal
Privacy Policy.
What personal information FileFresh collects, why, who sees it, how long we keep it, and your rights under South Africa's Protection of Personal Information Act (POPIA).
Draft for review. This policy is written for how FileFresh works today. Have it checked by a South African attorney, register your Information Officer with the Information Regulator, and fill in the highlighted details before publishing.
The short version
- The free scan runs in your own account. If you let it, it sends us totals only, never file names or contents.
- When we work in your storage, you stay in control: we work under a signed operator agreement, inside your account, and we delete any notes or copies when we're done.
- We use your contact details to reply to you and to run your service. We don't sell them, and we don't send marketing without your consent.
1. Who we are
FileFresh is a trading name of [registered business name] (registration number [number]), [address].
Our Information Officer is [name], reachable at hello@filefresh.co.za. You can contact them about anything in this policy.
2. Our two roles under POPIA
| When | Our role | What it means |
|---|---|---|
| You contact us, run the free scan, ask for a quote, or become a client | Responsible party | We decide how your contact and account details are used, as this policy explains. |
| We work in your cloud storage on a clean-up or monthly plan | Operator | You (or your organisation) are the responsible party for the files. We act only on your instructions, under a signed operator agreement (POPIA sections 20 and 21). |
3. What we collect
When you run the free scan
- If "Share my scan totals" is ticked: the numbers of files and folders, storage size, counts of each issue found (such as duplicates, old files and public links), whether the storage is personal or an organisation's, and the price estimates. You can untick this.
- If you tick "Email me a quote": your name and email address.
- If you choose "Share with FileFresh": we get access to that one review sheet (not your storage), so we can prepare a plan.
When you contact us
Your name, contact details, organisation and whatever you choose to tell us in your message, email or WhatsApp.
When you become a client
Billing details, the people we deal with at your organisation, the signed agreements, and records of the work we did (such as the change log).
When we work in your storage
We can see the files we're asked to organise, which may include personal information about other people (for example, members or staff). We handle it only as your operator, as described in section 2 and in the operator agreement.
4. What we don't collect
- Your passwords. We never ask for them.
- File names, folder names or file contents from the free scan.
- Copies of your files. We work inside your account and don't download them to our devices.
5. Why we use it
| Purpose | Lawful basis under POPIA |
|---|---|
| Replying to you and preparing quotes | Your consent, and steps you asked for before a contract |
| Delivering the service you bought, and invoicing | Carrying out our contract with you |
| Combining scan totals into anonymous averages (for example, "the average Drive we scan has 9% duplicates") | Our legitimate interest in improving and explaining the service. Only totals, only averages, never about one person or organisation |
| Keeping financial records | Legal obligations, including tax law |
| Occasional updates and offers | Your consent, or as an existing customer, with an easy opt-out (see section 11) |
6. Who we share it with
We don't sell or rent personal information. We only share it with service providers who help us run FileFresh, under their own data protection terms:
- Google (Google Workspace: email, documents, and the sheet that receives scan totals)
- Meta (WhatsApp, if you message us there)
- [Accounting or invoicing software]
- An AI provider, only for client work, only if the client agrees in the operator agreement, and only the information needed
We may also share information if the law requires it.
7. Information stored outside South Africa
Some of our service providers, including Google and Meta, store information on servers outside South Africa. POPIA (section 72) allows this when the recipient is bound by laws, rules or agreements that give an adequate level of protection. We only use providers that do.
8. How long we keep it
| Information | How long |
|---|---|
| Scan totals (no names attached) | As long as they're useful for averages |
| Quote requests and messages, if you don't become a client | 12 months, then deleted |
| Client contact, agreement and invoice records | 5 years after the work ends, for tax and legal records |
| Anything we saw in your storage during a job | Not kept: notes and copies are deleted when the job ends, and we confirm it in writing |
9. How we protect it
- Business accounts protected by strong passwords and two-step verification
- Access to client storage through temporary accounts, for the agreed dates only
- No client files on our own devices
- An offboarding checklist at the end of every job: access removed, notes deleted, confirmation sent
If we ever suspect that personal information has been accessed without authority, we'll tell you and the Information Regulator as POPIA requires (section 22).
10. Your rights
Under POPIA, you may:
- ask what personal information we hold about you, and for a copy
- ask us to correct it, or to delete it where we no longer need it
- object to us using it, including for marketing
- withdraw consent you gave us, at any time
- complain to the Information Regulator at inforegulator.org.za
To use any of these rights, contact our Information Officer. We'll respond within 30 days. If you're asking about files in a client's storage, we'll pass your request to that client, who is the responsible party.
11. Marketing messages
We'll only send you marketing by email, SMS or WhatsApp if you've agreed to it, or if you're an existing customer and it's about similar services (POPIA section 69). Every message includes an easy way to opt out. We don't buy contact lists.
12. Children
Our website and services are for adults and organisations. Client storage may hold information about children (for example, a school's or club's member lists). We treat it with extra care, only as the client's operator, and as POPIA's rules for children's information require.
13. This website
- This website doesn't use tracking cookies or analytics. [If you add analytics, update this section.]
- Its fonts load from Google Fonts, so Google receives your device's IP address when the page loads.
- The contact form prepares a message on your own device; nothing is sent until you choose to send it by email or WhatsApp.
14. PAIA manual
Our manual under the Promotion of Access to Information Act 2 of 2000 (PAIA) explains how to request records we hold. It's available on request from our Information Officer. [Prepare the PAIA manual.]
15. Changes and contact
We'll update this policy if the way we handle information changes, and show the new effective date at the top. For significant changes, we'll tell clients directly.
Information Officer: [name] · hello@filefresh.co.za · [address] · Contact page