Privacy Policy
Two different people read this page. If you have a FileSathi account, start at section 2. If someone sent you a link and you want to know what was recorded while you read it, go straight to section 3 — that is the part that concerns you.
1. Who controls your data
FileSathi (“we”) is the controller of the personal data described in this policy. For questions about it, or to exercise any right described below, contact contact@filesathi.com.
For documents shared through our service there are two roles, and the distinction decides who you should contact:
- We are the controller of account data — the information you give us to have a FileSathi account.
- Our customer is the controller of the analytics collected when someone opens a document they shared. We process that data on their instructions. If you opened a document and want it erased, the person who sent you the link decides, and we will help them do it.
2. If you have an account
What we collect
- Identity — name, email address, and an optional phone number.
- Credentials — your password is stored only as a bcrypt hash. We cannot read it. If you sign in with Google we receive your name, email and profile picture from Google and never see your Google password.
- Two-factor settings — whether 2FA is on, and the secret needed to verify your codes.
- Content you upload — documents, folders, client records, custom branding.
- Workspace data — teams you belong to, your role, and invitations you send.
- Billing data — plan, subscription status and payment history. Card details are handled by our payment processor and never reach our servers.
- Operational logs — audit entries for security-relevant actions, and error reports when something breaks.
Why
To run your account and provide the service (performance of our contract with you); to secure it and investigate abuse (legitimate interests); to take payment and meet tax and accounting obligations (legal obligation); and to send you service email you can control from Settings.
3. If you opened a document someone shared
You do not need an account to open a FileSathi link, and we do not create one for you. Opening a tracked document does, however, record the following and report it to the person who shared it. This is the whole purpose of the product, and we would rather state it precisely than describe it vaguely.
| What | Detail |
|---|---|
| Open events | The date and time the link was opened. |
| IP address | The address your connection came from. |
| Approximate location | Country and city, derived from that IP address. Never GPS or precise location. An operator can disable this lookup entirely, in which case no location is stored. |
| Device and browser | Your browser's user-agent string. |
| Reading behaviour | Which pages you viewed, how long you spent on each, how far you scrolled, and cursor position within the document. |
| Session replay | A reconstruction of your session in the document viewer, so the sender can replay how you moved through it. It covers the document viewer only — never your other tabs, your screen, your camera or your microphone. |
| Your email address | Only if the sender turned on the email gate and you typed it in to get access. |
| Notes you leave | Any note you deliberately write on the document, with its position and timestamp. |
We do not sell this data, use it for advertising, combine it across different senders to build a profile of you, or use it to train machine-learning models.
To have it deleted or to ask what was collected, contact the person or company that sent you the link — they control it. You can also write to contact@filesathi.com and we will route your request to them and assist. Where the law gives you a right to object to this processing, exercise it with the sender.
4. Cookies and similar technologies
To run the service we use a session token that keeps you signed in, and local storage for preferences such as your workspace selection and light/dark theme. Clearing site data signs you out.
We also use Google Analytics and Google Ads on our marketing site and inside the app, to understand how people find us and which sign-ups came from an advertisement. These set third-party cookies and are used for advertising measurement.
They are never loaded on a shared document. If you are here because somebody sent you a FileSathi link, no Google tag runs on that page. We consider it indefensible to let an advertising network observe you reading a document you were told was confidential, so the viewer and data-room pages carry no third-party tracking of any kind. The sender still sees their own analytics for that document — that is the product they pay for, and it is measured by us directly, not by an advertiser.
5. Who we share data with
We do not sell personal data. We share it only with providers who process it on our behalf, under contract, for the purposes below:
| Provider | Purpose | Data involved |
|---|---|---|
| Payment processor | Subscriptions and payments | Billing identifiers and payment status. Card details go directly to them. |
| Email delivery | Transactional email — verification, password resets, notifications | Email address, message contents |
| Error monitoring | Diagnosing crashes | Technical error reports, which may include your account identifier |
| IP geolocation | Turning an IP address into a country and city | Recipient IP address. Disabled entirely if the operator switches the lookup off. |
| File storage | Storing uploaded documents | Your uploaded files |
| Google (optional) | Sign-in, only if you choose it | Name, email, profile picture |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever sold or merged, data may transfer as part of it — you would be told before that takes effect.
6. International transfers
Our providers may process data outside your country. Where that happens we rely on the transfer safeguards the law requires, such as standard contractual clauses. [Confirm your hosting regions and transfer mechanism before publishing.]
7. How long we keep things
- Account data — while your account is open, and deleted when you close it.
- Documents — until you delete them or close your account.
- Session replay recordings — 30 days on Starter, 90 days on Pro and 365 days on Business, then deleted automatically. The Free plan does not record sessions at all.
- Other analytics — open events and reading data are kept for as long as the sender keeps the document, and are deleted with it.
- Billing records — kept as long as tax and accounting law requires, even after an account closes.
8. Security
Passwords are hashed with bcrypt. Optional two-factor authentication is available on every account. Access to a document is controlled by the sender, who can require an email address or a password, and set links to expire. Traffic is encrypted in transit. Admin actions are written to an audit log. No system is perfectly secure, and we will notify you and the relevant authority of a breach affecting your data as required by law.
9. Your rights
Depending on where you live — including under the GDPR in the EU and UK, and India's Digital Personal Data Protection Act — you may have the right to access your data, correct it, delete it, export it, restrict or object to how it is used, and withdraw consent. You also have the right to complain to your data protection authority.
You can delete your account and its data yourself from Settings. Doing so removes your documents, clients, folders, workspaces and all associated tracking data, including session replays. It requires your password and cannot be undone. If you own a workspace that still has other members, transfer ownership first.
For anything you cannot do in the app, email contact@filesathi.com and we will respond within the period the law allows.
10. Children
FileSathi is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.
11. Changes to this policy
If we make a material change we will update the date at the top and tell account holders by email or in the app before it takes effect. Continuing to use FileSathi after that means you accept the updated policy.
12. Contact
contact@filesathi.com. See also our Terms of Service.