Who is responsible
Maestrow, a company registered in Québec, Canada.
The person in charge of protecting personal information at Maestrow can be reached at mae@maestrow.com.
What we collect
- Account: email, password hashed with Argon2id, language, plan, encrypted two-factor secret, sign-in method (email, Google, Apple).
- Sessions: a hashed session identifier, the date, the browser and the IP address of each sign-in, for your security.
- Transfers: date, number of files, total size, options used and number of recipients. On plans with history (Pro, Max), the name of the first file.
- Payments: handled by Stripe. We only keep your Stripe customer identifier and the status of your subscription, never your card number.
We never receive the content of your files, nor the key hidden in your links.
Why
To provide the service (accounts, transfers, plans), to secure it (rate limiting, fraud prevention), to bill subscriptions and to meet our legal obligations. Legal bases: performance of the contract, legitimate interest (security) and legal obligation (accounting).
Who else sees it
Our host (Maestrow), Stripe (payments), Resend (emails) and, if you use them, Google or Apple (sign-in). They only process data on our instructions. Some of them process it outside Québec, especially in the United States, with protections suited to that transfer.
The STUN servers used to establish the connection see the IP addresses of both browsers, as with any video call.
How long
Account data: as long as your account exists, deleted when you delete it. Transfer log: 12 months. Billing data: 6 years (tax obligations in Canada). Server logs: 30 days.
Cookies
We only use cookies needed for the service: your session, the language and the sign-in steps. No advertising or tracking cookies, no third-party analytics.
Your rights
You can access, correct, export or delete your data, object to its processing or limit it, by writing to mae@maestrow.com. You can delete your account yourself in Settings. You can also lodge a complaint with the Commission d'accès à l'information du Québec, or with the data protection authority of your country (for example the CNIL in France).