Last updated: June 1, 2026

Privacy Policy

This Privacy Policy describes how FairForge LLC ("stored.ge", "we", "us") collects, uses, and protects your personal data when you use our S3-compatible object storage service.

Contents

• Lawful Basis for Processing
• Data Categories
• Retention Periods
• Data Subject Rights
• Sub-processors
• International Transfers
• Security Measures
• Changes to This Policy
• Contact

Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by the General Data Protection Regulation (GDPR):

• Performance of a contract — processing necessary to provide the storage service you signed up for, including account management, billing, and service delivery.
• Legitimate interest — processing necessary for service security, fraud prevention, abuse detection, and service improvement, where these interests are not overridden by your rights.

Data Categories

We collect and process the following categories of personal data:

• Account data — email address, company name, hashed password, account creation date, email verification status.
• Usage data — storage consumption, bandwidth usage, API request counts, bucket and object metadata (names, sizes, content types, ETags). We never access or process the content of your stored objects.
• Billing data — subscription plan, payment method (processed by Stripe; we do not store card numbers), invoice history, Stripe customer ID.
• Session data — IP address, user agent, session creation and last-active timestamps, used for active session management and security.

Important: We never access, read, analyze, or process the content of objects you store in our service. Object content is encrypted in transit (TLS) and treated as opaque data.

Retention Periods

• Account data — retained for the lifetime of your account plus 30 days after account deletion (grace period for recovery).
• Session and access logs — retained for 90 days, then automatically purged.
• Billing records — retained for 7 years to comply with financial reporting and tax obligations.
• Object metadata — deleted immediately when you delete the corresponding object, or within 30 days of account deletion.

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of all personal data we hold about you.
• Right to data portability — receive your data in a structured, machine-readable format (JSON export).
• Right to erasure — request deletion of your account and all associated personal data, subject to a 30-day grace period.
• Right to rectification — correct inaccurate personal data (e.g., update your email or company name via account settings).
• Right to restrict processing — request that we limit how we use your data while a dispute is resolved.
• Right to object — object to processing based on legitimate interest.

To exercise any of these rights, contact us at privacy@stored.ge. We will respond within 30 days.

Sub-processors

We use the following third-party sub-processors to deliver our service:

• iDrive Inc. — object storage infrastructure (data storage and retrieval).
• Stripe Inc. — payment processing and subscription management.
• Cloudflare Inc. — CDN, DDoS protection, and TLS termination.

Each sub-processor is bound by a Data Processing Agreement that requires GDPR-equivalent protections.

International Transfers

Your data may be transferred to and processed in the United States. We ensure adequate protection for international transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Sub-processor agreements that incorporate GDPR-equivalent data protection terms.

Security Measures

• All data in transit is protected by TLS 1.2 or higher.
• Passwords are hashed using bcrypt with a cost factor of 12.
• Sessions use cryptographically random tokens with HttpOnly, Secure, and SameSite cookies.
• Two-factor authentication (TOTP) is available for all accounts.
• Access to production systems is restricted to authorized personnel with SSH key authentication.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

For privacy-related inquiries, data subject requests, or complaints:

• Email: privacy@stored.ge
• Entity: FairForge LLC
• Jurisdiction: State of Utah, United States