LetMeDrop — Privacy Policy

Version 1.0 — Effective date: 2026-11-08

This policy applies to everyone who uses the service, including visitors, senders, recipients and account holders, and is available at all times on our website. It explains how we handle your personal data and our use of cookies (Section 12). It applies on its own, independently of our Terms of Service, and is not a contract you are asked to accept.

This policy is available in Portuguese and in the other languages of the service; for Consumers habitually resident in Portugal, the Portuguese version prevails.

1. Who we are

LetMeDrop, the file-transfer service available at letmedrop.com and its country-specific domains, is operated by Pedro Queiroga, sole trader trading as LetMeDrop, NIF PT222690631, Avenida Infante Dom Henrique, n.º 16, 3.º G, 8900-413 Monte Gordo, Portugal (“we”, “us”).

We are the controller of your personal data in connection with the service, within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Law No. 58/2019 of 8 August. We have not appointed a data protection officer, as we are not required to do so. For any privacy question, write to info@letmedrop.com.

2. What LetMeDrop does

LetMeDrop lets you share files through a temporary download link, with or without an account. The features and plans available are described in our Terms of Service.

3. What data we collect

We collect only what we need to run the service:

Connection data: IP address, browser type, time of access and pages visited, and, when you sign in, create an account, submit a report or exercise your right of withdrawal through our forms, the technical signals processed by our anti-bot check (Cloudflare Turnstile).

Transfer data: file names, sizes and types, the duration you choose, creation and expiry dates, the price paid and, for a paid transfer, the e-mail address you give us, which we use to send you the contract confirmation and messages about that transfer; for paid transfers and subscriptions, the country of your connection, used for VAT purposes.

Invoicing data: the name and tax number you choose to put on the invoice and your e-mail address, to which we send the invoice.

Payment data: transaction references returned by the payment provider. We never receive your card or payment account details.

Contract records: the contract confirmation we send you and a record of its sending; for paid transfers, subscriptions and plan changes, your request that the service start immediately and a record of that request; and, if you exercise your right of withdrawal, your request (name, e-mail address and the contract concerned).

Account data (if you create an account): e-mail address, name (if you choose to add it), preferences, transfer and subscription history, and a record of key actions (such as accepting our terms, changing plan or deleting your account), including the IP address and browser used at that moment.

Drop & Charge (when available): your name and tax number (NIF), the identifier of your Stripe account, its country and its verification status.

Branding (Annual Plan): the logo and background image you choose for your download page.

Messages: the content of messages you send us and of any reports of illegal content, with any contact details you choose to give.

Recipient data: technical data about access to download pages and downloads and, for Drop & Charge, the payment confirmation sent by the payment provider.

We never ask for a password: you sign in through a single-use link sent to your e-mail, valid for 10 minutes.

We do not intentionally collect sensitive data. Providing data is optional, except for your e-mail address to make a paid transfer or to use an account, and the data needed to complete a payment, which are necessary to enter into and perform our contract with you, and the invoicing data that tax law requires us to record; without them we cannot provide that part of the service.

Most of this data comes directly from you or is generated when you use the service. Some comes from others: payment confirmations and transaction references from our payment providers (and, for Drop & Charge, the verification status of your Stripe account from Stripe), invoice references from our invoicing software, the country of your connection from our network provider (Cloudflare) and, for recipients and for people whose data is contained in a file, from the sender. We do not collect data from publicly accessible sources.

4. Your files

We do not open, read or analyse the files you upload, except where we receive a report of illegal content or an order from an authority. We only store them for the period you choose, make them available to anyone with the link, and delete them afterwards. If your files contain other people’s data, you decide how that data is used and must make sure you are entitled to share it; we handle it only on your behalf, as your processor, under Section 10.1 of the Terms of Service. We tell you at least 30 days in advance of any addition or replacement of providers that process personal data contained in files on our behalf, so that you can object to it; if your objection cannot be resolved, you may terminate the affected subscription and receive a pro-rata refund of prepaid subscription fees for the period after the change (see Section 10.1 of the Terms of Service), and you may close your account (see Section 14 of the Terms of Service). Requests about personal data inside a file should be addressed to the sender; we will help where appropriate.

To stop files already removed as illegal from being uploaded again, your browser calculates a digital “fingerprint” of each file, which we compare against an internal list of removed files. The fingerprint cannot reveal or rebuild the file’s content.

5. Why we use your data

To provide the service: processing transfers and payments, managing your account and subscription, and sending service e-mails (sign-in links, receipts, purchase confirmations, renewal and security notices). Legal basis: performance of a contract.

To comply with the law: issuing and keeping invoices and determining VAT, keeping proof of contract confirmations and of withdrawal-right acknowledgements, meeting tax and consumer-protection rules, handling reports and orders about illegal content, answering your data-protection requests, responding to authorities and, where the EU Data Act (Regulation (EU) 2023/2854) applies, handling requests to switch to another provider and exporting files, transfer metadata and account data under Section 7.5 of the Terms of Service. Legal basis: legal obligation.

To protect the service: preventing abuse, fraud and attacks (including rate limiting and anti-bot checks), detecting technical errors, preventing the re-upload of files already removed as illegal, keeping evidence of key actions, answering general enquiries and defending legal claims. Legal basis: our legitimate interests, namely keeping the service secure and available for all users, preventing its misuse and the redistribution of illegal content, and being able to prove what was agreed or done and to defend ourselves in case of dispute. You may object to this processing at any time (see Section 9).

We do not sell your data, show ads, build profiles or use your data to train artificial-intelligence systems. We do not send marketing e-mails; if we ever do, they will only cover services similar to those you bought, and you can opt out at any time, easily and free of charge, both when we collect your e-mail address and in every message. Any other marketing will only be sent with your prior consent, which you can withdraw at any time as easily as you gave it.

We share data only with the providers that help us run the service, under contract and confidentiality obligations:

Cloudflare — file storage (in the EU), content delivery and protection against bots and attacks;

Amen.pt, TransIP and Eurofiber — server hosting and data centre (Portugal and the Netherlands);

Moloni — invoicing (Portugal);

Brevo — service e-mails (France);

Google — the info@letmedrop.com mailbox;

Sentry — technical error monitoring;

Register S.p.A., Associação DNS.PT, Key-Systems GmbH and GoDaddy — registration of our domains (Italy, Portugal, Germany and the United States), involving only our own contact details.

Payment providers (Easypay, when available, PayPal and, for Drop & Charge, when available, Stripe) act as independent controllers and handle your payment data under their own responsibility and privacy policies.

Cloudflare also uses the anti-bot signals, as an independent controller, to improve its own bot detection. We send our invoices to the Portuguese Tax and Customs Authority (Autoridade Tributária e Aduaneira), as tax law requires. We may also have to share data with other public authorities, including courts, where the law requires it.

7. Transfers outside Europe

We prefer providers based in the European Union. Some (Cloudflare, Google, Sentry and GoDaddy, which registers some of our domains and receives only our own data) belong to US-based groups and may process data in the United States. Where they do, it is only with the safeguards required in the EU, namely the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for providers certified under it, or standard contractual clauses approved by the European Commission. You can ask for more information, including a copy of the applicable safeguards, at info@letmedrop.com. PayPal and Stripe decide on their own transfers as independent controllers, using safeguards such as, for PayPal, binding corporate rules; see their privacy policies for details.

Our files are stored in the EU; content delivery and protection against attacks by Cloudflare may involve processing outside the EEA, with the safeguards described above.

8. How long we keep your data

Files: until the end of the period you choose (30 days maximum) or until you delete them, and removed within the following 24 hours; or, during a switching process under Section 7.5 of the Terms of Service, until the end of the export period;

File names and e-mail given for a transfer: 30 days after the files are deleted;

Other transfer data: 12 months or, if longer, for as long as your account exists; for paid transfers, as long as the invoice is kept;

Invoices and related payments: 10 years, as required by tax law;

Account data: while your account exists and, after you confirm its deletion, for a further 30 days during which you can cancel the deletion and restore the account (see Section 9); after that, only what the law or evidence of past actions requires;

Evidence records (acceptance of terms, contract confirmations, requests for immediate start, withdrawal requests, subscriptions and purchases): 3 years;

Server logs: 12 months; backups: 14 days;

Support messages: 3 years after the last contact;

Data-protection requests: 3 years after the request is resolved;

Payment notifications from providers: full copy 90 days, reference 2 years;

Error reports: up to 90 days;

E-mail delivery records: 6 months;

Unpaid or incomplete transfers: if payment or the upload is not completed within 48 hours of the transfer being created, the transfer lapses and its files are deleted within a further 24 hours; file names, e-mail and other transfer data are kept as set out above;

Content reports and moderation decisions: 5 years after the case is closed; where access to files has been disabled rather than the files deleted, the files may be kept for the time needed to handle the report and, where needed to establish, exercise or defend legal claims, up to 5 years after the case is closed. A report does not by itself set any retention period;

Files and records subject to an order from a competent judicial or administrative authority: for the period specified in the order.

9. Your rights

You can, at any time and free of charge, access your data and get a copy (also downloadable from your account settings), correct it, ask us to delete it, restrict or object to certain uses, and receive the data you gave us in a structured, commonly used and machine-readable format you can move to another service, where processing is based on contract or consent. Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. Some data, such as invoices, can only be deleted once the legal retention period ends.

Your right to object: you can object at any time, on grounds relating to your particular situation, to the processing based on our legitimate interests (Section 5). We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. You can also object at any time, without giving reasons, to the use of your data for marketing, and we will stop immediately.

To exercise your rights, write to info@letmedrop.com. We reply without undue delay and within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month. Writing from the e-mail linked to your account or transfer is usually enough; if we have reasonable doubts about your identity, we may ask for additional information to confirm it. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and will explain why.

You can delete your account in your settings. Once you confirm by e-mail, the account is locked and deleted after 30 days. Until then, you can cancel the deletion using the link we send you — a safeguard against accidental deletion or deletion by someone else.

10. Automated decisions

We do not make decisions about you based on profiling. Only two automated processes can affect you: blocking the upload of a file identical to one already removed as illegal (by comparing its fingerprint with our list of removed files), and ending a subscription whose renewal is not paid within 7 days. These are necessary to perform our contract with you and to prevent the redistribution of illegal content. In either case, you can ask for a person to review the decision, express your point of view and contest the decision by writing to info@letmedrop.com.

11. Security

All connections to the service are encrypted (HTTPS); our website uses TLS 1.3. Files are stored encrypted. Access to our systems is restricted, we limit abusive attempts, we keep regular backups, and the operator of our hosting infrastructure (team.blue/TransIP) is ISO/IEC 27001 certified. If a data breach occurs, we will notify the Comissão Nacional de Proteção de Dados where required, and if it is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, by e-mail or by a notice on our website.

12. Cookies

We only use cookies and similar technologies that are strictly necessary for the service you request to work: keeping you signed in, securing sign-in, remembering your language, remembering that you closed the cookie notice, and linking a transfer to the browser that started it. Your browser also temporarily stores, until you close the tab, the reference of a transfer whose payment you have not yet completed, so that you can resume it. Cloudflare may also set security cookies, and our anti-bot check (Cloudflare Turnstile) runs in your browser without setting cookies. When you select files, your browser reads them locally only to prepare the upload; no file leaves your device before you click “Send”. If you are signed in, your browser may tell us the total size and the duration you chose, so that we can check them against your account's limits. Separately, if you try to send a selection larger than 100 GB, your browser sends us only its size, for aggregate statistics, without cookies or identifiers and without identifying you. We have disabled open and click tracking in our service e-mails. We use no analytics, advertising or tracking cookies or similar technologies; under Law No. 41/2004 of 18 August, the strictly necessary technologies described in this section do not require your consent.

13. Children

LetMeDrop is for people aged 18 or over. By accepting our Terms of Service, you confirm that you are 18 or over; we do not carry out technical age checks or ask for identity documents. If we learn that a minor has used the service, we will delete their account and data and refund payments where possible. If a file uploaded by a sender contains a minor’s data, the sender is responsible for it, and we will pass any request from the minor or their parent or guardian to the sender and help them respond.

14. Changes to this policy

We may update this policy. Significant changes include, for example, new categories of data, new purposes or legal bases, new providers or transfers outside Europe, new tracking technologies, reduced rights or longer retention periods. For significant changes, we will give you at least 30 days’ notice on our website and by e-mail where we have your address, unless the law or an urgent security risk requires a shorter period. Continuing to use the service does not mean you consent to any processing. Previous versions are available on request.

15. Complaints

Not happy with how we use your data? Tell us at info@letmedrop.com and we will try to fix it. You can also complain at any time to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or the authority in the EU country where you live, work or where the alleged infringement took place (see the list at edpb.europa.eu). You also have the right to an effective judicial remedy.