Privacy Policy

This Policy applies to information we process through the Service. It does not apply to information processed by third parties linked to or integrated with the Service (for example, the identity provider you choose to sign in with, or the third-party services that deliver email on our behalf), whose practices are governed by their own privacy policies.

We use the information described above to:

• Operate, maintain, and secure the Service.
• Authenticate users, deliver transfers, and enforce rate limits and expiration.
• Send transactional notifications (transfer ready, claim link, verification codes, expiration warnings, security alerts).
• Send marketing communications about products and services we believe may interest you, consistent with Section 7 of the Terms of Use and applicable law; you may opt out at any time.
• Analyze usage, measure performance, and improve the Service.
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms.
• Comply with legal obligations, respond to lawful requests, and enforce our rights.

Legal bases for processing (for users in the EEA, UK, or Switzerland). To the extent the GDPR applies, we process personal data on the bases of (a) performance of a contract with you, (b) our legitimate interests in operating and securing the Service, (c) your consent (for marketing communications and certain cookies), and (d) compliance with legal obligations.

We share information only as described below. We do not sell your personal information.

• With service providers that help us run the Service. These providers are contractually restricted to using your information only to provide services to us. The categories of providers we engage include:
  • Infrastructure providers — cloud hosting, content delivery, DNS, storage, bot protection, and service analytics.
  • Identity providers — the third-party sign-in service you choose when you authenticate (for example, Google or Microsoft). We receive only the profile information described in Section 2.1.
  • Communications providers — third-party services that deliver email (including transactional and marketing messages) on our behalf.
  • Product analytics providers — Google Analytics and similar tools that help us measure usage and improve the Service, as described in Section 2.6.
  We will provide the specific identity of any individual service provider on request to the extent required by applicable law.
• With recipients you designate. When you create a transfer, the recipient email you provide is used to deliver the transfer.
• To comply with law. We may disclose information to comply with subpoenas, court orders, legal process, or other legal obligations, or when we believe in good faith that disclosure is necessary to protect our rights, enforce our Terms, protect the safety of any person, or investigate suspected fraud or abuse.
• In connection with a business transaction. If we are involved in a merger, acquisition, financing, sale of assets, or similar transaction, information may be transferred as part of that transaction. We will require any acquirer to honor the material terms of this Policy or give you notice.
• With your consent. For any purpose not described in this Policy, with your consent.

We use reasonable administrative, technical, and physical measures designed to protect information, including:

• Encryption of file contents and sender messages in your browser before upload, using industry-standard algorithms, with per-transfer keys wrapped under a server-held key.
• Encryption in transit for all connections between you, our infrastructure, and our service providers.
• Authentication through established third-party identity providers; short-lived session tokens; secure cookies.
• One-way hashing of passphrases (stored as salted SHA-256, wiped on successful claim); constant-time comparison for sensitive equality checks.
• Automatic deletion of transfer ciphertext after seven (7) days or first download.
• Rate limits, bot protection, and audit logging for abuse-sensitive operations.

No security measure is perfect. You acknowledge that use of the Service carries residual risk and that we cannot guarantee against unauthorized access, interception, or disclosure. You are responsible for sending only content whose sensitivity is appropriate for a free, general-purpose utility (see the prohibited-uses list in the Terms of Use).

• Transfer ciphertext and sender message ciphertext: deleted from our infrastructure seven (7) days after creation or upon first successful download, whichever comes first.
• Transfer metadata: the row is retained in our database after ciphertext deletion for operational and audit purposes; may be purged on a rolling basis per our retention schedule.
• Account data: retained while your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements.
• Audit logs: typically retained for ninety (90) days.
• Passphrase hashes: wiped from the database on successful claim or when the transfer expires.

We operate the Service in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, which may have data-protection laws different from those in your jurisdiction. By using the Service you consent to this transfer.

The Service may contain links to third-party websites or services. Those third parties are not controlled by us, and we are not responsible for their privacy practices. This Policy does not apply to any third party; review their policies before providing information.

We may update this Policy at any time by posting the revised version at otdrop.com/privacy and updating the Effective Date. Material changes will be noted on the page or communicated by email to registered senders. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

NuSecuritas, LLC

PO Box 702, Hillsdale, MI 49242