Last updated: 2 June 2026
This notice explains what personal data Nullsend collects, why, how we protect it, and the rights you have over it. We have written it in plain language rather than legal jargon, because a privacy product should be able to explain itself clearly.
Nullsend Ltd is a company registered in England & Wales with company number 17266592. References to "Nullsend", "we", "us" and "our" mean Nullsend Ltd.
Nullsend provides encrypted file transfer. Files are encrypted in your browser before they leave your device, which means our systems only ever hold scrambled data. We cannot read the contents of the files you send. This is not a policy choice we could quietly reverse later; it is how the product is built.
For any privacy question, or to exercise your rights, contact us at privacy@nullsend.io.
The data controller is Nullsend Ltd, a company registered in England & Wales with company number 17266592.
We collect as little as we can. Here is the full picture.
Account and workspace information. When you create an account we collect your email address, a password (which we never store in readable form; it is hashed using Argon2id), your company or workspace name, and the subdomain you choose. We need this to create and secure your account and to provide the service. Lawful basis: performance of our contract with you.
Billing information. Payments are handled by Stripe. We do not see or store your card number. We hold a record that an account is subscribed to a particular plan, and the billing identifiers Stripe gives us. Lawful basis: performance of our contract with you, and our legitimate interest in being paid.
The files you send. We hold your files only as ciphertext. They are encrypted on your device before upload, and the key needed to decrypt them lives in the share link, in the part after the "#", which by web standards is not sent to our servers in normal use. We therefore cannot read, scan, index, or otherwise access the contents of your files, and neither can anyone we work with. One exception, stated plainly: if you choose to have us email a transfer link for you, that link contains the key by necessity (otherwise the recipient could not open it), so it passes through our email system and is held only long enough to send the message. Even then, we cannot read your files. Lawful basis: performance of our contract with you.
Transfer metadata. To run the service we keep records about transfers: file sizes, dates, how many times a file has been downloaded, and the recipient email addresses that a sender enters so we can notify them. We also keep audit logs of who sent what, meaning the fact that a transfer happened and between whom, never the contents. Lawful basis: performance of our contract with you, and our legitimate interest in operating and securing the service.
Security logs, including IP addresses. We log IP addresses only for security and abuse prevention. These are retained for 30 days and then deleted. We do not use IP addresses for tracking, profiling, advertising, or analytics. Lawful basis: our legitimate interest in keeping the service and its users secure.
Bot protection. We use Cloudflare Turnstile to tell humans from automated abuse at login and signup. This involves a check performed by Cloudflare. Lawful basis: our legitimate interest in protecting the service from abuse.
Mobile-app waitlist. If you ask to be notified when our mobile apps launch, we store the email address you give us, plus the date and where you signed up. We use it only to send that one launch notification, nothing else. You can ask us to remove you at any time. Lawful basis: your consent.
We think it is worth being explicit about what we do not collect or do, because for a privacy product the absences matter as much as the presences.
We do not sell your data. We use a small number of trusted service providers (sub-processors) to run the service. Each only receives what it needs to do its job.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Hosting and infrastructure | European Union (Finland) |
| Backblaze B2 | Encrypted file storage | European Union |
| Stripe | Payment processing | United States |
| Postmark | Sending transactional email | United States |
| Cloudflare | DNS and bot protection (Turnstile) | Global network |
| Anthropic | AI onboarding assistant (signup conversation only; never file contents or recipient data) | United States |
Your account information and the encrypted files are stored in the European Union. Stripe, Postmark, and Anthropic are based in the United States; where personal data reaches them, it is protected by the safeguards those providers maintain for international transfers under UK and EU data protection law (such as Standard Contractual Clauses and applicable data transfer frameworks). The files themselves remain ciphertext throughout, so even our storage and infrastructure providers cannot read them.
We may also disclose data where we are legally required to, for example in response to a valid legal order. Because we hold files only as ciphertext, we cannot produce readable file contents even if compelled to; we can only provide what we actually hold, which is metadata and account information. For how to report a child in danger or child sexual abuse material, and how we act on reports of misuse, see our Child Safety page.
We keep personal data only as long as we need it.
Under UK and EU data protection law you have the right to:
To exercise any of these, email privacy@nullsend.io. We will respond within the timeframes required by law (normally within one month).
If you believe we have handled your data improperly, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local data protection authority in the EU. We would always prefer you contact us first so we can put things right.
We use only the cookies necessary to make the service work, such as keeping you logged in and remembering your light or dark theme preference. We do not use advertising or third-party tracking cookies.
If we change how we handle your data, we will update this notice and change the date at the top. For significant changes affecting your rights, we will take reasonable steps to let you know.
Questions about this notice or your data: privacy@nullsend.io
Nullsend Ltd