Privacy Policy

Who we are

The controller of the personal data described here is Sansavision, a division of Sansa Group AB, a limited company registered in Sweden (organisation number 559111-9507), Soldathemsgatan 20, 415 28 Göteborg, Sweden. Contact: support@slingdrop.my. We haven't appointed a data protection officer; privacy questions go to the same address.

What we collect

• Account data: your email address, name, profile details and sign-in method (one-time code, magic link, Google or Apple). We need your email to give you an account; you can send drops without one.
• Content: files you upload, comments, approvals, versions and settings. Vault drops are end-to-end encrypted; we store only ciphertext and cannot read them.
• Usage and device data: IP address, approximate location derived from it (country and city), browser and device type, and actions such as views, page reading time and downloads. Recipients' views are counted with a first-party identifier so senders see unique views.
• Payments: when you subscribe in the iOS or Android app, the store and our subscription processor tell us your plan status. We never see your card details.
• Communications: messages you send to support and your notification preferences.

Why we use it, and our legal bases

• To provide Slingdrop: storing and delivering files, generating previews, sending notifications you've asked for and keeping your devices in sync. Basis: performance of our contract with you (GDPR Article 6(1)(b)).
• To show senders who viewed what they shared. Basis: the sender's and our legitimate interest in knowing a shared file arrived (Article 6(1)(f)). Viewers of public drops are counted without being identified.
• To keep Slingdrop safe: scanning uploads for malware and abuse, preventing spam and fraud, enforcing rate limits and our policies, and handling reports. Basis: our legitimate interest in protecting users and the service (Article 6(1)(f)), and our legal obligations under the EU Digital Services Act (Article 6(1)(c)).
• To improve Slingdrop using aggregated, de-identified statistics. Basis: legitimate interests (Article 6(1)(f)).
• Optional emails, such as digests you turn on. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time in Settings.
• Bookkeeping and answering lawful requests from authorities. Basis: our legal obligations under Swedish and EU law (Article 6(1)(c)).
• Where we rely on legitimate interests you can object, and we'll stop unless we have compelling grounds to continue.

Automated decisions

We don't make decisions with legal or similarly significant effects on you based solely on automated processing. Automated malware and abuse checks can pause a drop until a person reviews it.

AI features

AI features run only when a user asks for them. Content is sent to model providers through our AI gateway with data collection disabled, so providers don't train on or retain it. Embeddings and transcripts we create are stored with the drop and deleted with it. Vault drops are never processed by AI.

Who we share it with

• People you share with: recipients see the drop and, where you allow, comments and other participants' names.
• Senders: if you view someone's drop, the sender sees view analytics. For private drops they see your verified email; for public drops they see anonymous counts, approximate location and device type.
• Service providers (subprocessors): Cloudflare (hosting, storage, databases, email delivery, AI inference, security), OpenRouter and the model providers it routes to (AI features, with data collection disabled), Resend (email delivery backup), Expo (push notification relay), Apple and Google (sign-in, push delivery and in-app purchases). Each is bound by data protection terms; the full list is on our Subprocessors page.
• Authorities: when the law requires it, for example when we report suspected child sexual abuse material to the Swedish Police Authority, or to protect rights, safety and the integrity of the service.
• We do not sell or rent personal data, and we don't use advertising trackers.

International transfers

We're based in Sweden, and most of our providers are in the United States. Transfers outside the EU/EEA rely on the EU–US Data Privacy Framework where the provider is certified, and on the EU standard contractual clauses otherwise. Ask us for a copy of the safeguards.

Retention

• Drops are deleted when they expire, when you delete them, or 30 days after you move them to Trash. Account data is kept while your account is active and deleted within 30 days after you delete your account. Device inbox items are deleted after 30 days. Analytics are kept while the related drop exists.
• Some records are kept longer because the law requires it: bookkeeping records for purchases made directly from us for seven years (Swedish Bookkeeping Act), and evidence of suspected child sexual abuse material, locked away from everyone, for up to one year after we report it so law enforcement can request it.

Your rights

• Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time.
• Many of these are self-service in Settings (Export my data, Delete account).
• For anything else, email support@slingdrop.my. We may ask you to confirm your identity, and we'll respond within one month (or tell you within that month if a complex request needs up to two more).

Complaints

If you think we've handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, which supervises us, or to the data protection authority where you live or work.

Security

We use encryption in transit and at rest, isolation of user content, access controls and monitoring. Vault drops add end-to-end encryption. See our Security page for details.

Children

Slingdrop isn't directed to children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

Changes

We'll post updates here and notify you of material changes by email or in the app.