In Short

This section explains, in plain language, how specific Ive Sent It features handle your data; where it is more specific, this section prevails. Contact for anything on this page: privacy@ivesentit.com.

Our promises — what we never do

• We never sell or rent your personal data, and never share it for advertising.
• We never use your content — files, messages or metadata — to train AI or machine-learning models, ours or anyone else's. Automated analysis of your content happens for one reason only: the safety checks described below.

How the features handle data

• Delivery evidence. When a recipient opens or downloads a delivery we record the event — time, file, the recipient's IP address, browser type and the country derived from the IP. This ledger powers the sender's delivery record, GeoWall rules, per-recipient download limits and the signed proof-of-delivery receipt. The sender sees the country, never the IP. The ledger is kept for the life of the delivery plus 30 days.
• Where a send comes from. When you send files — with an account, as a guest, through our developer API, inside a team, or by uploading to someone's request link — we record the IP address you sent from and the country, region and city our network derives from it, and the type of device (phone, tablet or computer). We use it only for security, fraud and abuse prevention, and to respond to lawful requests from law enforcement or regulators. It is never shown to the people you send to and never used for advertising. For an account send it is kept for as long as your account exists and deleted with your account. For a send made without an account (a guest send, or an upload to a request link) it is deleted 30 days after the link expires.
• Identity-verified delivery. A sender can require you to prove who you are before their delivery opens — from an emailed code up to a document-and-liveness check run by our verification provider Didit. A liveness check involves biometric processing by Didit and happens only with your explicit consent at that moment (declining just means the delivery stays closed). We receive the outcome and, for document and liveness checks, the verification portrait Didit returns; the sender can see that portrait on their review page, and it is deleted with the delivery. We never receive your ID document or any biometric template.
• Forensic watermarking. On the sender's request, documents and images carry a recipient-specific mark: a visible line with the recipient's email address and a short delivery reference, an embedded delivery and recipient identifier, and optionally a short label the sender chose — so a leaked copy can be traced.
• Safety scanning and human review. Every file is scanned for malware before delivery. Common image and video formats (JPEG, PNG, MP4, MOV) are also screened automatically for prohibited content such as CSAM. When a check flags a file, a member of our staff may view the files. A send under review cannot be deleted until the review ends; where we suspect serious abuse its records and files may be preserved as evidence for up to 13 months, and reported to the authorities where the law requires.
• Storage region and transit. A transfer's files are stored, scanned and delivered in one data region, the EU (Frankfurt) or the US (Ohio), for its lifetime. Which one depends on where you send from: we pick the region nearest the country your request came from (unknown means the EU). On the Team plan you choose the region for each send, and files sent to a file request use the region set when the request was made. Long-distance uploads may transit AWS's global edge network encrypted end to end; files never leave their region. Account and delivery records (names, email addresses, delivery ledgers, send origins) are held in the EU whichever region the files use, and the emails we send you are dispatched from the US.
• Measurement — our own, nothing third-party. We use no third-party analytics, we don’t track you around the internet, and we never mine or sell your data. By default we count visits with a daily-rotating, non-reversible hash of IP address and browser that cannot be joined from one day to the next — no cookie. Two things you control: if you choose Accept all on the cookie banner, our own server sets one first-party cookie holding a random identifier (13 months) so we can tell whether people come back — it carries nothing about you and is never joined to advertising. And if you arrived from one of our Google ads, the click reference Google put in the page address is attached to any sign-up, guest send or purchase you make during that visit, and we later tell Google that the click led to a sign-up, a guest send or a payment; Accept all additionally keeps the reference in your browser for 90 days so a later visit can still be credited. We never send Google your name, email or anything about your files; our conversion record (click reference, time, value, an internal id or a hash of a guest's email) is kept for 13 months. When you are signed in, our measurement carries a one-way hash of your email, made in your browser, so we can tell members from visitors — not who you are. Our own Google Ads reporting tool reads our advertising account's performance data through Google's API; it does not touch your data or your files. (See the Cookie Policy.)
• Error reporting. When something breaks, the website, the apps and our servers send a technical report to Sentry (Functional Software, Inc., USA): the error, the page or endpoint pattern, your opaque account id if you are signed in, your country and a request id. Never your email, your files, cookies or the contents of a request. Your IP address reaches Sentry with the connection, as with any web request, and is not stored by us there.
• Security logs. Our systems keep standard access logs — IP address, browser, page or file requested, time — for the website, the API and downloads, for 90 days, for security and abuse investigation.
• Delivery certificates and receipts. Every delivery has a public certificate at ivesentit.com/verify. From the Delivery ID alone it shows that the delivery is genuine, the sender's name, @handle and team, a masked email address, how many files and their total size, when it was sent and expires, and which protections were on; presenting the full certificate hash additionally shows the sender's email, the label and the file list. Signed receipts work the same way. After a delivery or the sender's account is deleted, the register keeps only a stub — the identifier, a hash and the signature, nothing personal — for 10 years, so a certificate or receipt someone holds can still be checked.
• Teams. In a team workspace your role and the sends you make there are visible to everyone in the team, in the team's Deliveries. A pending invite stores the invitee's email until accepted or expired. Sends made in a team belong to the team and are not deleted with your personal account.
• Recent recipients. To save you retyping, your account remembers the addresses and @usernames you have sent to (the last 60, with how often) and offers them on the send screen. You can forget any of them there, and the list is deleted with your account.
• Who bills you. A plan bought on our website from the United Kingdom, the Isle of Man, Jersey or Guernsey is sold and billed by Ive Sent It Ltd, our UK company; everyone else's by IVE SENT IT LLC. The company that bills you, and Stripe on its behalf, hold your billing details — name, email address, the full billing address asked for at checkout, your plan, invoices and payment status — and Ive Sent It Ltd is a controller of the billing records of its own customers. Card details are held only by Stripe. App Store subscriptions are billed by Apple.
• Pay to Download. When a seller charges for a delivery, the payment is taken by Stripe directly for the seller; the seller and Stripe receive your email address and the payment reference, and we keep a record of the payment (amount, currency, status, the delivery and recipient it belongs to). We take no commission.
• Delete it all, yourself.Account → Delete account closes your account immediately: you can no longer sign in, your sends stop working, your file requests close, any subscription bought on our website is cancelled, and your username is released after a 30-day hold. Your account, everything you sent and your file requests are scheduled for deletion at that moment and permanently deleted within 30 days. Deletion cannot be undone or cancelled. Files other people sent you remain theirs. A subscription bought through the App Store is managed by Apple: cancel it in your Apple ID settings or it will keep renewing. A few records outlive your account, as the full notice sets out: the tamper-evidence register for certificates and receipts (a stub with nothing personal, 10 years), support tickets you opened (2 years after closing), our edge security logs (90 days), anonymous usage statistics and ad-conversion records (13 months), a hard-bounce record for an email address that rejected our mail (12 months), and anything held under a safety review, a preservation hold or a lawful order for as long as that requires.