Privacy Policy

Summary in plain English

We collect as little as we need to move your files. Your files are deleted automatically when the transfer expires (at most 10 days with extensions), or sooner if you delete them. We keep basic transfer details, a salted hash of the uploader's IP address for abuse prevention and quotas, and account details if you sign in. Files are encrypted in transit and at rest by our storage provider, but Enzonic Send is not end-to-end encrypted. The service is paid for by Google ads; personalized ads are shown only with consent where consent is required. We never sell your data for money, and you can opt out of ad-related "sharing" at any time. Questions or requests: admin@enzonic.com with the subject line "Privacy".

Last updated: October 17, 2026

1. Who we are

This Privacy Policy explains how Enzonic LLC ("Enzonic", "we", "us", "our"), a limited liability company formed in the Commonwealth of Kentucky, USA, handles personal data when you use Enzonic Send, including the website at https://send.enzonic.com and the Enzonic Send apps for Android and iOS (the "Service").

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws, Enzonic LLC is the controller of the personal data described in this policy, except where we say otherwise (for example, where Google acts as an independent controller for advertising).

Contact: Enzonic LLC, Commonwealth of Kentucky, USA. Email: admin@enzonic.com (subject line "Privacy"). Company website: https://enzonic.com.

This policy should be read together with our Cookie & Local Storage Policy, Your Privacy Choices page and Terms of Service.

2. The personal data we collect

2.1 Information you give us

Please note: we do not need to know what is inside your files and we do not pre-screen them. However, because files are stored in a form our infrastructure can technically read (the Service is not end-to-end encrypted), avoid uploading highly sensitive personal data unless you have protected it yourself, for example with an encrypted archive.

2.2 Information collected automatically

2.3 Information about recipients

When someone opens a share link, enters a 6-digit code or scans a QR code, we record that a download happened (to update the download count and enforce any download limit). Their requests are also processed in Cloudflare's server logs, and they may see Google ads, as described above.

3. How we use personal data and our legal bases

If you are in the EEA, the UK or Switzerland, we must have a legal basis for each use of your personal data. The table below explains our purposes and the bases we rely on.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object to this processing; see section 9.

We do not use your files to build advertising profiles, we do not sell your files, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automatic quota checks and rate limits may temporarily prevent an upload, but they do not have legal effects and you can contact us if you think one has been applied in error.

4. Advertising

Enzonic Send is free because it is funded by ads.

• Website: we use Google AdSense, including auto ads that Google places on the page.
• Apps: we use Google AdMob, including optional rewarded ads (for example, to extend a transfer's expiry).
• Consent: for visitors in the EEA, the UK and Switzerland, we use a Google-certified consent management platform (Google's consent message on the web and the User Messaging Platform (UMP) in the apps). We use Google Consent Mode, so Google adjusts how its tags behave based on your choices. Personalized ads are shown only if you consent.
• Changing your choice: on the website, click "Privacy & cookie settings" in the footer to re-open the consent message. In the apps, use the privacy settings option in the app menu where available, and your device's advertising settings. See Your Privacy Choices.
• Google's role: Google acts as an independent controller for much of the data it processes for advertising. Learn how Google uses information from sites and apps that use its services at https://policies.google.com/technologies/partner-sites.

5. How we share personal data

We share personal data only as described here.

5.1 Service providers (processors)

These providers process data on our behalf, under contracts that require them to protect it and use it only to provide their services to us.

5.2 Advertising partners

Google processes some of this data as an independent controller under its own privacy policy. See https://policies.google.com/technologies/partner-sites.

5.3 Recipients you choose

Anyone with a transfer's link, 6-digit code or QR code (and the password, if one is set) can see the file names, sizes, title, message and files in that transfer. You control who receives these.

5.4 Legal, safety and business reasons

We may disclose personal data:

• to comply with a law, regulation, court order, subpoena or other valid legal process (see our Law Enforcement Guidelines);
• to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as required by U.S. law;
• to protect the rights, property or safety of Enzonic, our users or the public, including to investigate fraud, abuse or security incidents;
• to the person who sent a DMCA notice, when we forward a counter-notice, and vice versa, as the DMCA requires; and
• in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy.

We do not sell personal data for money. See section 10 for how US state laws treat advertising-related sharing.

6. How long we keep data

7. International data transfers

Enzonic is based in the United States. Our infrastructure runs on Cloudflare's global network, so your data may be processed in the United States and in other countries where Cloudflare, Clerk or Google operate. These countries may have data protection laws different from those where you live.

When we transfer personal data from the EEA, the UK or Switzerland to countries that are not considered to provide adequate protection, we rely on appropriate safeguards, such as:

• the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework, where the recipient is certified;
• the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where relevant; and
• other lawful transfer mechanisms permitted by applicable law.

You can ask us for more information about these safeguards by emailing admin@enzonic.com.

8. Security

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit using HTTPS/TLS for all connections to the Service;
• encryption at rest of stored files by our storage provider (Cloudflare R2);
• salted hashing of transfer passwords and of uploader IP addresses;
• automatic, permanent deletion of files at expiry; and
• access controls limiting who can access production systems.

Enzonic Send is not end-to-end encrypted. Files are encrypted by the storage provider, which means that our systems can technically access file contents (for example, to deliver them to recipients or act on legal requirements). We do not routinely look at files. If your files are sensitive, encrypt them yourself before uploading and share the key separately.

No method of transmission or storage is completely secure. For more details, and to report a vulnerability, see our Security & Responsible Disclosure page.

9. Your rights

9.1 Everyone

Wherever you live, you can:

• delete your transfers at any time from the device you sent them from, or from your account;
• delete your account in your account settings where available, or by emailing us;
• change your advertising choices using "Privacy & cookie settings" in the website footer, your app settings or your device settings; and
• contact us with any question about your data.

9.2 EEA, UK and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict our processing in certain circumstances;
• data portability, to receive data you provided to us in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, and to object at any time to processing for direct marketing;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and
• lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

9.3 Practical note about short retention

Because files and most transfer data are deleted within days, we may no longer hold the data you ask about. We also cannot always link data to you: for example, we store only a salted hash of the uploader's IP address and cannot reverse it. In those cases we will explain what we can and cannot provide.

10. United States privacy rights

10.1 California (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. In the past 12 months we have collected the following categories of personal information, for the purposes described in section 3, from the sources described in section 2 (you, your device, and our service and advertising partners):

Sale and sharing. We do not sell personal information for money. However, allowing Google to collect cookies and advertising identifiers on our website and apps for personalized advertising may be considered a "sale" or "sharing" (for cross-context behavioral advertising) under California law. You have the right to opt out. Go to Your Privacy Choices or use the "Privacy & cookie settings" link in the footer. We honor Global Privacy Control (GPC) signals as an opt-out request for the browser that sends them.

We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only for purposes permitted under the CPRA (such as providing the Service and keeping accounts secure) and not to infer characteristics about you.

Your California rights. You have the right to:

• know what personal information we have collected, used, disclosed, sold or shared about you, and to access specific pieces of it;
• delete personal information we have collected from you, subject to exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information;
• limit the use of sensitive personal information (we already use it only for permitted purposes); and
• not be discriminated against for exercising your rights.

Retention. See section 6 for how long we keep each category.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes as defined by Cal. Civ. Code § 1798.83.

10.2 Other US states

Residents of states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, may have the right to:

• confirm whether we process their personal data and access it;
• correct inaccuracies;
• delete personal data;
• obtain a portable copy of personal data;
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• appeal our decision on a request.

We use personal data for targeted advertising only through Google's advertising services as described above, and you can opt out at any time on our Your Privacy Choices page. We do not engage in profiling that produces legal or similarly significant effects. We honor these rights for all US users, whether or not a particular state law applies to us.

Nevada. We do not sell covered information as defined by Nevada law. You may still email us to submit an opt-out request.

10.3 Appeals

If we decline to take action on your request, you may appeal by replying to our decision or by emailing admin@enzonic.com with the subject line "Privacy Appeal". We will respond within the time required by applicable law (generally 45 to 60 days). If you are not satisfied with the outcome, you may contact your state Attorney General.

11. How to exercise your rights

• Email: admin@enzonic.com with the subject line "Privacy Request", stating which right you want to use and your country or state of residence.
• Online choices: use Your Privacy Choices and "Privacy & cookie settings" in the website footer for advertising and cookie choices.
• Verification: to protect you, we will verify your identity before acting on access, deletion or correction requests. For account data, we will usually ask you to confirm the request from the email address on your account. For transfer data, we may ask for the share link or 6-digit code and other details that show the transfer is yours.
• Authorized agents: you may use an authorized agent to make a request on your behalf. We may ask for proof of the agent's authority and ask you to verify your identity directly.
• Timing: we will respond within one month under the GDPR and UK GDPR (extendable by two further months where necessary), and within 45 days under US state laws (extendable where the law allows). We will tell you if we need more time.
• Cost: requests are free, unless they are manifestly unfounded or excessive.

12. Children

The Service is not intended for children under 13, or under 16 in the EEA and other places where a higher age of digital consent applies. We do not knowingly collect personal data from children under these ages. If you believe a child has provided us with personal data, email admin@enzonic.com with the subject line "Privacy" and we will delete it.

13. Links to other sites

The Service may contain links to other websites and ads from third parties. We are not responsible for their privacy practices. Please read their privacy policies before providing them with information.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date at the top of this page and, if changes are material, give notice through the Service or by email to account holders before they take effect where required. Please review this page periodically.

15. Contact

Enzonic LLC Commonwealth of Kentucky, USA Email: admin@enzonic.com (subject line "Privacy") Website: https://enzonic.com