Privacy Policy

Last updated 6 September 2026

Uploaditz is operated by Grandfield Media Private Limited, No 93 Koundinya Nagar, Nr Prathibha High Sch, I.E.Nacharam, Uppal, Hyderabad 500076, Telangana, India (“we”, “us”). This policy explains what personal data we process when you use uploaditz.com and the Uploaditz application, and why.

The short version

We never receive, store or read the contents of the files exchanged through Uploaditz. They move directly between your browser and the storage you or your organisation chose.
We store the catalogue: file names, sizes, folders, hashes, who uploaded and downloaded what, and when. This is what makes the product work and what your organisation relies on for its audit trail.
We do not sell personal data and we do not use it for advertising.

Data we process

Account data

Name, email address, role, organisation, sign-in method (Google, magic link or password). Passwords are never stored in plain text.

Catalogue data

File names, content types, sizes, folder paths, part hashes, object keys in your storage, upload and download timestamps, request records (what was asked of whom, by when) and archive status.

Audit data

For every action: the acting user, their role, IP address, browser user agent, timestamp, the file or request concerned and the result. Audit data is append-only and retained for the life of the organisation’s account so that it remains a complete record.

Technical data

Server logs (IP address, request path, timing) retained for 30 days for security and troubleshooting. We do not run advertising trackers.

Why we process it

To provide the service you or your organisation signed up for (contract); to keep the service secure and to keep an accurate audit trail (legitimate interest of your organisation and ours); to bill seats and storage (contract); and to answer support requests. Where you are a client or supplier invited by a customer organisation, that organisation is the controller of the catalogue and audit data about you, and we process it on its behalf.

Where data lives

Catalogue and audit data: in the region of your organisation’s account (United States or European Union). Managed file storage: a dedicated bucket in the region your organisation selected (US East, US West, EU Frankfurt or EU Ireland). Data does not leave the selected region.

Who else processes it (sub-processors)

Amazon Web Services — managed storage buckets and infrastructure (region of your choice).
Vercel — application hosting.
Supabase — catalogue database and authentication.
Resend — transactional email (invitations, requests, reminders).
Razorpay — payment processing; we never see full card numbers.

Retention

Account and catalogue data: for the life of the account plus 30 days, unless your organisation asks for earlier erasure. Audit data: for the life of the organisation’s account. On account closure your organisation can export the full catalogue and audit trail first. Managed storage buckets are transferred to your organisation or emptied at its written instruction — never silently.

Your rights

You can access, correct, export or ask for erasure of your personal data, and object to processing, by emailing uploaditz@grandfieldmedia.com. If you are an EU resident you may also complain to your supervisory authority. Where your organisation is the controller, we will forward your request to it and help it respond.

Cookies

Only the session cookie needed to keep you signed in, and a preference cookie for the interface. No third-party advertising cookies.

Changes

We will post changes here with a new date and, for material changes, email account admins at least 14 days before they take effect.