Privacy Policy — TubeDisk

Effective date: May 11, 2026 Last updated: May 15, 2026

1. Data Controller

The data controller is the TubeDisk service operator ("we", "us", "our").

Contact for privacy matters:

Email: <support@tubedisk.com>

EU Representative appointment is pending. While we complete the formal designation (via a third-party EU representation service), EU-resident data subjects may submit GDPR-related requests directly to <support@tubedisk.com> with the subject line "GDPR EU Representative Inquiry" — we route these requests to our designated representative when the appointment is finalised.

2. Data We Collect

When you use TubeDisk, we may process the following categories of personal data:

Category	Specific data	Source
Identifiers	email, username	provided by you at registration
Authentication	password hash (BCrypt)	provided by you
Social identifiers	OAuth tokens, name, email from Google	from Google on OAuth login
Technical	IP address, User-Agent, browser locale	automatically on connection
Behavioural	download history (URLs, sizes, timestamps)	through service use
Payment	amount, date, method	through payment processor (we do not store card numbers)

Ephemeral content processing. When you request a video or audio transfer, the Service streams the data from the source to your selected cloud destination. Intermediate buffers exist only for the duration of the transfer and are discarded on completion. The Service does not retain your source media as long-term data.

3. Purposes of Processing

3.1. Service provision: account management, processing download requests, providing functionality.

3.2. Communication: task status notifications, support replies, service updates.

3.3. Security: fraud prevention, DDoS protection, incident investigation.

3.4. Service improvement: aggregated usage analytics, error debugging.

3.5. Legal compliance: responses to lawful requests from authorities.

4.1. Consent (Article 6(1)(a)) — for analytics and marketing communications.

4.2. Contract performance (Article 6(1)(b)) — for service provision under these Terms.

4.3. Legitimate interests (Article 6(1)(f)) — for security and fraud prevention. Our legitimate interests are balanced against your fundamental rights.

4.4. Legal obligation (Article 6(1)(c)) — for compliance with applicable laws.

5. Your Rights as a Data Subject

You have the right to:

Access your personal data (Article 15);
Rectification of inaccurate data (Article 16);
Erasure ("right to be forgotten", Article 17);
Restriction of processing (Article 18);
Data portability (Article 20);
Object to processing (Article 21);
Lodge a complaint with a supervisory authority (in your EU country).

Under CCPA / CPRA (California residents)

You have the right to:

Know what personal information is collected, used, shared, or sold;
Delete your personal information;
Opt-out of the sale or sharing of your personal information. We do not sell personal data; you can confirm this opt-out is honored by contacting support;
Limit the use of sensitive personal information;
Non-discrimination for exercising your rights.

Global Privacy Control (GPC). We honor the GPC browser signal as a valid opt-out request for sale/sharing under CCPA, effective 2026. If your browser sends a GPC header, no further action is required.

Under similar US state laws (Virginia, Colorado, Connecticut, Texas, etc.)

You have substantially equivalent rights under your state's privacy law (VCDPA, CPA, CTDPA, TDPSA, and others). Contact support to exercise them.

Under the EU Data Act (effective September 2025)

In addition to GDPR rights, you have the right to access machine-generated data created through your use of the Service, and to request portability of that data to another service provider where technically feasible.

To exercise any right, contact <support@tubedisk.com>. We respond within 30 days (GDPR / EU Data Act) or 45 days (CCPA and US state laws).

6. Third Parties

We do not sell personal data to third parties.

Data may be shared with:

Google LLC — when Google Drive is connected (Google Drive API access);
Yandex LLC — when Yandex.Disk is connected (Yandex OAuth, Disk API);
Dropbox Inc. — when Dropbox is connected (Dropbox OAuth);
Amazon Web Services — when S3 integration is used;
Payment processors — for plan purchases (name, email, amount);
Government authorities — when legally required.

Transfers occur only to the extent necessary for the relevant function.

7. International Transfers

7.1. Some data may be transferred outside the European Economic Area (EEA), particularly to the United States (Google, AWS).

7.2. Such transfers occur on the basis of:

Adequacy decisions of the European Commission (where applicable);
Standard Contractual Clauses (SCCs) approved by the European Commission;
your explicit consent (Article 49(1)(a)).

8. Data Retention

8.1. Account data — until you delete your account.

8.2. Technical request logs — 90 days.

8.3. Download history — until you delete your account.

8.4. Payment records — 7 years (tax law compliance).

9. Security

9.1. We implement technical and organisational measures to protect your data:

BCrypt password hashing;
HTTPS for all connections;
access control for staff;
regular security updates.

9.2. We notify affected users within 72 hours of becoming aware of any personal data breach, in accordance with GDPR Article 33–34.