Scope and responsibility — Link to section
This policy covers the Kasai Cloud website, web app, mobile applications, cloud-storage service and support interactions, and desktop applications if and when offered. Kasai Cloud determines the purposes of account, service-security and support processing. For personal data stored by a business customer on behalf of others, the customer may be the controller and Kasai Cloud the processor; an agreed DPA governs that relationship.
Service operator
Kasai Cloud is the service name. The operator’s verified legal identity and contact details will be published here before public launch.
Information we handle — Link to section
The information involved depends on the features you use. Customer Content is a separate category: it is not ordinary usage analytics.
Account information
Name, email address, account identifier, preferred language and authentication or account-security information. Passwords and device credentials are sensitive authentication information and must not be sent through ordinary support messages.
Customer Content
Files, folders, photos, videos, documents, filenames, file metadata and other content you intentionally upload or share to Kasai Cloud. Previews, versions and sharing operations can involve processing this content to provide the features you select.
Subscription and transaction information
Where applicable, the selected plan, storage quota, billing status and transaction identifiers. Any payment-provider arrangements and handling of payment details must be disclosed when paid services are offered; this policy does not imply that Kasai Cloud stores raw payment-card details.
Sharing information
Share links, recipients, access permissions, password-protection settings and expiry settings used to make your chosen sharing work.
Device and application information
Device type, operating system, application version and device or session identifiers where applicable, including information needed to list and revoke connected devices.
Security and diagnostics
IP addresses, authentication events, security events and server or application logs. Crash information may be processed when supplied through a diagnostic or support flow; no third-party crash collector is asserted here.
Support information
Information you voluntarily send when asking for help, such as your message and relevant screenshots. Please avoid sending unrelated private content, passwords or device credentials.
Why information is processed — Link to section
We process information to provide and maintain Kasai Cloud: authenticate users, synchronise files, process uploads and downloads, generate requested previews, maintain sharing and manage applicable subscriptions. We also use relevant account and technical information to protect accounts, detect incidents, prevent abuse, troubleshoot problems and respond to support requests or legal obligations.
Service reliability can be improved using appropriate non-content telemetry, such as transfer failures and response times. Private file contents are not treated as general analytics data.
Ownership and limits on use — Link to section
Your Customer Content remains yours. Kasai Cloud does not sell users’ personal information. Private customer content is not used to build advertising profiles or target advertising. Kasai Cloud does not use the contents of customers’ private files to train AI models unless a future feature explicitly obtains separate, informed permission. Such permission would be optional and specific, not hidden in acceptance of these policies.
Legal bases, where the GDPR applies — Link to section
Contractual necessity applies to processing needed to supply the service you request, such as account access, storage, transfers and sharing. Legal obligations may require specific records, lawful disclosures or regulatory cooperation. Legitimate interests may support proportionate security, abuse prevention and reliability work only after considering necessity, your expectations and the impact on your rights; they do not authorise unlimited use of private content. Consent is used where legally required, including any future optional tracking or separately authorised feature, and can be withdrawn.
Who may receive or access information — Link to section
Recipients you choose can access shared material within the permissions you set. Authorised personnel must limit access to what is reasonably necessary for technical operations, security, fraud or abuse investigation, legal compliance, a lawful request or support you expressly request. This is a restriction on permitted use, not a technical guarantee: server and database operators can access data outside ordinary application permissions. Administrative logging covers selected application events, not every file view or infrastructure action; production access procedures remain subject to operational verification.
- Service providers may process information needed to operate the service, under applicable instructions and safeguards. The Subprocessors page identifies the status of the provider register.
- Authorities may receive information only on an applicable lawful basis, as described in Government & Legal Requests.
- A business transfer may involve relevant information subject to applicable law, appropriate safeguards and notice of a material change in responsibility.
How long information remains — Link to section
Retention depends on the purpose, account status, your instructions, security needs and applicable law. Exact operational schedules are still being confirmed; no fixed trash, backup or deletion deadline is promised here. Information should not be kept longer than necessary for its stated purpose.
Trash and version recovery depend on storage settings and available space, rather than a guaranteed recovery period. Log rotation by file size is not a fixed retention period. Historical database copies can contain earlier account information after active deletion. Backup expiry and independent recovery safeguards still require operational confirmation; a deletion record alone cannot guarantee that an older backup will never restore data.
- Active account information: for the service relationship and then only for necessary closure, security or legal purposes.
- Customer files: while stored for you, until you delete them or the account enters its deletion process, subject to recovery settings and lawful preservation.
- Deleted or trash content: for the applicable recovery window if enabled, then through permanent deletion.
- Server and security logs: for proportionate operational, investigation and security needs; a specific incident or legal hold can require longer preservation of relevant records.
- Support records: for handling the request and necessary follow-up or dispute resolution.
- Billing and legal records: for applicable accounting, tax, claims and other legal retention requirements, where relevant.
- Backup copies: handled separately under backup-retention procedures; a fixed expiry period is not yet confirmed. Restoring a backup must respect prior deletion instructions and any continuing legal preservation obligations.
File deletion and recovery — Link to section
You can delete files and use available trash controls. Recovery availability depends on the service configuration. Keep an independent copy of content you need before permanently deleting it.
When you delete a file
- You delete an active file.
- If recovery is enabled, it moves to trash and may be restored while it remains there.
- Permanent deletion removes the file from active storage. Versions and associated data are handled by the applicable deletion process.
- Residual backup copies are handled separately through backup-retention procedures, subject to necessary legal preservation. No fixed backup-expiry period is promised.
Account deletion — Link to section
Initiate deletion yourself in the current Kasai Cloud application under Account → Delete account; you do not need to contact support or leave the app. Download needed files first: individual file downloads are available, but there is no comprehensive account export. Confirmation disables access immediately and starts irreversible background deletion, with no cancellation or grace period. Deleting the account also removes its trash and versions rather than starting a recovery window. Removing an application from a device or cancelling a subscription is not an account-deletion request.
The app clears its managed offline copies, queued uploads and account preferences on the initiating device and reports cleanup errors separately. Already downloaded copies and disconnected devices cannot be remotely wiped by this process. A minimal deletion receipt and pseudonymous recovery marker are retained to track completion and help detect and reconcile deleted accounts during recovery; these are not a retained copy of your files. A notification address is kept encrypted only until the completion email is sent. Limited security records remain separately where justified; no blanket retention of account content applies.
When you request account deletion
- In Account settings, choose Delete account, download anything you want to keep, then confirm with your current password, a second factor when required and the word DELETE. Confirmation is irreversible; there is no cancellation or grace period.
- Access is disabled immediately when the request is accepted; sessions and device credentials are revoked. Deletion continues in a background process.
- Sharing links are revoked so they no longer provide access through the account.
- Owned active files, versions, trash, uploads and account metadata are removed. Files belonging to other people are not deleted. The saved in-app receipt shows progress, including incomplete operations being retried; completion is reported only after verification.
- Residual backup copies are handled separately under backup-retention procedures, not erased instantaneously by this process. A fixed backup-expiry period has not yet been confirmed.
- Records that must be kept by law may remain for that limited purpose. Copies already downloaded by recipients are outside Kasai Cloud’s control.
Your privacy rights — Link to section
Depending on applicable law, you can ask to access your personal data, correct it, delete it, restrict processing, object to processing where applicable, and receive portable data where the conditions are met. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. These rights are subject to applicable conditions and lawful exceptions.
- Contact privacy with the request and enough information to identify the account. We may request proportionate verification to protect it and respond within the applicable legal requirements.
- You can complain to the competent data-protection supervisory authority, including in your place of habitual residence, work or the alleged infringement where the GDPR applies.
- For files controlled by a business customer, direct rights requests to that customer; Kasai Cloud assists according to the agreed DPA and applicable law.
Processing locations and international transfers — Link to section
Provider identities and processing locations are subject to confirmation in the Subprocessors register. We do not promise that all information stays in Europe or in any particular country. Where personal data is transferred outside an area protected by applicable law, the transfer must have a lawful mechanism, such as an adequacy decision or appropriate contractual safeguards, with additional measures where necessary. You may request information about the safeguards applicable to your data through the privacy contact.
Children and people represented by others — Link to section
Kasai Cloud is not a service specifically directed at children. Users must have the capacity or valid authority required by applicable law to use it. Where a child’s consent or a representative’s authority is required, it must be valid. A parent or guardian who believes a child’s information has been provided unlawfully can contact privacy for review.
Updates and contact — Link to section
The effective date and version identify this policy. Material changes will be communicated through an appropriate service notice or account communication before taking effect where required. A policy update is not a substitute for consent where new processing requires it. Contact privacy for questions, rights requests or information about the operator.
Contact privacy
This contact channel is awaiting confirmation. Verified contact details will be published here before public launch.
Describe your request and the account concerned. Never send your password, device credentials or private files unless a secure, necessary exchange has been agreed.