Privacy Policy

This Privacy Policy explains how Saffna ("Saffna," "we," "us," or "our") collects, uses, shares, and protects information when you use saffna.com, our related applications, and services (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

This policy applies to:

• Workspace users who create accounts, create file requests, invite clients, and manage submissions.
• Clients who open a request link and upload files without creating a Saffna account.
• Visitors to our marketing pages and people who contact us or report abuse.

If you use Saffna on behalf of an organization, your organization may control additional policies for how your workspace data is handled.

Account and workspace information. When you sign up or sign in, we receive identity and authentication data through our authentication provider (Clerk), such as your name, email address, profile details you provide, and authentication metadata. We also store workspace settings, request configuration, invitation details, and activity related to your use of the Service.

Client and submission information. When a client uses a request link, we may collect the information your request asks for (for example, name or contact fields you configure), uploaded files, and submission metadata such as timestamps, request identifiers, and delivery status.

File content. Files uploaded through the Service are stored so we can scan them, show them to the requesting workspace, and deliver them to destinations you configure (such as your Saffna inbox or a connected Google Drive folder).

Communications. If we send invitation or notification emails, we process email addresses and delivery-related events (for example, sent, delivered, bounced, or failed) needed to operate those messages.

Integrations. If you connect Google Drive, we receive tokens and permissions needed to deliver accepted files to folders you select, plus related delivery status information.

Usage, device, and log data. We automatically collect technical information such as IP address, browser type, device information, pages or endpoints accessed, referring URLs, and timestamps. We use this for security, reliability, abuse prevention, and product improvement.

Support and abuse reports. If you contact us or submit an abuse report, we collect the content of your message and any details needed to investigate.

We use information to:

• Provide, operate, maintain, and improve the Service
• Authenticate users and secure workspaces
• Create and manage file requests, invitations, submissions, and delivery
• Scan uploaded files for malware and enforce file-type and safety controls
• Send transactional emails related to invitations and submission activity
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Respond to support requests and abuse reports
• Comply with legal obligations and enforce our Terms of Service
• Analyze aggregated or de-identified usage to understand how the Service is used

We do not sell personal information.

Uploaded files may be scanned for malware (including with ClamAV), checked against blocked file types, and evaluated against known-bad hashes or similar controls. Infected or rejected files are blocked from reaching a workspace inbox as accepted submissions.

Scanning reduces risk but does not guarantee that every malicious or unwanted file will be detected. Workspace users remain responsible for how they handle files they choose to download, open, or forward.

We share information only as needed to operate the Service or as described below:

• Service providers. We use vendors to host infrastructure, authenticate users, store files, send email, and support security and operations. These providers process data on our behalf under contractual obligations.
• Google Drive. If you connect Google Drive and choose Drive delivery, accepted files and related delivery data are sent to Google using your connected account and selected folder.
• Workspace access. Submission content and metadata are available to authorized members of the requesting workspace according to workspace permissions.
• Legal and safety. We may disclose information if we believe it is reasonably necessary to comply with law, respond to lawful requests, protect rights and safety, or investigate abuse or security issues.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

Common categories of processors include authentication (Clerk), cloud hosting and object storage (such as AWS S3), email delivery (Resend), and malware scanning tooling.

When a client uploads files to a workspace request, the workspace organization is generally the party deciding why that information is collected. Saffna processes that information to provide the Service to the workspace.

Clients should only upload information they are authorized to share. Workspace users should only request information they are authorized to collect.

We and our providers may use cookies, local storage, and similar technologies for authentication, session management, security, and basic product functionality. Some of these technologies are essential to operate the Service.

We retain account, workspace, request, submission, and file data for as long as needed to provide the Service and for legitimate business purposes such as security, dispute resolution, backups, and legal compliance.

Workspace users may delete requests, submissions, or related content according to product controls. Residual copies may persist for a limited time in backups or logs before automatic deletion.

Rejected or blocked uploads may be retained briefly as needed for security review, abuse prevention, and operational integrity, then deleted according to our retention practices.

We may process and store information in the United States and other countries where we or our providers operate. Those locations may have different data-protection laws than your home jurisdiction. Where required, we use appropriate safeguards for cross-border transfers.

We use administrative, technical, and organizational measures designed to protect information, including access controls, encrypted transport where appropriate, private file storage, and malware scanning of uploads.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and for configuring requests and destinations carefully.

Depending on your location and role, you may have rights to:

• Access personal information we hold about you
• Correct inaccurate information
• Request deletion of personal information
• Object to or restrict certain processing
• Request a copy of information in a portable format

Workspace users can often manage or delete workspace content directly in the product. Clients who submitted files through a request link may need to contact the workspace that collected their submission, or contact us so we can help route the request.

To exercise privacy rights, email privacy@saffna.com. We may need to verify your identity before responding. We will not discriminate against you for exercising rights available under applicable law.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

The Service may link to or integrate with third-party services such as Google Drive and authentication providers. Their privacy practices are governed by their own policies. We are not responsible for third-party practices outside our control.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date. Material changes may also be communicated through the Service or by email when appropriate. Continued use after an update means you accept the revised policy.

For privacy questions or requests, contact privacy@saffna.com.

To report misuse of the Service, use our abuse report form or email abuse@saffna.com.