Privacy policy

Misi.Link is for sending files. We only collect what is needed for that, we never sell any data and we do not use your files. This page explains, in plain words, what we process, why, for how long and what your rights are.

Who is responsible for your data?

The data controller is MisiLab, 20 square du pont de Sèvres 92100 BOULOGNE BILLANCOURT, publisher of Misi.Link (see the legal notice).

For any question about your data: the Contact page or contact@misiraca.com.

What data, and why?

When you send files

• The files, their names and sizes, the optional message, the availability period and, if you set one, the password (stored encrypted, never in plain text).
• Your email address as the sender: for an email transfer (your recipients see who is writing to them) and to send you the confirmation, the link and the deletion link.
• Your recipients’ addresses (email transfer), to send them the link.

• The IP address of the upload, to apply usage limits and fight abuse.

Why: to provide the service you ask for (performance of the contract) and keep it secure (legitimate interest: spam, illegal content, fraud).

When your files are downloaded

The date of the download, the recipient’s address for an email transfer and, where applicable, their IP address: to notify the sender, apply self-destruct after download and detect abuse.

End-to-end encryption

Your files are encrypted in your browser before they are sent: we store unreadable content and cannot open it. For a link transfer, the key is in the link itself and is never sent to us, unless you ask to receive the full link by email: it is then entrusted to us just long enough to send that email, and erased. For an email transfer, the key is kept in sealed form so that your recipients get a working link. The links of your latest transfers, keys included, are kept only in your browser.

Verifying your address

Without an account, a 6-digit code is sent to your address the first time (then again after 30 days or on another browser), so that nobody can send files in your name. The code is stored encrypted and expires after 15 minutes.

Your account

Your account is created when you first sign in, or automatically when you send files with an address verified by code: your transfers are then saved in it. It contains your email address, your name if you provide it, your plan, the history of your transfers, your recipient address book and, for paid plans, your logo, colour and background image. You sign in with a code or a link received by email: we do not store any account password. You can ask for it to be deleted at any time.

Payment

Payments are processed by Stripe. You enter your card number with Stripe: we never see or store it. We only keep the Stripe customer and subscription identifiers, the subscription status and, for invoices, the information required by law (name, address, VAT number if any).

Why: performance of the contract and accounting and tax obligations.

News by email

Account holders receive news and offers from Misi.Link, as stated when the account is created. We keep your address, your language, and the date and source of the subscription. Every email contains a one-click unsubscribe link, and you can also unsubscribe from My account; an unsubscribed address is never automatically re-subscribed.

Why: our legitimate interest in keeping you informed about a service you use; you can object at any time, without having to give a reason.

Contact and reports

When you write to us or report content: your message, your email address (optional for a report), your name if you provide it and the type of browser used, in order to reply and handle the request.

We do no profiling and make no automated decisions about you, and we do not look at the content of your files, except when illegal content is reported and we are required to act.

For how long?

• Files: deleted automatically on the expiry date you chose, or as soon as you delete them (or after the first download if you chose self-destruct).
• Information about a finished transfer (file names, addresses, download log): deleted 12 months after the end of the transfer.
• IP addresses: removed from the logs after 12 months.
• Verification and sign-in codes: deleted at the latest one hour after they expire.

• Account: kept for as long as you use it; deleted on request. When a paid subscription ends, the account’s transfers are deleted (the account returns to the free plan), as announced when subscribing.
• Invoices: 10 years, as required by law.

• News subscription: until you unsubscribe; the record of your subscription and unsubscription is kept for 3 years as proof; after that, only an irreversible fingerprint of the address is kept, so that it is never re-subscribed automatically.

• Contact messages: 2 years. Reports: 3 years.

Who has access?

Only the Misi.Link team has access to the data, to run the service. We never sell or rent any data. We use technical service providers, who act only on our instructions:

• Website hosting: IONOS
  Regus Pont de Neuilly, 191-195 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France
• File storage: Equinix PA3 - 114 rue Ambroise Croizat 93200 Saint-Denis France
• Email delivery: our email delivery provider

• Payment: Stripe Payments Europe Ltd. (Ireland)

Data may be disclosed to the authorities only where the law requires it (court order).

Does your data leave Europe?

Your files are stored in data centers located in France, with the storage provider listed above: they do not leave the European Union.

Stripe may process some payment data in the United States; these transfers are covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Cookies and storage in your browser

The site only uses cookies that are necessary for it to work, which do not require your consent:

• mlsess: session (sign-in, form security); deleted when the browser is closed.
• ml_sv: sender address already verified, so that the code is not asked again for 30 days.

Your browser also keeps, locally, your cookie banner choice, whether you have seen the guided tour, the links of your latest transfers (with their encryption keys) and what is needed to resume an interrupted upload. This information stays on your device and is never sent to us; you can erase it by clearing the site’s data in your browser.

Any audience measurement or advertising tools are loaded only after your consent, given in the cookie banner, and never on pages that contain an encryption key. You can change your mind at any time with the “Cookies” link at the bottom of the page.

Security

All connections are encrypted (HTTPS). Download links are long and random and are not indexed by search engines. Transfer passwords and codes are stored encrypted. Administration is restricted to the team, with sign-ins limited against repeated attempts.

With end-to-end encryption, even in the event of unauthorised access to the storage, the content of the files remains unreadable.

Your rights

You can at any time request access to your data, its rectification, erasure or portability, or the restriction of its processing, object to processing based on our legitimate interest and withdraw your consent (news by email). You can also give instructions on what happens to your data after your death.

To exercise these rights: the Contact page or contact@misiraca.com. We reply within one month. We may ask you to prove that the address concerned is yours.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL): www.cnil.fr, or with the authority of your country.

Minors

The service is not intended for children under 15 without their parents’ consent.

Changes

This policy may change along with the service. The date of the last update is shown at the top of the page; in the event of a significant change, we will inform you on the site or by email.