How do we process and protect your data and files?

Protecting your data and privacy is one of our highest priorities. We design our services to keep your data secure while only processing the information needed to provide, improve, and protect our services.

How do you protect my files?

Your files are protected throughout their lifecycle:

• Files are encrypted during transfer using TLS 1.2 or TLS 1.3.
• Files are encrypted at rest using AES-256.
• Files can only be accessed through the unique transfer links provided to the sender and recipients.

To help maintain our security standards, we:

• Base our information security program on the ISO/IEC 27001 standard and maintain ISO/IEC 27001 certification.
• Perform regular penetration testing of our applications and infrastructure.
• Continuously monitor for known vulnerabilities using automated vulnerability management tools.
• Operate a Responsible Disclosure program for security researchers.
• Work with trusted infrastructure and payment providers, including AWS and Stripe.

Our certifications and related documentation are available in our Trust Center.

Do you look at my files?

No. Your files remain your content.

We do not review the contents of your transfers unless:

• you have explicitly given us permission to use transfer data for research and product improvement;
• we need to investigate a suspected violation of our Terms of Service or applicable laws; or
• we are required to do so to meet our legal obligations.

If you choose to participate in transfer research, you can opt in through the consent prompt or manage your preference at any time in Settings → Profile & Security → Data Processing. You can revoke your consent at any time, and we will no longer access your past or future transfers for this purpose.

What personal information do you process?

We process only the personal information necessary to:

• provide and maintain our services;
• secure our platform and prevent abuse;
• improve our products;
• communicate with you when needed; and
• comply with legal obligations.

We do not sell your personal information.

For full details about the information we collect and how we use it, please see our Privacy & Cookie Statement.

How long do you keep my data?

Retention depends on the type of data and the service you use.

User content

Your transferred files are automatically and permanently deleted:

• within 48 hours after the selected expiration date if the transfer is not Recoverable; or
• within 1 year after expiration if Recoverable is enabled,

unless you delete them earlier.

Personal information

We retain personal information only for as long as necessary to:

• provide our services (such as maintaining your account);
• operate and secure our platform;
• comply with legal obligations (for example, retaining financial records where required);
• respond to legal requests; and
• resolve disputes.

If we process personal data on behalf of your organization, we retain it according to our agreement with that organization and applicable law.

Where content or accounts are associated with suspicious, infringing, or illegal activity, we may retain limited information for a limited period to help protect our users, investigate reports, and comply with applicable laws, including the EU Digital Services Act.

Where do you store my files?

To provide fast and reliable transfers, WeTransfer stores files in both the EU and the US.

If you upload from the European Union using a European IP address and are not using an anonymous proxy, your files are stored in the EU. Otherwise, they are stored in the US.

Privacy and compliance

WeTransfer is based in the Netherlands and operates under European data protection laws, including the GDPR.

We have a dedicated Data Protection Officer who oversees our privacy program and helps ensure our practices remain compliant with applicable privacy legislation.