Privacy Policy

1. Who are we?

downloadlink.nl is responsible for the processing of personal data as described in this statement. For questions you can reach us via Patricklankhorst@hotmail.com.

2. What data do we process?

About you as a customer:

• Contact details: name, email address, company name (via the request form).
• Account and payment data: customer number, chosen plan, payment transaction data via Mollie/PayPal (no credit card numbers).
• Usage data: log files, IP addresses, browser information, file uploads.
• Planning data: if you use the planning module, we process data about your staff — name, discipline, contracted hours, scheduled and available hours, and for hours booked outside the planning also the project and who worked on it. For the AI assistance in the planning, part of this goes including names to Anthropic in the United States: the AI weekly overview sends that data automatically shortly after you open the planning, even if you do not use the AI button; the AI planning proposal only when you ask for it. We keep the AI's response for a maximum of 30 days, so the same question does not have to be sent again. See point 6 for the recipients and the safeguards outside the EU.
• Use of the tools: when you are signed in, we keep track per account of how often you use each tool, per day — only the number, no files, file names or content. We use this to improve the tools; we delete it after 12 months, and it disappears with your account. We also count, per day, how often a pointer to the tools was shown, clicked or dismissed: the number only. To avoid counting twice, we remember for at most two days that an account has already been counted.
• AI assistants and the API: if you connect an AI assistant (such as Claude or ChatGPT) to your account or create an API key, we keep, per connection or key, the name the assistant gave or your label, the permissions you granted, when you created it and when it was last used. We store keys and tokens only as an irreversible hash. For every request from the assistant we record in our security log which connection, which request and whether it succeeded, never what you asked; we delete that log after 12 months. What a request returns, such as the titles, file names, sizes and links of your transfers, goes to the assistant you connected and so to its provider, under that provider's terms. We do not receive your conversations with the assistant. You can revoke access at any time on your account page; connections and keys disappear with your account. If a connected assistant reports to us on your behalf that something is missing or could be better, we keep that report (the type, the description and the task as the assistant wrote them, the tool, your account and the connection, without an IP address) to improve the site, and delete it after 12 months or earlier together with your account.
• Local helper: with the local helper your AI assistant runs the tools on your own computer, in your own Chrome or Edge. Your files and their names are not sent to us. We receive the link you allow yourself, what you search for in the tools and the count of a use, as on the website. If you ask the helper to share a result as a download link, that file and its name go to your account, as with any upload. You revoke the link on your account page.
• Communication: emails or support requests.
• Messages between you and us: if we write to you personally, if you ask a question through the contact form, if you reply using the button in an email from us, or if you email us at our address, we keep your email address, your name if you gave it or if it came with your email, the subject, the text and the time. We use this to handle your question and to be able to read the conversation back. We only keep text, no attachments; of an attachment to an email we only keep the file name and the size. We keep each message for two years at most; an email from someone without an account that we do not reply to is deleted after 30 days. An email to our address is also held, encrypted, for at most 72 hours on the server that receives our mail, until it has arrived with our messages; that server is located in the United States. If you delete your account, the conversations with your address are removed with it, and on request we delete a conversation sooner.
• Data you enter about others yourself: the email addresses of the recipients you send a link to, your address book (email address and name) and the names of team members you link to your account. We use the recipient addresses to send your link, to show you the status per recipient and to send any reminders; the sending runs via our email provider (see point 6). We do not use your address book or your team members for anything else. If colleagues share a single login, we keep the personal address book separate per person; a team account additionally has a shared address book that is deliberately visible to everyone on that account. You decide who you write to; we process this data on your instructions. Recipient addresses remain for as long as the package exists: if it expires or you delete it, they go with it. Your address book and your team members remain until you erase them or delete your account.
• Verification of recipients: if you switch on the verified-recipient option for a package, we send that recipient a code by email. In doing so we keep their email address, the IP address from which the code was requested and confirmed, and the time of confirmation. We do not keep the code itself, only an irreversible encrypted imprint with which we can check a code that is typed in. This is precisely the proof you switch the option on for: in your overview you can see per recipient whether and when they verified themselves, and the proof of delivery (pdf) also states the IP address. Codes that are not used are erased 7 days after they expire; the rest disappears together with the package.
• Advertising attribution: if you arrived via a Google advert, we store the click ID (gclid) and the time to measure which advert works. With a free sign-up, while the sign-up is in progress, that click ID sits in the same record as your email address and IP address; we delete that record no later than seven days after the sign-up has been completed or has expired. With a paid sign-up, it is stored with your request. After that we keep it with your account, so that we can measure whether the click brought in a paying customer; 90 days after your sign-up we delete it there and from the request. We manually export only the click ID, the type of measurement (sign-up or payment) and the time to Google Ads, without an email address; we delete those records after 90 days as well. We set no cookies for this and load no third-party advertising or tracking scripts: during your visit, our own page code remembers the click ID in your browser's session storage, and that disappears as soon as you close the tab.
• VPN: if you use the VPN, we store for each device you connect the name you give it, the type of device, the public key or user name it connects with, the internal VPN address it gets and when you connected it. We do not store a device’s secret key or password. Whether a device is connected right now is read from the server at the moment you open the VPN page; we do not store that. We keep no traffic data: not which websites you visit, not when you were connected and not from which IP address. Your traffic goes onto the internet with the IP address of our VPN server. If you revoke a device, it disappears from our database within 30 days; a block for abuse is kept for as long as your account exists.
• Remote VPN switching: if you install the on/off switch on a Windows PC, that PC checks in with us every minute, so you can also turn its VPN on and off from another device. We only keep the latest check-in: when it was and whether the VPN on that PC was on or off, plus your latest request (on or off) and what the PC reported back. We do not store the PC's IP address for this. If you revoke the device, this is deleted too.
• Tor-surfen: if you use this module, we record when a session starts, and when you or we end it, the time, your account, the IP address and user agent of the request, and the place the session ran on. We do not store which sites you visit or what you enter. The module’s server keeps a short technical line per request (method, path and status code, without your account name and without what you visit) that disappears after fourteen days; the details of starting and ending are in the security log and disappear after at most a year. The session itself, the browser with everything in it, is erased when you end it, after three minutes without a heartbeat from your page, or at the end of the session time. Because the browser runs on our server, we can technically look in; we do not do so, except for the security of the service and during an investigation into abuse.
• TV player and music tool: with an account we store your playlists (encrypted), favourites and where you stopped watching, so they are ready on every device. If you use our server to play something with a free account, we only keep, per account and per day, how many minutes you used; no channels, addresses, viewing behaviour or IP address. That counter disappears after two days. Your browser fetches the iptv-org list and the streams it plays directly from the source itself; we are not involved in that. With a subscription the music tool plays radio and music through our VPN server (except your own music server and casting): that server then sees the address of the station or track in order to fetch it, but does not store it.
• Fault reports from the TV player: with a subscription the TV player automatically reports a fault (an error message, a stream that drops, a script error) to us, unless you turn this off under 'Storingen automatisch melden' (report faults automatically). The music tool reports stalls and a radio stream that drops in the same way, without the name of the station. Such a report contains a short description and technical data: browser and platform, the chosen route, the name of the server of the source (not the full address), the state of the stream, the latest stalls and how long it had been playing; no login details and no titles. We keep reports for 30 days per account. A short summary with your account number (without browser and platform) is also kept in the technical log of our hosting provider Render and disappears there after at most 30 days. With a free account the player reports nothing.

About the people you share with — recipients, signers, submitters and visitors to a portal. We record this data as a result of your use of the service, and you largely see it yourself: together it forms the proof that something arrived or was signed. To that extent we act on your instructions — so inform your recipients about this yourself. In addition, we use the same records to keep the service secure and available (abuse and overload detection); for that we are responsible ourselves.

• Download records: for everyone who opens a download page or retrieves a file, we record the date/time, IP address and browser information. As the sender, you see the downloads in full — including the IP address — on your package's activity page, in the CSV export, on the proof of delivery (PDF) and via the API. We keep these records for a maximum of 12 months.
• Recipients' email addresses: if you send a package by email, we store to whom, when this first happened and when it last happened (in the case of a reminder). The address and the first send also appear on the proof of delivery. Disappears as soon as the package itself is gone. Each recipient gets their own link, so as the sender you can see per recipient whether and when they downloaded the package; we do not store any extra IP address for this.
• Verification by email code: if your package has a code on it, we keep the email address, the time and the IP address of the recipient who requested and entered the code. A successful verification (address, time, IP) appears on the proof of delivery — that is its compliance value. Disappears as soon as the package is gone; a code that was never used, no later than 7 days after it expires.
• Signing: for a signature request we record the signer's name, email address, time, IP address and device/browser. These are printed on the signing certificate in the PDF document itself — that is what gives the signature its evidential value. You can withdraw an outstanding request; the request then remains in your overview and disappears with your account.
• Submissions via an inbox link: name, email address, message and IP address of the person uploading files to you. A submission that was never completed is erased after 48 hours. A completed submission remains in your overview — even if you revoke the link — and disappears with your account.
• Visits to a client portal or shared folder: for each view, download, request and comment the time, IP address and browser information, visible to the owner of the portal. After 30 days only the network part of the IP address remains and we erase the browser information; the record itself (time, action, file) is kept for at most 12 months.
• Blocked download attempts: if a download is stopped because a download limit has been reached, we record the reason, the IP address and the browser information. We do this to detect abuse and overload; the administrator of your workspace can see it in the insights dashboard. A maximum of 12 months.

From people who report something – if you report unlawful content or abuse, we keep your name (if you gave one), your e-mail address, the report itself (the place and your explanation), the time and our decision. We use this to handle the report and to inform you. Basis: legitimate interest (preventing abuse) and, where the law requires it, a legal obligation.

3. What do we use this data for?

• Performance of the agreement (hosting & file exchange, invoicing, support).
• AI functions in the service: the cover letter the recipient sees with your package, text recognition of a scan (OCR), the automatic reading of receipts and invoices you import into the bookkeeping module, and, in the weekly planner, the weekly summary and the scheduling proposal. The relevant content is sent to our AI processor Anthropic in the United States: the file names and part of the contents of your package, the scanned page, the receipt or invoice, or planning data with names, disciplines and hours (see point 6). This happens as soon as you use the function; in addition, the weekly summary is prepared in advance shortly after you open the planner, even without you asking for it. We keep nothing from a scan, the cover letter belongs to the package and disappears with it, what the AI reads from a receipt ends up in your own records, and the weekly summary and the scheduling proposal are kept in a temporary cache that is cleaned up whenever a new AI result is added — anything older than 30 days is then removed.
• Security and availability of the service (monitoring, abuse detection).
• Legal obligations (administration, tax rules).
• Contact and customer service.
• Download statistics for the sender (knowing whether and when a package was collected).
• Measuring which ad or entry point led to a sign-up (aggregated, cookieless).

4. On what legal bases?

• Performance of an agreement (service provision and payments).
• Legal obligation (record-keeping requirement).
• Legitimate interest (security, abuse prevention, business communication).

5. How long do we keep data?

We do not keep personal data longer than necessary. Administrative and invoicing data: 7 years (statutory retention obligation). Account and usage data: no longer than 12 months after the service ends, unless a longer period is required by law.

In concrete terms: files and packages disappear automatically on the expiry date chosen by the sender. If you delete your account, it is deactivated immediately and your download links stop working straight away. Within 30 days we permanently erase your files and account data; only invoicing data (7 years, statutory retention obligation) and security logs remain. Your data then disappears from our daily database backups within 14 days: these are kept on our server at Render and as a copy at Backblaze B2, expire automatically and are used solely to recover after an outage. Usage and visit data containing date/time, IP address and browser information — downloads and view-in-browser, blocked download attempts, visit statistics, visits to a shared folder, sent notifications and linked devices — we retain for a maximum of 12 months, advertising-attribution data for 90 days, and security logs (who logged in and when) for a maximum of 12 months.

Some of the data is inextricably tied to a delivery, a signature or a submission. These have no fixed retention period: they remain for as long as the package, the document or your account exists. This applies to:

• Review records for a file shared for review — who opened it and when, with IP address and browser information. This is the evidence that a review actually took place, so we do not clear it after 12 months. It disappears as soon as you delete the package, and when you delete your account.
• Verifications with an access code — the email address and IP address of a recipient who entered a code. This is needed for the proof of delivery and remains as long as the package exists; for a package without an expiry date, therefore, until you delete it yourself. Codes that no one has used are erased 7 days after they expire.
• Signing records — for a digitally signed document we record the signer's IP address and browser information. These belong to the signature and are retained for as long as your account exists. Withdrawing a request or letting it expire only changes the status; it does not delete this data.
• Submissions via an upload link — for a completed submission we store the submitter's IP address, so that the submission remains visible to you. That data remains for as long as your account exists. Submissions that stall partway through disappear automatically after 48 hours.

If you use the planning tool, our AI assistant automatically creates an AI weekly overview shortly after you open it, and a planning proposal at your request. We keep that output — including the names it contains — for a maximum of 30 days in our own database, so that if the data is unchanged, a new text does not have to be fetched from our AI supplier each time; after that we clear it. This output does not belong to a package and therefore does not disappear along with it when a package expires; an AI covering letter does belong to that package and disappears together with it.

Reports about unlawful content or abuse (name, e-mail address, report and decision): two years at most after they have been dealt with.

Messages between you and us (what we write to you personally, your question through the contact form, your reply using the button in an email from us and an email to our address): each message for two years at most, text only and no attachments; an email from someone without an account that we do not reply to, 30 days.

6. Who do we share data with?

We engage these sub-processors — they process solely on our instructions, under a data processing agreement:

• Render — application hosting. The public downloadlink.nl service (application and database) runs in Frankfurt (EU). We back up the database every night; we keep those backups for 14 days, on the server itself and as a second copy in the object storage below. A bespoke environment on its own subdomain may, by agreement with that customer, run in another region, including outside the EU; this is then recorded with that customer and never applies to the public service. Email that comes in to us (to our addresses or as a reply to an email from us) is received and processed on a second service of ours at Render in the United States (Oregon).
• Backblaze B2 — object storage of your files (EU Central, Amsterdam).
• Brevo — transactional email (welcome, notifications, password reset).
• Cloudflare — the network and security layer in front of the website (CDN/DDoS protection) and the pass-through for part of the downloads. The first three downloads of a transfer come straight from storage, and after that too as long as the free download traffic our storage provider gives us each month has not run out. Beyond that, and for the other downloads (such as from a shared folder), the file travels to the recipient via Cloudflare's network, through the server closest to them — and that server may be outside the EU. Cloudflare does not keep the files and does not cache them. One exception to those first three: if the recipient's browser cannot build a zip of several files itself, our server in Frankfurt builds that zip, and it then also goes via Cloudflare. Uploading a package goes straight from your browser to storage; smaller files you upload within the app itself also pass through Cloudflare on the way in.
• Hetzner — the VPN server (Falkenstein, Germany). If you use the VPN, your internet traffic travels encrypted to this server and goes onto the internet there; we keep no traffic data on the server.
• The Tor-surfen server — a dedicated server, hosted by Hetzner, on which the module’s Tor browsers run. If you use the module, your traffic leaves that server through the Tor network; we do not store on the server what you visit.
• Anthropic (United States) — the AI behind our AI features. Transfers outside the EU take place under EU standard contractual clauses. Below you will find, per feature, exactly what is sent.

What goes to the AI? Only what the function in question needs, and only for these three functions:

• Covering letter — the tick box when uploading. What is sent: the names of all the files in the package, plus a few of the smallest PDFs from it, truncated to their first pages. The text that comes back is stored with your package and disappears together with that package.
• Recognise a scan (OCR) — the page itself is sent as an image. You get the text back immediately; we keep none of it.
• AI assistance in the planning tool — the weekly overview and the proposed work distribution. What is sent: the names of employees, their discipline, their free and booked hours, and the project numbers, service names and hour-type names they work on. Please note: the weekly overview is prepared in advance shortly after the planning tool is opened, so even without you clicking on it. We keep the answer in a cache for a maximum of 30 days, so that the same question does not have to go to the AI a second time.

Outside these features, nothing of yours goes to the AI: files you simply send are not read by an AI.

In addition, the following parties are independent controllers; they process under their own privacy terms:

• Mollie and — for existing subscriptions —PayPal, for processing payments.
• Google, Microsoft of Facebook, if you choose to "sign in with" one of these accounts. They will then see that you are signing in with us; we receive from them your email address and whether they have verified that address (Facebook also sends along your name and user ID, which we do not store). We never see your password with that party. If you do not yet have an account with that email address, a trial account can be created with it straight away. You can see which of these buttons are enabled on the login page.
• Google, if you arrived via a Google advert: cookieless conversion measurement in which we pass on only the click ID, the time and the name of the step (for example "trial account created"), so no name or email address. We retain that data for 90 days.

We never sell your data and use no advertising or tracking cookies.

With the AI functions, data is processed outside the EU. On downloadlink.nl this concerns the cover letter you can tick when sending, and the recognition of text in a scan (OCR) in the PDF tools. On business environments where we offer them, this is joined by the weekly overview and the scheduling proposal in the planner, plus the checking of submitted documents, the quotation assistant and the text suggestions in a Word document.

What is sent along is what the feature needs: for the covering note, the names of the files in your package and the first pages of at most three PDFs from it; for OCR, the image of the page you have recognised; and for the planning, the names of employees, their discipline and their hours. That data goes to Anthropic in the United States, which processes it solely on our instructions, under a data processing agreement and with EU standard contractual clauses for the transfer. This only happens when you use such a feature; if you do not use it, your files and planning data are not submitted to an AI.

We keep the output of the planning AI for a maximum of 30 days in a temporary cache, so that the same overview does not have to be recalculated each time. For the other parties mentioned above, too, where they process outside the EU we ensure appropriate safeguards such as EU standard contractual clauses.

7. Cookies

We use functional cookies only — no advertising, analytics or tracking cookies, and therefore no cookie banner either. Here are all three of them:

• A session cookie to keep you logged in. In it we also store the security token that protects forms against abuse (CSRF); so that is not a separate cookie. The cookie disappears as soon as you log out, and expires after 12 hours in which you do not use the site (in the Downloadlink app for iPhone and Mac this is 30 days). If you are not logged in, it disappears as soon as you close your browser. If you open a link from an email as a recipient, this cookie remembers a random code from that email for 12 hours, so the sender can see that you downloaded the package. The code does not contain an email address.
• A language cookie (dl_lang, 180 days) that we only set if you choose a language yourself, so that the site opens in that language straight away next time.
• A device cookie (mt_device_id, around 2 years, renewed on each visit) that we set as soon as you open the planning. It remembers who works on that device, so that changes are linked to the right person — necessary because colleagues often share a single login.

In addition, we store a few preferences in your browser's local storage, for example which person you are in the planning tool and the email address on which you want to receive notifications. This is not a cookie: that data stays on your own device, is not automatically sent to the server and is not used for tracking. You can erase it by deleting the site data in your browser.

In the Downloadlink app (iPhone, iPad and Mac) the built-in web view keeps the same cookie and local storage as the site. Downloaded files are kept temporarily in a folder of the app and deleted after a day. Only the iPhone app contains a component from Google for casting to a Chromecast; measurement by that component is switched off.

8. Your rights

You have the right to:

• Request access to your personal data.
• Request correction or erasure.
• Object to processing or request restriction of it.
• Request data portability.
• Lodge a complaint with the Dutch Data Protection Authority.

You can send requests to Patricklankhorst@hotmail.com. We respond within 30 days.

9. Security

We take appropriate technical and organisational measures to protect personal data against misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification.