1. Overview
This Privacy Policy describes how VIP Blocks, LLC("WebUploads," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information in connection with our websites (including www.webuploads.com and related subdomains), applications, APIs, upload and download links, and related services (collectively, the "Services").
By accessing or using the Services, you acknowledge this Privacy Policy. If you do not agree, please do not use the Services. If you use the Services on behalf of an organization, you represent that you are authorized to accept this policy on that organization's behalf.
Core principles. We aim to collect only what we need to provide and improve the Services; to be transparent about our practices; to protect customer files as confidential business information; to reserve the ability to review content when we receive reports of abuse or illegal activity; and to give you meaningful choices where applicable. We do not sell personal information for money or other valuable consideration as described in Section 6.
2. Scope
This policy applies to personal information we process as a business operating the Services.
- Where you are a customer, team member, or account holder of WebUploads. We process personal information as described here to provide accounts, product features, support, security, and billing.
- Uploaders and download recipients.People who use a customer's upload request link or download link without creating an account may still provide personal information (for example, IP address, device data, or files they choose to submit). That processing is described here as well.
- Customer Content.Files, folders, filenames, file metadata, upload and download link configurations, messages or notes associated with transfers, and similar materials you or users of your workspace submit to the Services ("Customer Content") are primarily governed by your agreement with us and, where applicable, by your organization's instructions. We treat Customer Content as private to you and your organization except as needed to operate, secure, troubleshoot, and improve the Services; to investigate abuse or illegal activity; as required by law; or as otherwise described in this policy and your service agreement.
- Third-party services.The Services may link to or integrate with third-party products (for example, payment processors or analytics tools). Those parties' privacy practices are governed by their own policies. We encourage you to review them.
This policy does not apply to processing we perform solely as a service provider / processor on behalf of an enterprise customer under a separate data processing agreement, except to the extent that agreement incorporates these terms.
3. Information we collect
We collect information in three main ways: you provide it, we collect it automatically, and we receive it from others.
3.1 Information you provide
- Account and profile data, such as email address, organization or workspace identifiers, role or team membership, subdomain preferences, and authentication-related data for passwordless sign-in (for example one-time passcodes (OTPs), verification status, and session tokens, but not account passwords, which we do not use).
- Billing and commercial data, such as billing contact details, plan selection, tax identifiers where required, and transaction history. Card numbers and other sensitive payment credentials are collected and processed by Stripe via Stripe-hosted Checkout (and related Stripe payment services); we typically receive tokens, last-four digits, card brand, billing status, and similar limited payment metadata rather than full card numbers.
- Customer Content: files and other materials uploaded to the Services (including via public or semi-public upload request links), folder structure, filenames and content types, sizes, checksums or similar integrity data where used, link settings (expiry, limits, passwords if offered), and related transfer metadata.
- Team and collaboration data: invitee email addresses, roles, acceptance status, and activity associated with shared workspaces.
- Communications: messages you send to support or other channels, including attachments and feedback, and abuse or legal reports you submit about content on the Services.
- Surveys and events: information you choose to provide in research, waitlists, webinars, or marketing forms.
3.2 Information collected automatically
- Device and log data: IP address, browser type and version, operating system, device identifiers, language, referring URLs, pages or features viewed, timestamps, request paths, and diagnostic or error logs.
- Usage and performance data: product interactions (for example uploads, downloads, link creation, storage usage), feature usage, latency and reliability metrics, crash reports, and similar telemetry that help us operate and improve the Services.
- Link and transfer telemetry: when someone opens an upload or download link, we may record access times, success/failure of transfers, approximate volume, and technical signals needed for security, quotas, and analytics dashboards.
- Cookies and similar technologies: as described in Section 9.
- Approximate location: derived from IP address or similar signals (for example, city- or region-level), used for security, localization, analytics, and compliance.
3.3 Information from third parties
- Payment processors. From Stripe: confirmation of payment status, customer and billing identifiers Stripe shares with us, limited payment method metadata, receipts, refunds, and fraud-prevention or risk signals.
- Infrastructure and security providers: technical and operational data from our hosting and edge providers (primarily Cloudflare) as needed to deliver, protect, and measure the Services.
- Referrers, partners, and advertising platforms: campaign or referral parameters, conversion events, and similar marketing attribution data where you interact with our ads or partner links.
- Public or commercial sources: limited business contact information from publicly available sources or reputable data providers when we conduct B2B outreach, where permitted by law.
- Reporters and authorities: information provided in abuse reports, takedown notices, or lawful requests that may identify accounts, links, or Customer Content.
4. How we use information
We use personal information for the following purposes:
- Provide and fulfill the Services: create and manage accounts; authenticate and authorize users; store, transfer, and deliver files; generate and honor upload request links and short download links; support team workspaces and subdomains; process subscriptions; enforce storage and plan limits; and deliver the features you or your organization request.
- Troubleshoot and support: diagnose bugs, respond to tickets, restore access, investigate delivery failures, and maintain service reliability.
- Secure the Services and combat abuse: detect, prevent, and respond to fraud, unauthorized access, spam, malware, phishing, copyright or other rights infringement, child sexual abuse material, and other harmful or illegal activity; enforce our terms; and protect WebUploads, our users, and the public. This may include reviewing Customer Content as described in Section 8.
- Improve and develop the Services: analyze usage and performance; understand feature adoption; fix defects; and design new capabilities. We may use aggregated or de-identified insights for product improvement. We do not use Customer Content to train public generative AI models for unrelated third parties without a separate agreement authorizing that use.
- Communicate with you: service notices, security alerts, administrative messages, product updates, billing notices, and, where permitted, marketing communications, delivered via our email providers (primarily Cloudflare Email Sending, with Twilio SendGrid as backup). You may opt out of marketing emails as described in Section 14.
- Personalize and measure experiences: remember preferences, measure campaigns, attribute referrals, and understand how marketing channels perform (including cookies and analytics technologies described below).
- Comply with law and protect rights: meet legal, tax, accounting, and regulatory obligations; respond to lawful requests; establish, exercise, or defend legal claims; and enforce our agreements.
- Business operations: analytics, planning, audits, corporate transactions (see Section 6), and other legitimate business purposes consistent with this policy.
Where required by applicable law (for example, in the EEA/UK), we rely on one or more legal bases such as performance of a contract, legitimate interests (balanced against your rights), consent where we request it, and legal obligation.
6. Sale of personal data and business transfers
We do not sell personal information.We do not sell, rent, or lease your personal information to third parties for their independent marketing or commercial exploitation. We do not sell Customer Content or user files as a data product. We also do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) for cross-context behavioral advertising for monetary or other valuable consideration, except to the limited extent that certain advertising or analytics cookies could be interpreted as "sharing" under some state laws, in which case we will honor applicable opt-out mechanisms and disclosures as we implement them.
Business transfers and change of control. We may sell, transfer, or otherwise dispose of some or all of our business or assets, including a sale of the WebUploads platform, a sale or transfer of all or substantially all assets of VIP Blocks, LLC, or a merger, acquisition, financing, reorganization, or bankruptcy involving VIP Blocks, LLC. In those transactions, personal information and Customer Content associated with the Services may be among the assets transferred to the acquirer or successor, subject to appropriate confidentiality and continued use consistent with this Privacy Policy (or a successor policy providing at least comparable protections, with notice where required by law). If a transfer would materially change how your personal information is processed in a way that is less protective, we will provide notice and any choices required by applicable law.
This section is intended to make clear that while we do not sell user data as a product, a future sale or transfer of the WebUploads platform and/or VIP Blocks, LLC (or its assets) may include the personal information and Customer Content we hold as part of operating the business.
7. Customer content and file privacy
Customer Content, including the files customers store and transfer through WebUploads, is central to the Services. We process it to store, retrieve, transmit, and (where you enable links or team access) share it through the Services. Our practices emphasize:
- Confidentiality. We treat Customer Content as confidential and do not use it for advertising or sell it to data brokers.
- Access limitation. Routine human access by WebUploads personnel is limited to what is reasonably necessary for fulfillment, security, troubleshooting, abuse investigation (Section 8), legal compliance, and product improvement workflows that require it, under internal access controls and confidentiality obligations.
- Encryption and key custody. Files at or under 100 MB are encrypted in the browser by default before upload. In the default managed mode, WebUploads wraps and holds the envelope keys, so we can decrypt managed file contents where reasonably needed to operate the Services (for example delivering authorized downloads, support, security, abuse investigation under Section 8, and legal compliance). If an upload request link uses an optional custom key, we never receive or store that key and cannot read the file payloads encrypted under it; a lost key makes those files unrecoverable. Filenames, file sizes, mime types, and notes uploaders attach to transfers are not encrypted; uploader notes are stored and visible as cleartext.
- Your controls. Workspace permissions, link settings (including expiry and other limits), and team roles help you manage who can upload or download content. You remain responsible for configuring access appropriately and for the legality of content you store or distribute.
- Transparency. If we must access Customer Content for support, we aim to do so with a clear operational need and to minimize exposure.
Nothing in this policy grants us ownership of your Customer Content. Ownership and license terms are set out in our Terms of Service or other customer agreement.
8. Abuse, illegal content, and file review
WebUploads is a file collection and sharing platform. We do not actively monitor or open every file stored on the Services. However, we expressly reserve the right to access, review, scan, preserve, and disclose Customer Content and related account or technical data when we believe in good faith that doing so is reasonably necessary to:
- Investigate reports of abuse, misuse of the Services, or violations of our Terms of Service or acceptable use rules
- Investigate, prevent, or take action regarding suspected illegal activity, including (without limitation) distribution of malware, phishing materials, stolen credentials or personal data, intellectual property infringement, fraud, harassment, threats, or content that exploits or endangers children
- Respond to lawful process, governmental requests, or legal obligations
- Protect the rights, property, or safety of VIP Blocks, LLC, our users, recipients of links, or the public
- Secure the platform (for example, scanning for malware signatures, ransomware, or other threats where we implement such measures)
Reports of abuse or illegal activity may come from users, third parties, automated systems, infrastructure providers, payment partners, or public authorities. When we review content in these circumstances, access is limited to personnel or agents with a need to know, and we may preserve copies of relevant materials and metadata even if an account later deletes content, to the extent permitted by law and needed for the investigation or legal process.
We may remove or disable access to Customer Content, suspend or terminate accounts or links, notify affected parties, and/or report matters to law enforcement or other authorities when we believe it is appropriate or required. Automated or human review for abuse and safety does not mean we guarantee that all unlawful or harmful content will be detected or removed.
To report abuse or illegal content on the Services, contact us at support@webuploads.com with as much detail as possible (including relevant URLs, link codes, timestamps, and a description of the concern). For copyright infringement claims under the U.S. Digital Millennium Copyright Act, follow our DMCA Copyright Policy.
10. Analytics
We use analytics to understand how the Services are used, improve performance, and inform product and marketing decisions.
- Cloudflare (platform and analytics). We run WebUploadson Cloudflare's infrastructure (including Workers, R2 object storage, D1 databases, and the Cloudflare edge network) and we use Cloudflare Analyticsand related platform telemetry. Cloudflare may process technical and operational data (such as request metadata, IP address, and performance metrics) as needed to provide those services, in accordance with Cloudflare's privacy commitments and our configuration. Cloudflare is a publicly traded, security-focused enterprise infrastructure provider. Learn more at Cloudflare's Privacy Policy and Cloudflare's Trust Hub.
- Google Analytics. We use Google Analytics (including Google Analytics 4 or successor Google measurement products) to collect usage statistics via cookies or similar technologies. Google may process data as described in Google's Privacy Policy and related Google Analytics documentation. You may be able to use Google's opt-out browser add-on or other controls Google provides. We may also configure available privacy controls (such as IP anonymization or limited data retention) where appropriate.
- In-product usage analytics. We may also collect first-party product analytics (for example upload/download counts and storage metrics shown in your dashboard) on our own systems to operate billing limits and account features.
Analytics providers act as service providers / processors for these purposes, subject to their terms. Analytics data is used for measurement, troubleshooting, security, and improving the Services, not for selling your personal information.
11. Retention
We retain personal information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and support legitimate business needs (including security and backups). Retention periods vary by data type:
- Account data: generally for the life of the account and a reasonable period afterward for backup, audit, and legal purposes.
- Customer Content (files): for as long as your account or organization maintains it, subject to plan limits, link expiry, and deletion by authorized users, plus residual copies in backups or object-lifecycle systems for a limited period after deletion. Content retained for an active abuse, security, or legal investigation may be kept longer as described in Section 8.
- Upload and download links: configuration and access logs may be retained for the life of the link and for a period after expiry needed for security, analytics, and dispute resolution.
- Logs and security records: for periods appropriate to security investigation and operational analysis.
- Billing records: as required by tax and accounting rules.
- OTP and authentication artifacts: short-lived codes and related rate-limit data are retained only as long as needed for authentication security.
When information is no longer needed, we delete or de-identify it, except where retention is required or permitted by law.
12. Security
We implement administrative, technical, and organizational measures designed to protect personal information and Customer Content against unauthorized access, loss, misuse, or alteration. Measures may include encryption in transit, access controls, session security (for example httpOnly cookies and origin checks on sensitive actions), rate limiting, logging, and infrastructure hardening on Cloudflare.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for securing the email address used for OTP sign-in, protecting active sessions, configuring workspace and link permissions appropriately, and promptly notifying us of suspected unauthorized access at support@webuploads.com.
13. International transfers
VIP Blocks, LLCis based in the United States. The Services are operated primarily on Cloudflare's global network. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where we or our service providers operate (including edge locations used to deliver the Services). Those jurisdictions may have data protection laws different from those in your country.
Where required, we use appropriate safeguards for cross-border transfers (such as standard contractual clauses or other lawful transfer mechanisms) with relevant vendors.
14. Your choices and rights
14.1 Account and marketing choices
- Account settings. You may update certain profile, subdomain, and preference information through the Services, and manage or cancel billing via the Stripe customer portal where available.
- Marketing emails. You can opt out of promotional emails via the unsubscribe link in those messages. Operational, security, and transactional messages (including OTP codes and billing notices) are not marketing and may still be sent.
- Cookies and analytics. See Sections 9 and 10 and our Cookie Policy for browser and provider controls, including Google Analytics opt-out tools where available.
- Links and files. Authorized users may delete files or revoke links subject to product capabilities; residual copies may remain briefly in backups as described in Section 11.
14.2 Privacy rights
Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, or objection to certain processing, or to withdraw consent where processing is consent-based. California and other U.S. state residents may have additional rights to know, delete, correct, and opt out of sale/share of personal information, and not to be discriminated against for exercising those rights.
To exercise applicable rights, contact us at support@webuploads.com. We may need to verify your identity and, if you act on behalf of another person or organization, your authority. Some requests may be limited by law or by our need to retain information for security, fraud prevention, abuse investigation, legal compliance, or contractual reasons. If an organization administers your account, we may redirect certain requests to that organization as the appropriate controller of workplace data.
EEA/UK individuals may lodge a complaint with their local supervisory authority. We encourage you to contact us first so we can try to resolve your concern.
15. Children's privacy
The Services are designed for businesses, professionals, and adult individuals. They are not directed to children, and we do not knowingly collect personal information from children under 13 (or under 16 where a higher age is required by local law for consent-based processing).
If you believe a child has provided us personal information, contact support@webuploads.com and we will take appropriate steps to delete the information and, where required, terminate the account. Parents or guardians who need assistance may use the same contact channel.
Organizations that enable access for users under applicable age thresholds are responsible for obtaining any consents and providing any notices required by law.
16. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last modified" date at the top and, for material changes, provide additional notice as required by law (for example, by email, in-product notice, or a prominent notice on our website). Continued use of the Services after an updated policy becomes effective constitutes acceptance of the updated policy to the extent permitted by law. If you do not agree, you should stop using the Services and request account closure where applicable.
17. Contact us
For privacy questions, requests, or concerns, contact:
Mailing address (single line): VIP Blocks, LLC, 944 Deltona Blvd #5096, Deltona, FL 32725. This Privacy Policy is provided for transparency and does not constitute legal advice. It is designed to describe our practices and protect both users and VIP Blocks, LLC within the bounds of applicable law.