Privacy Policy

Last updated: July 28, 2026 · Effective: July 28, 2026

This Privacy Policy explains how BouncyLoop SRL, a limited liability company incorporated under the laws of Italy with registered office in Italy (“BouncyLoop”, “we”, “us”), processes personal data when you use Spize — the file-transfer, file-request, electronic-signature and related services available at spize.io, through the Spize desktop application and through our APIs and integrations (the “Service”). BouncyLoop SRL is the data controller for this processing. You can reach us for any privacy matter at info@spize.io; full company details are available on request at the same address.

This policy covers senders, recipients, signers, sellers and buyers of Paid Shares, visitors to our site, and users of the desktop app and APIs. It does not cover third-party websites, applications or services that you use alongside Spize (for example the email service that delivers your messages, a sign-in provider you choose, or an AI assistant you connect) — those are governed by their own policies.

1. At a glance

• We cannot read the files you transfer. Cloud transfers are end-to-end encrypted on your device; we store ciphertext only, and the decryption key never reaches us.
• We collect little. An email address, transfer metadata, billing status, technical logs — and analytics only if you opt in.
• We do not sell personal data, we do not share it for advertising, and we use no advertising trackers.
• You are in control. GDPR and (where applicable) U.S. state privacy rights, exercisable by email; cookie choices changeable at any time.

2. What we can never read: your transferred files

Spize’s core is designed so that we do not have access to the contents of the files you transfer:

• Cloud transfers are end-to-end encrypted. Files are encrypted with AES-GCM in your browser or on your device before upload. Our servers and our storage providers only ever receive and store ciphertext. The decryption key travels in the URL fragment of the share link (the part after #), which browsers never send to any server — so the key never reaches us. Where a share is password-protected, the additional unwrap key is derived on the recipient’s device.
• Filenames are encrypted too. Cloud-relay share names are stored in opaque, encrypted form; we cannot read them.
• Direct device transfers are streamed between sender and recipient through an encrypted tunnel and are not stored on our infrastructure.
• Your key vault is opaque to us. If you enable the encrypted key vault and its backup, we store only wrapped (encrypted) key material that we cannot use; it can be unlocked only with secrets that stay on your side.

One deliberate exception: Spize Sign. To assemble, flatten and cryptographically seal signed documents, signature documents are processed on our infrastructure and are therefore not end-to-end encrypted in the way transfers are. They are encrypted in transit and at rest, access-controlled, and processed only to provide the signature service. Section 3(c) describes the associated data.

3. Personal data we process

a. Account and profile data

• Email address; password (stored only as a cryptographic hash by our authentication provider); or, if you choose to sign in with a third-party identity provider, the basic profile data that provider shares with us (email, name, avatar).
• Optional profile details you add (such as display name), your plan and settings, and your Organization memberships and roles.
• Your public handle, if you claim one. Handles are public by design — anyone who knows a handle can send files to it.

b. Transfer and share metadata

• For each Share: sizes, timestamps, status, expiry, plan tier, opaque encrypted filename, and download events (including technical data such as IP address and browser type in server logs).
• Recipient email addresses that you provide so we can deliver a share notification, a file request or a signature invitation. We use them only for that delivery and related service messages — never for marketing to the recipient.
• For file requests: the request title/description you write and the metadata of uploads received.

c. Spize Sign data

• Names and email addresses of the parties, the signature document itself (see Section 2), signature placements, and an audit trail of signature events — timestamps, IP addresses, browser/user-agent data and technical event records — which forms part of the completion certificate that makes signatures verifiable.

d. Billing data

• Subscription tier and status, billing period, billing country and tax status, invoices and receipts, prepaid credit balance and ledger, and — for sellers of Paid Shares — payout account status and transaction records (amounts, currency, fees, status).
• We never receive or store full card numbers. Payments are handled by our payment processor (Stripe), which acts as our processor for payment execution and as an independent controller for its own fraud prevention and regulatory compliance. Sellers of Paid Shares additionally onboard directly with the processor, which collects identity-verification (KYC) data under its own privacy policy.

e. Technical logs and diagnostics

• Server and security logs generated when you use the Service: IP address, user agent, timestamps, request paths and status codes, API-key usage, and rate-limit events.
• Client diagnostics: when something goes wrong in the app, we may receive a structured error event (error type, message, page path, browser type). Error reports are also processed by an error-monitoring provider acting on our behalf; we keep session replay disabled.
• Desktop app: device records you create by linking a device (device name, platform, app version, online status/last-seen), used for device-to-device transfers.

f. Analytics (only with your consent)

• If — and only if — you opt in via the cookie banner, we collect first-party, pseudonymous product-usage analytics: pages viewed, features used, device/browser class, and a random device identifier. Analytics is configured to strip URL fragments (which can contain decryption keys) before anything is recorded, honors “Do Not Track”, and is never used for advertising or shared for third parties’ own purposes. See the Cookie Policy.

g. Communications and waitlist

• Messages you send us (support, legal notices, rights requests) and, if you join a waitlist, the details you submit there.

h. What we do not collect

• No file contents or filenames of end-to-end encrypted transfers (Section 2).
• No full payment-card data.
• No advertising identifiers, cross-site trackers, or data purchased from brokers.
• We do not intentionally collect special categories of data (health, beliefs, etc.). What you place inside files you transfer is encrypted and invisible to us; what parties place in signature documents is theirs and processed only to provide the signature service.

4. Purposes and legal bases

• Providing the Service — operating accounts, delivering transfers, file requests and signatures, executing Paid Shares, enforcing plan quotas, providing support (Art. 6(1)(b) GDPR — performance of a contract).
• Security and abuse prevention — authentication, logging, rate limiting, fraud and abuse detection, diagnosing failures (Art. 6(1)(f) GDPR — legitimate interest in keeping the Service and its users safe; where required by law, Art. 6(1)(c)).
• Billing and compliance — invoicing, tax and accounting record keeping, responding to valid legal requests (Art. 6(1)(c) GDPR — legal obligation; Art. 6(1)(b) for billing execution).
• Product analytics — understanding aggregate product usage to improve the Service (Art. 6(1)(a) GDPR — your consent, given via the cookie banner and revocable at any time).
• Service communications — transactional messages such as sign-in codes, delivery and signature notifications, billing and security notices (Art. 6(1)(b)). We send marketing only if you have opted in or where soft opt-in rules allow it, always with a working unsubscribe.
• Establishing, exercising or defending legal claims (Art. 6(1)(f)).

Where we rely on legitimate interests, we have assessed that the processing is limited to what is necessary and does not override your rights, given the minimal data involved and the protective design of the Service; you can object as described in Section 10. We do not carry out automated decision-making that produces legal or similarly significant effects on you. Anti-abuse systems may flag activity automatically, but decisions with significant effect (such as account termination) involve human review.

5. Cookies and similar technologies

We use strictly necessary storage (sign-in session, local encryption keys, your consent choice) and, only with your consent, first-party analytics cookies. No advertising cookies. The full inventory, durations and the way to change your choices at any time are in the Cookie Policy.

6. Who receives personal data

We do not sell personal data and we do not share it with third parties for their own marketing. Data is disclosed only to:

• Service providers (processors) acting on our documented instructions under data-processing agreements (Art. 28 GDPR), in these categories: cloud application hosting; database and authentication infrastructure; object storage for encrypted content; transactional email delivery; error monitoring; and — only with your consent — product analytics. In line with data minimisation and our security posture we identify these providers by category here; you can obtain the identity of the specific providers that process your data by writing to info@spize.io (Art. 15 GDPR; CJEU C-154/21).
• Our payment processor (Stripe), which users interact with directly during checkout and — for sellers — payout onboarding, as described in Section 3(d).
• Recipients you designate — the people you send Shares, file requests or signature invitations to necessarily see the data needed for that interaction (e.g., your sender identity and the share metadata).
• Authorities and other parties where legally required — in response to valid legal process, to comply with legal obligations, to enforce our terms, or to protect life, safety, rights or property. What we can produce is limited by design: for end-to-end encrypted content we hold only ciphertext and metadata and cannot decrypt content.
• Corporate transactions — a merger, acquisition or asset sale, in which case this policy continues to apply and you will be notified of any change of controller.

7. International transfers

We are established in Italy, and some of our service providers process data in the United States or other countries outside the European Economic Area. Where personal data leaves the EEA, we rely on the safeguards of GDPR Chapter V: European Commission adequacy decisions (including, for certified U.S. providers, the EU-U.S. Data Privacy Framework) and/or Standard Contractual Clauses with supplementary measures as needed. Note that end-to-end encrypted content is ciphertext wherever it is stored — the keys never leave your side. You can request a copy of the relevant safeguards via info@spize.io.

8. Retention

• Share ciphertext: deleted when the Share expires (per your plan or chosen settings) or when you delete it, whichever is earlier.
• Share metadata: kept while relevant for your dashboard and quota accounting, then deleted or anonymized.
• Signed documents and completion certificates: kept while your account stores them (they count against your storage) — you can delete them at any time; parties should retain their own copies.
• Account data: kept for as long as your account exists; deleted or anonymized within a reasonable period after account deletion, except where retention is legally required.
• Billing and tax records: retained for the period required by Italian law (currently 10 years, Art. 2220 Civil Code).
• Security, server and diagnostic logs: short, defined periods proportionate to security and troubleshooting needs — as a rule no longer than 12 months, save for logs preserved as evidence of an incident or legal claim.
• Analytics data: retained in identifiable (pseudonymous) form no longer than needed for product statistics; consent identifiers expire as described in the Cookie Policy.

9. Security

Beyond end-to-end encryption of transferred content, we apply technical and organizational measures appropriate to the risk (Art. 32 GDPR): TLS for all connections, encryption at rest on our storage, hashed passwords and one-time-code authentication, scoped API keys, access controls and least-privilege administration, logging and monitoring, and separation between content ciphertext and account systems. No system is perfectly secure: protect your share links and passwords — anyone with a complete link (including its key fragment) can download and decrypt that Share until it expires. If a personal-data breach occurs that is likely to result in a risk to you, we will notify the competent authority and, where required, you, in accordance with Articles 33–34 GDPR.

10. Your rights (GDPR)

Under the GDPR you have the right to:

• access the personal data we hold about you and obtain a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”), including by deleting your account;
• receive data you provided in a portable, machine-readable format and have it transmitted to another controller where technically feasible;
• restrict processing in the cases provided by Art. 18 GDPR;
• object to processing based on legitimate interests, on grounds relating to your particular situation (we will stop unless we have compelling legitimate grounds or the processing serves legal claims);
• withdraw consent at any time where processing is based on consent (e.g., analytics — via the cookie preferences), without affecting prior processing;
• lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (garanteprivacy.it) — or with the authority of your place of residence or work.

To exercise any right, email info@spize.io. We may need to verify your identity (normally by confirming control of the account email). We respond within one month, extendable by two further months for complex requests, as the GDPR allows. Exercising rights is free of charge except in the cases of manifestly unfounded or excessive requests provided by law. Note that we cannot “retrieve” the contents of end-to-end encrypted Shares for an access request — we do not have the keys.

11. U.S. state privacy rights

We are an Italian company and may not meet the applicability thresholds of U.S. state privacy statutes (such as the California Consumer Privacy Act as amended by the CPRA, or the Virginia, Colorado, Connecticut and similar acts). To the extent such a law applies to you, we honor it:

• No sale, no sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We use no advertising cookies, so there is nothing to opt out of; universal opt-out signals such as Global Privacy Control are effectively honored because non-essential processing only ever happens on an opt-in basis.
• Categories collected (as defined by the CCPA): identifiers (email, IP address, handle); commercial information (subscription and transaction records); internet activity (service logs and, with consent, analytics); and inferences limited to service usage. Sources: you, your devices, and our payment processor. Purposes and recipients are as described in Sections 4 and 6.
• Your requests. You may request to know, access, correct or delete your personal information, and you will not be discriminated against for doing so. Submit requests (directly or via an authorized agent) to info@spize.io; we verify requests via your account email.
• No sensitive-data uses requiring a “limit use” right, and no profiling producing legal or similarly significant effects.

12. Children

The Service is not directed to children. Accounts require you to be at least 18. We do not knowingly collect personal data from children under 16 (or under 13 for U.S. COPPA purposes); if you believe a child has provided us personal data, contact info@spize.io and we will delete it.

13. Data you provide about other people

When you give us someone else’s email address (to notify a share, request files or invite a signature), you are responsible for being entitled to do so. We process that address solely to deliver the requested interaction and related service messages, and this policy is available to those recipients from every message and page involved. Recipients can object to further messages at any time via info@spize.io.

14. Changes to this policy

We may update this policy from time to time. For material changes we will give notice through the Service or by email before they take effect; the “Last updated” date above reflects the latest revision. Earlier versions are available on request.

15. Contact

Privacy questions and rights requests: info@spize.io (BouncyLoop SRL). For the rules governing use of the Service, see the Terms of Service; for cookies, the Cookie Policy.