← Back

Bytely — Privacy Policy

DRAFT — Pending legal review. This policy has been prepared for review and is not a substitute for advice from a qualified Ontario privacy lawyer. Do not publish until reviewed.

Effective Date: [TO BE SET ON PUBLICATION] Last Updated: [TO BE SET ON PUBLICATION] Version: 1.0

This Privacy Policy describes how 2410945 ONTARIO INC. (the "Company", "we", "our", or "us"), an Ontario corporation having a registered office at 7 Grand Avenue South Unit 109, PMB 160 Cambridge, Ontario, Canada N1S 2L3, collects, uses, shares, and protects personal information when you access or use the file-transfer service available at https://app.bytely.xyz (the "Service", marketed as "Bytely").

This policy applies to Senders who hold accounts with the Service, Recipients who access shared files, and visitors to our website.

By using the Service you confirm that you have read and understood this Privacy Policy. If you do not agree with the practices described here, you must not use the Service.

1. Data Controller

The Company is the data controller (under the General Data Protection Regulation ("GDPR") and the United Kingdom GDPR), the business (under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, "CCPA/CPRA"), and the organization responsible for personal information (under the Personal Information Protection and Electronic Documents Act, "PIPEDA").

For any privacy-related question or to exercise your rights, contact:

Privacy Officer 2410945 ONTARIO INC. 7 Grand Avenue South Unit 109, PMB 160 Cambridge, Ontario, Canada N1S 2L3 Email: support@bytely.xyz

2. What Personal Information We Collect

We collect the following categories of personal information.

2.1 Account Information (Senders only)

When you create an account, we collect:

• Email address
• A salted, cryptographically hashed version of your password (we never store the plaintext)
• Display name (optional)
• API keys you create (stored hashed)
• Account creation date and last sign-in date

2.2 User Content

The files, folders, file names, file paths, file metadata, and any messages or notes you upload to the Service through your account constitute "User Content". We process User Content on your instruction in order to deliver it to your designated Recipients.

2.3 Package Metadata

For each transfer ("package") you create, we record: package name, file count, total size, sender identifier, recipient access token, expiry timestamp, download count, and the package's lifecycle status (pending / uploading / ready / expired / revoked / cancelled / deleted). Package metadata is retained on a long-term basis even after file content is deleted, in order to maintain your account history and operational records.

2.4 Recipient Activity

When a Recipient accesses a shared package we may record: the access token used, the time of access, the IP address, the browser user-agent string, the volume of data transferred, and the outcome (completed / failed / cancelled).

2.5 Abuse-Prevention Data

To protect the Service from abuse, we record: failed sign-in attempts (with timestamp, IP address, and account email), rate-limit counters, suspected automated traffic, and similar security telemetry. We retain this data only as long as needed to enforce our security policies (typically less than 30 days).

2.6 Technical Information

When you interact with the Service, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Device type
• Referring URL
• Pages or endpoints accessed
• Timestamps of access
• Country-level geolocation derived from your IP address by our edge network provider

2.7 Cookies and Similar Technologies

We use a small number of strictly necessary cookies — including a session cookie that authenticates you after sign-in and a CSRF-protection cookie. We do not use advertising cookies, third-party analytics that profile users, or cross-site tracking technologies.

2.8 Communications

If you contact us by email or other channel, we keep a record of that communication, including any attachments and contact details you provide.

2.9 Information We Do Not Collect

We do not collect: government-issued identifiers, payment-card numbers (until paid plans are introduced and a third-party payment processor is engaged), precise geolocation, biometric data, health data, racial or ethnic data, sexual-orientation data, religious data, or political-opinion data. We do not knowingly collect personal information from children under sixteen (16) — see Section 11.

3. How We Use Personal Information

We use personal information for the following purposes:

| Purpose | Lawful basis (GDPR/UK GDPR) | | ------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------- | | To provide, operate, and maintain the Service (account management, file transfer, file storage, link generation, package lifecycle) | Performance of a contract | | To send transactional emails (sign-in links, password reset, package notifications) | Performance of a contract | | To detect, investigate, and prevent fraud, abuse, illegal activity, and security incidents | Legitimate interest; legal obligation | | To enforce our Terms of Service and Acceptable Use Policy | Legitimate interest | | To comply with legal, regulatory, and law-enforcement obligations | Legal obligation | | To communicate with you about the Service, including service announcements, security notices, and changes to our policies | Performance of a contract; legitimate interest | | To improve and develop the Service (aggregate, de-identified usage analysis) | Legitimate interest | | To administer the Company's business records | Legitimate interest; legal obligation | | To establish, exercise, or defend legal claims | Legal claims |

We will not use your personal information for purposes materially different from those described in this policy without giving you notice and, where required, obtaining your consent.

4. How We Share Personal Information

We do not sell personal information.

We share personal information with the following categories of recipients only as necessary for the purposes described in Section 3:

4.1 Service Providers (Sub-processors)

We engage third-party service providers ("sub-processors") to operate the Service. These providers process personal information on our behalf, under written data-processing agreements containing the contractual safeguards required by GDPR / UK GDPR / PIPEDA, and only for the purposes we specify. The categories of sub-processors we currently engage are:

| Category | Purpose | | ------------------------------------------------------- | ------------------------------------------------------------------------ | | Cloud hosting and infrastructure provider | Serverless compute, object storage, database, key-value state, content delivery | | Edge security provider | Web application firewall, rate limiting, bot management, DDoS mitigation | | Transactional email provider | Delivery of sign-in links, verification emails, and package notifications | | Payment processor | Subscription billing and tax calculation (paid plans only) | | Customer support tooling | Handling of support requests sent to us by email |

A current list naming each sub-processor, the service they provide, and the region in which personal information is processed is published at bytely.xyz/subprocessors and is updated whenever we add, remove, or replace a sub-processor. Where required by law or contract, we will provide at least thirty (30) days' advance notice of material changes (for example, the addition of a new sub-processor processing personal information of EEA, UK, or Swiss data subjects), giving you the opportunity to object before the change takes effect.

4.2 Legal and Safety Disclosures

We may disclose personal information when we believe in good faith that disclosure is necessary to:

• comply with applicable law, court order, subpoena, or government request;
• enforce or apply our Terms of Service or Acceptable Use Policy;
• detect, prevent, or otherwise address fraud, security, or technical issues;
• protect the rights, property, or safety of the Company, our Users, or the public;
• report content or conduct as required by law (for example, mandatory reporting of child sexual abuse material to the National Center for Missing & Exploited Children or equivalent authority in your jurisdiction).

4.3 Business Transfers

If we are involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will require the acquiring party to honour the commitments in this Privacy Policy or give you notice and an opportunity to delete your data.

4.4 With Your Direction

We share personal information when you direct us to do so — for example, when you create a sharing link, the recipients of that link can access the User Content you have shared.

We do not share personal information with third parties for their independent marketing or advertising purposes.

5. International Data Transfers

The Service is operated using globally distributed cloud infrastructure. Your personal information is primarily processed in the United States and the European Union, and may also transit through other countries in which our sub-processors maintain points of presence. The current list of sub-processor processing regions is available at bytely.xyz/subprocessors.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of data protection, we rely on:

• the European Commission's Standard Contractual Clauses (Module One: Controller-to-Controller, or Module Two: Controller-to-Processor, as applicable);
• the United Kingdom International Data Transfer Addendum to the Standard Contractual Clauses;
• the Swiss Data Protection Authority's adaptations for transfers from Switzerland;

each as concluded between us and our sub-processors, and supplemented by additional technical and organizational measures where appropriate.

You may request a copy of the relevant transfer mechanism by writing to support@bytely.xyz.

6. How Long We Keep Personal Information

We retain personal information only as long as necessary for the purposes described in this Privacy Policy.

| Category | Retention period | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | User Content (file bytes) | Until package expiry, package revocation, or account deletion — typically 7 days from package creation, or as configured by the Sender | | Package metadata | Indefinitely while the account is active, to maintain account history; deleted within 90 days of account termination | | Account information | While the account is active; deleted within 30 days of termination, with limited residual copies in encrypted backups for up to 90 additional days | | Abuse-prevention data | Up to 30 days from collection, except where retained to support an active investigation | | Technical access logs | Up to 90 days, except where retained to support an active investigation or legal obligation | | Email communications | Up to 24 months from the last interaction | | Transactional records (when fees apply) | As required by tax, accounting, and corporate-records law (typically seven years in Ontario) |

We may retain personal information longer where retention is required by law, by regulatory order, by litigation hold, or to protect the rights, property, or safety of the Company, our Users, or the public.

7. How We Protect Personal Information

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• In transit: TLS 1.2+ encryption for all traffic between Users and the Service.
• At rest: server-side encryption of object storage by our hosting sub-processor, enabled by default.
• Authentication: salted, cryptographically hashed password storage; rate-limited sign-in; account lockout on repeated failed attempts.
• Access control: least-privilege access for personnel and contractors; role-scoped sub-processor bindings; signed-token access to recipient-facing endpoints.
• Network protections: web application firewall, rate limiting, bot management, and DDoS mitigation provided at the network edge by our security sub-processor.
• Monitoring: logging of administrative actions and security-relevant events.
• Incident response: defined process for triaging, containing, investigating, and reporting suspected incidents.

No security measure is perfect. You are responsible for keeping your account credentials secret and for using strong, unique passwords. If you suspect unauthorized access to your account, contact support@bytely.xyz immediately.

8. Your Rights

8.1 All Users

Subject to applicable law and verification of your identity, you have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your account and associated personal information, subject to retention obligations described in Section 6;
• withdraw consent where consent is the lawful basis for processing;
• lodge a complaint with a privacy regulator (see Section 8.4).

To exercise any of these rights, write to support@bytely.xyz. We will respond within thirty (30) days, or within such shorter period as is required by applicable law.

8.2 Users in the European Economic Area, United Kingdom, and Switzerland

In addition to the rights in Section 8.1, you have the right to:

• portability — receive your personal information in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• restriction — request that we restrict processing of your personal information in specified circumstances;
• object — object to processing based on legitimate interests, including profiling;
• be free from automated decision-making producing legal or similarly significant effects (we do not engage in such automated decision-making).

The supervisory authority for your country can investigate complaints about our handling of your personal information.

8.3 Users in California (CCPA/CPRA)

In addition to the rights in Section 8.1, California residents have the right to:

• know the categories of personal information we collect, the sources, the purposes, and the categories of recipients;
• delete personal information we collected from you, subject to exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioural advertising);
• limit the use and disclosure of sensitive personal information (we do not collect sensitive personal information beyond what is strictly necessary to provide the Service);
• non-discrimination for exercising any of the rights above.

You may exercise these rights by writing to support@bytely.xyz. You may also designate an authorized agent to make a request on your behalf.

8.4 Where to File a Complaint

| Region | Authority | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Canada | Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca | | Ontario | Information and Privacy Commissioner of Ontario — https://www.ipc.on.ca | | European Union | The data-protection authority of your country of residence — list at https://edpb.europa.eu/about-edpb/about-edpb/members_en | | United Kingdom | Information Commissioner's Office — https://ico.org.uk | | Switzerland | Federal Data Protection and Information Commissioner — https://www.edoeb.admin.ch | | United States — California | California Privacy Protection Agency — https://cppa.ca.gov | | Mexico | Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) — https://www.inai.org.mx | | Japan | Personal Information Protection Commission — https://www.ppc.go.jp |

9. Data You Share with Recipients

When you create a sharing link, you choose the Recipients with whom you share your User Content. You are responsible for the lawfulness of that sharing, for obtaining any required consents, and for ensuring that you have the right to share the User Content. We are not the controller of the personal information that flows from you to your Recipients through the Service in accordance with your instructions.

If you are a Recipient and believe you have received content that should not have been shared with you, contact the Sender directly. If you believe the content violates our Acceptable Use Policy, report it to support@bytely.xyz.

10. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. We do use automated systems for security purposes (rate limiting, anomaly detection, abuse prevention), but those systems do not make decisions about your civil, contractual, or other legal rights.

11. Children's Privacy

The Service is not directed at, and we do not knowingly collect personal information from, individuals under sixteen (16) years of age. If you believe a child under sixteen has provided personal information to us, contact support@bytely.xyz and we will take prompt steps to delete the information.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, our sub-processors, or applicable law. If we make a material change, we will give notice through the Service or by email at least thirty (30) days before the change takes effect, except where the change is required immediately for legal, regulatory, or security reasons. The "Last Updated" date at the top of this policy will always identify the most recent version.

13. Contact Us

For any question about this Privacy Policy, to exercise your rights, or to file a privacy concern:

Privacy Officer 2410945 ONTARIO INC. 7 Grand Avenue South Unit 109, PMB 160 Cambridge, Ontario, Canada N1S 2L3 Email: support@bytely.xyz

We will respond to your request within thirty (30) days, or within such shorter period as is required by applicable law.

2410945 ONTARIO INC. 7 Grand Avenue South Unit 109, PMB 160 Cambridge, Ontario, Canada N1S 2L3 Province of Ontario, Canada