Document release: 2026-09-18.6 · Effective: 2026-09-18
Privacy Notice
This notice explains how Backends, the operator of Free S3, handles personal information. Our address is 25 Thomas Road, Kegworth DE74 2DY, United Kingdom. Contact our privacy lead at privacy@backends.co.uk. Additional privacy contact or representative details are: Oliver Whysall, privacy@backends.co.uk.
It covers visitors, registered users, people contacting us and individuals whose data is involved in security or abuse reports. The service website is https://frees3.backends.co.uk.
1. Our different roles
We are the controller of account, authentication, service-management, security, support and legal-administration information: we decide why and how it is used for those purposes.
For personal data inside customer objects that we store and transmit on the customer's instructions, we generally act as a processor, or a sub-processor where the customer is itself a processor. The customer decides what is uploaded and why. The Data Processing Agreement governs that processing where applicable. A personal or household use may fall outside parts of data protection law for the customer; that does not remove our own duties.
If your information is in another customer's object, contact that customer to exercise rights concerning its use. You may also contact us; we will assist the appropriate customer and will not use this distinction to ignore a concern about our own conduct. Where we must process limited object information for our own lawful security, abuse-handling or legal purposes, we assess our controller obligations for that separate processing.
2. Information we handle
We handle account email addresses, account identifiers, verification status, password hashes, sign-in/session data, agreement records, bucket names, credential identifiers and account status. We do not need your card details for the free plan.
We temporarily hold newly created S3 secrets in encrypted form so you can reveal them once, and temporarily process a secret you submit for a connection test. The storage system must also maintain credential material to authenticate S3 requests. "Shown once" does not mean no server ever handles a secret.
Operational information can include object names and metadata, storage totals, object counts, transfer measurements, API actions, timestamps, error/status information, IP addresses, user-agent information and security signals. The exact event/log fields depend on the portal, S3 gateway and infrastructure configuration. Object names themselves may contain personal information; avoid putting unnecessary personal data in them.
If you separately allow optional analytics, OpenPanel processes screen paths, visit duration, referrers, device/browser information, approximate location, outgoing-link events and explicitly marked interactions. We do not send your account email, S3 credentials, object contents or session replay. Analytics is disabled on query-string, verification and password-reset URLs to prevent link tokens entering analytics.
We receive the messages and evidence you send to support, privacy or abuse contacts. Reports may identify third parties. We may receive relevant information from an authorised account representative, a rights holder, a security provider, an authority or other affected people. We minimise the information retained and record its source where appropriate.
Where a request or report is handled in the case manager, we store its contact address, narrative, notes, case type, reference, assignment, status, priority, deadlines, tasks, reviewed holds and outcome records. Narratives, contact details and notes are encrypted at rest; authorised administrators can decrypt them to handle the case. Operational metadata needed to find overdue work remains searchable. Notification email contains a case reference and authenticated link rather than the narrative.
The portal compares recent numeric transfer, stored-byte and object-count observations with configured thresholds and recent rates to flag sudden changes. A signal opens a restricted internal security-review case and sends verified administrators a minimal case notification. The signal does not inspect object names or contents, is not proof of wrongdoing, and does not itself suspend an account, revoke a key, change visibility or delete data. The customer case area does not display a confidential internal review merely because the account is its subject; applicable access and objection rights can still be exercised through our privacy contact.
Registration uses Cloudflare Turnstile. Your browser contacts Cloudflare for a security challenge. Technical/device signals and an IP address may be processed; our server also sends your IP with the token for verification. This is used to resist automated abuse, not to inspect customer objects.
3. Purposes and lawful bases for our controller activities
| Purpose | Information and lawful basis |
|---|---|
| Create and operate your account, verify email, provide storage, deliver essential notices and respond to your service requests | Account and necessary service information; performance of our contract with you or steps you request before entering it. For representatives of organisational customers, our legitimate interests in administering that relationship. |
| Protect accounts and systems, limit automated abuse, detect unusual aggregate usage changes, investigate incidents and enforce reasonable service limits | Security signals, access records, numeric usage observations and relevant account/object information; legitimate interests in a secure, reliable service and protecting people. Where a specific law requires particular processing, legal obligation. |
| Handle complaints, privacy rights, legal requests and required records | Relevant correspondence and records; legal obligation where applicable, otherwise legitimate interests in resolving disputes and demonstrating proper conduct. |
| Measure capacity, diagnose faults and plan the service | Service usage and technical metrics; legitimate interests in operating the service efficiently. We prefer aggregated or minimised information. |
| Understand and improve portal navigation and usability through optional analytics | The analytics information described above; consent, which you may refuse or withdraw without affecting the service. |
We assess necessity and balance our legitimate interests against people's rights. You may object to processing based on legitimate interests. Ask us for more information about the relevant assessment.
We do not sell personal information, use stored objects for advertising, train AI models on customer objects or operate a marketing mailing list as part of this service. OpenPanel analytics is optional and disabled until the separate choice is granted. Agreement to the Terms is not analytics or marketing consent.
4. Who can receive information
Access is limited to authorised personnel who need it and are bound by confidentiality obligations. We use service providers for the functions and in the roles described in the Provider and Location Register. Some act as our processors for account data; a provider with access to customer object data may act as our sub-processor. A software product installed on our own servers is not automatically a third-party recipient merely because we use it.
Analytics events are sent to our self-hosted OpenPanel endpoint operated by Backends. OpenPanel AB supplies the browser SDK from openpanel.dev and receives ordinary request metadata when that script is downloaded after consent. These arrangements do not authorise either party to inspect customer objects.
We may disclose the minimum necessary information to professional advisers, insurers, authorities or courts where there is a lawful basis, or as part of a genuine business transfer with suitable safeguards and notice. We do not routinely give a complainant another user's identity. A customer's own sharing instructions can cause information to be delivered to its chosen recipients.
5. Locations and international access
The portal and account-data location is Enderby, United Kingdom. The primary object-storage location is Enderby, United Kingdom. Snapshot/backup locations and arrangements are Enderby, United Kingdom. Authorised remote administration takes place from Kegworth, United Kingdom and Enderby, United Kingdom.
Our Provider and Location Register identifies external providers and relevant countries. We do not claim that all information stays in the UK merely because the primary storage location is there. Email delivery, security checks, remote access, gateways and operational backups must also be considered.
Where a disclosure is a restricted international transfer, we use an applicable adequacy arrangement or appropriate contractual safeguards and the required assessment and supplementary measures, unless a lawful exception applies. The configured safeguards are UK adequacy regulations where applicable; UK IDTA/Addendum and transfer assessment where required. Ask privacy@backends.co.uk for relevant information or a copy of safeguards, with necessary security/commercial redactions that do not defeat that right.
6. Retention and deletion
We retain information only for the purposes explained here and review whether it is still needed. The following schedule applies, subject to proportionate, documented preservation for a legal obligation, an active dispute or a security incident. Such information is restricted, reviewed and deleted when the reason ends.
| Category | Normal period or deletion trigger |
|---|---|
| Live account and ordinary configuration | While the account is open; ordinary identifiable account records removed within 30 days after confirmed closure, apart from specifically justified records below. |
| Customer objects | Until you delete them or close the service; active objects removed within 30 days of the agreed deletion trigger. See Return and Deletion. |
| New-key reveal material | Up to 24 hours from creation; removed from the active portal record on reveal or by the expiry process. A revocation request also clears the portal's reveal copy. |
| Secrets submitted for a connection test | Encrypted while the test is pending; cleared after completion or cancellation by the operation-handling process. Failed/stalled jobs require cleanup and are not a permanent credential store. |
| Secret entered in the object browser | Used in page memory to sign direct S3 requests. The browser feature does not submit it to the portal server or save it in cookies, local storage, session storage or request URLs. The user should clear it before leaving a shared device. |
| Browser/server session | Browser-session cookie; corresponding server session expires after approximately two hours without a refresh. Browser session restoration may retain a session cookie longer on your device. |
| Email verification and password-reset token records | Links are valid for 24 hours and one hour respectively; expired token records are pruned after a further 30 days. |
| Detailed usage snapshots | 90 days. |
| Portal security/audit events | 365 days. |
| Optional portal analytics and consent choice | Analytics events: Event-level analytics retained 90 days, then deleted; aggregated reports retained 12 months. The browser retains the granted/denied choice until it is changed or site data is cleared. |
| Infrastructure, S3 and proxy access logs | 30 days, then automatically deleted unless subject to a documented incident hold. |
| Completed job records and operational credential metadata | Usage observations 90 days; audit events 365 days; completed jobs 90 days. |
| Support, abuse and privacy correspondence | Normally 24 months after case closure, subject to reviewed legal holds. |
| Portal case records and notification-delivery records | Normally 24 months after case closure; Normally 24 months after case closure, subject to reviewed legal holds. Open cases and documented lawful holds require separate review. |
| Numeric activity alerts | Held with the linked restricted security-review case and removed when that eligible closed case is pruned; Normally 24 months after case closure, subject to reviewed legal holds. |
| Agreement and dispute evidence | For the account lifetime and 6 years after closure where legally justified. |
| Backup or snapshot copies, where present | Daily backups retained 30 days; monthly restore tests; deletion reapplied after restore. |
Deletion from active systems and expiry from restricted backups can occur at different times. We do not use residual backup data for ordinary purposes and reapply relevant deletions if a backup is restored. We do not promise a customer restore service or an undelete facility. Details appear in the Data Processing Agreement.
7. Security and your choices
We use controls appropriate to the service, including authenticated bucket access, scoped credentials, separation of administrative access, password hashing, temporary secret encryption, TLS for published service endpoints and operational access restrictions. No service can guarantee absolute security. The Service Description explains important limits, including the absence of an end-to-end-encryption or certified-backup claim.
You control the data you upload, bucket visibility, the applications or browser tabs holding your keys and any links you share. Public mode is a disclosure instruction for anyone who obtains an exact object URL. Rotate exposed keys promptly and tell support about suspected compromise. Do not send passwords or S3 secrets in ordinary support email.
8. Automated checks
Email verification, capacity checks, rate limits and bot checks may prevent registration or temporarily restrict requests. Storage quota checks may reject uploads. Monthly transfer measurements do not automatically suspend accounts in this deployment; a human may review excessive use under the service terms. Separate anomaly checks compare recent aggregate transfer, stored-byte and object-count changes with absolute thresholds and, where history exists, a recent baseline. An anomaly creates an internal case for human review and emails administrators; it does not itself restrict the account. These controls use verification results, technical signals, usage totals and configured thresholds; they do not decide credit, employment or insurance eligibility.
A block or suspension may be mistaken. Contact support@backends.co.uk or privacy@backends.co.uk to explain your circumstances, challenge a result or request human review. Where law grants additional rights concerning a solely automated significant decision, we will honour them; this notice does not remove them.
9. Your rights
Depending on the processing and applicable law, you may request access, correction, erasure, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. If we rely on consent for a particular optional activity, you can withdraw it without affecting the lawfulness of earlier processing. Rights can have lawful limits, which we will explain when relevant.
Contact privacy@backends.co.uk or write to our address. No special form, legal terminology or account login is required. We may request proportionate information to confirm identity or clarify a request. We normally respond to rights requests within one calendar month, subject only to lawful timing rules or extensions which we will explain. This is different from the acknowledgement deadline for a complaint.
An email address and necessary account/security information are required to provide an account. Without them we cannot operate it. You need not upload objects simply to visit our public legal pages.
10. Complaints and the regulator
Tell us about a data protection concern at privacy@backends.co.uk or by post. You can use our optional complaint template, completed electronically or on paper. We will acknowledge your complaint as soon as reasonably possible and no later than 30 days after receipt, investigate and keep you informed, and explain the outcome without undue delay. There is no fee for making a complaint.
You also have the right to complain to the UK's Information Commissioner's Office (ICO). Its complaints information explains the process and contact options. Our internal procedure does not remove rights to complain to a regulator, seek a judicial remedy or use another competent authority where applicable. See our complaints procedure.
11. Children and changes
Accounts are intended for adults aged 18 and over. We do not deliberately invite children to register. If you believe a child has registered or their information has been handled inappropriately, contact us so we can assess the issue and take suitable action. The registration age declaration is not a claim of independently verified age assurance.
We will update this notice when the service or relevant requirements change, show its version and effective date, and notify users of material changes where appropriate. A revised notice does not by itself authorise an incompatible new use of existing data.