Privacy policy for buyers of the Filelayer plans

This policy explains how Technology Pro Bono S.L. ("we") handles personal data about the people who buy a Filelayer paid plan, write to us for support, or send us material to examine under a plan. It does not cover the files your applications store with the Filelayer library: the library runs on your own database and your own storage bucket, and we never receive that data.

1. Who is responsible

The controller of the personal data described here is Technology Pro Bono S.L., NIF B88502364, Serrano 17, 28001 Madrid, Spain. It is registered in the Mercantile Registry of Madrid, volume 39704, folio 98, sheet M-705482, first entry, and was incorporated by deed of 17 October 2019 before the Madrid notary Francisco Javier Barreiros Fernández, protocol number 2019/2767.

You can reach us about anything in this policy at support@filelayer.dev.

2. What we collect, and why

When you buy a plan. Checkout is run by Stripe. Stripe collects the payment card details; we never see or store a full card number. We receive from Stripe the name and email address of the buyer, the organization's name and billing address, the VAT number if you enter one, the plan, and the history of payments, invoices and cancellations. We use this to provide the plan, to invoice you and to keep the accounting and tax records the law requires.

When you write to us. If you email support@filelayer.dev or another Filelayer address, we receive your name, your email address and what you write, including any attachments. We use it to answer you and to provide the services of your plan.

When we carry out a review. Under the Business plan, and in the file-model review, we work from the material you choose to send: schemas, configuration, code excerpts and descriptions. Send only what the review needs. The terms ask you not to send personal data about your own users unless it is necessary; if you do, we use it only for that review and delete it when the review is closed.

When you visit filelayer.dev. The site sets no cookies. It is served by Cloudflare, which processes the technical data of each request, such as the IP address, to deliver the page and protect the site. To know which pages are read, we use Cloudflare Web Analytics, which counts visits without cookies and does not store the parameters in a page's address. It is the only script on the site that is not part of the page itself.

3. Legal basis

• Data needed to sell and provide a plan, and to answer support requests under it: the performance of the contract with your organization (article 6(1)(b) GDPR), and, for the people who act for that organization, our legitimate interest in dealing with our customer's representatives (article 6(1)(f)).
• Invoices, accounting and tax records: a legal obligation (article 6(1)(c)).
• Emails from people without a plan: our legitimate interest in answering the questions people send us (article 6(1)(f)).
• Visit counts and the technical data of each request: our legitimate interest in delivering, protecting and improving the site (article 6(1)(f)).

We do not use your data for advertising, we do not sell it, and we do not send marketing email.

4. How long we keep it

• Billing and invoice records: as long as Spanish tax and commercial law requires, which is currently up to six years after the end of the year they refer to.
• Support emails: for as long as your plan is active and for one year after it ends, so that we can follow up on earlier requests, then deleted.
• Review material: deleted when the review is closed, except the written report we send you, which we keep with the support emails.

5. Who receives it

We use these providers to run the plans. Each one processes the data on our behalf or under its own terms, only as far as its service needs:

• Stripe, for checkout, payments, invoices, tax calculation and the customer portal.
• Google, through Google Workspace, for support@filelayer.dev and the other Filelayer addresses.
• Cloudflare, for hosting filelayer.dev and for its web analytics.

Google and Cloudflare act as our processors.

We also give data to the tax authorities, courts and other public bodies where the law requires it.

6. Transfers outside the European Economic Area

Some of these providers process data in the United States or other countries outside the European Economic Area. Where they do, the transfer relies on the EU-US Data Privacy Framework, under which Stripe, Google and Cloudflare are certified.

7. Your rights

You can ask us for access to your personal data, and to correct it, delete it, restrict its processing or receive it in a portable format. You can object to processing based on our legitimate interest. Write to support@filelayer.dev; we answer within one month. Some data, such as invoices, we have to keep for the periods in section 4 even if you ask us to delete it.

If you think we have not handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority in the country where you live or work.

8. Changes

If we change this policy in a way that matters to you, we will update this page and tell customers with an active plan by email before the change applies.

Last updated: 4 November 2026.