Legal

Privacy policy for the Slayper service

Information pursuant to Art. 13 and 14 GDPR on the use of Slayper: apps, sending and receiving, download, upload and verification pages, Outlook add-in and integrations. The website privacy policy applies to the website. This is a translation; the German version is legally binding.

1. At a glance

• Files, file names, messages, references and address books are encrypted on the device. We cannot read them.
• Transfers are deleted after 48 hours.
• Every transfer creates a record for the sender (the Slayper record). It is retained for ten years.
• Servers, storage and email delivery are located in Germany. There is no tracking and no advertising.
• We do not store IP addresses. To defend against password guessing, we keep them in memory for no more than 15 minutes.

2. Controller and roles

We are not required to appoint a data protection officer.

Slayper involves two roles:

• We are the controller for the data of customer accounts (Section 3) and for the operation of the service.
• We process on behalf of our customers everything that arises when files are sent, requested and received: content, information about recipients and uploaders, and the transfer records (Sections 4 to 6). The controller for this is the company that sends or requests the files. This is governed by our Data Processing Agreement. If you are a recipient and have questions or wish to exercise your rights, please contact the sender. If your request reaches us, we will forward it to the sender.

3. Customer account

For an account, we process the name and email address, the password (only as a scrypt hash, not in plain text), the public key of the account, for each device a public device key with the device name (for example the computer name), the time of the last connection, the setting for email notifications and, where applicable, the time of a termination. Private keys never leave your devices.

After you sign in, your device receives a session key. We store only a hash of it; the session is valid for 30 days. After ten failed sign-in attempts per email address or per IP address, we block sign-in for 15 minutes. For this purpose, we keep the IP address and email address in memory only and remove them when the block expires.

So that files arrive directly in the inbox of another Slayper account, signed-in users can check whether a Slayper account exists for an email address. They then receive the name, email address and public keys of that account.

The legal basis is Art. 6(1)(b) GDPR (contract), and for the sign-in throttle Art. 6(1)(f) GDPR (protection against unauthorized access).

After a termination, we delete the account with all transfers, requests, the address book and the transfer records of the account after 30 days. During this period you can download your transfer records. Entries in the transfer records of other accounts, for example that you sent something to another account, belong to their transfer record and remain there until the end of the retention period.

4. Sending and requesting

Files, file names and types, messages, references, the recipient list for your own devices and your address book are end-to-end encrypted on your device. The key for links is contained only in the link itself and is not transmitted to the server.

For operation, the server knows: the number and size of files, checksums, times, expiry, protection settings (PIN only as a hash, requirement to confirm by code, download limit), the addresses of the intended recipients only as an encrypted hash (HMAC), for integrations a reference ID from the business software, and the recipients of link emails that your app reports for the transfer record.

The app sends link emails via your own email mailbox, not via our server.

Retention period: Transfers are deleted after 48 hours, incomplete ones after 24 hours. Once a download limit is reached, we delete the transfer as soon as all downloads are confirmed, at the latest after two hours. In storage, an additional deletion rule applies after three days. Requests (upload links) are valid for 2, 7 or 14 days and are deleted seven days after expiry. You can delete transfers yourself at any time.

5. Receiving and uploading without an account

Anyone who downloads or uploads files via a link confirms their email address with a code or enters a PIN, depending on the sender's settings. In doing so, we process:

• the email address entered, to match it against the intended recipients and to send the code. We store the code only as a hash; it is valid for ten minutes.
• after confirmation, the email address in the download session until the transfer is deleted.
• when uploading, the name provided and, where applicable, the email address.
• a rough indication of browser and operating system (for example “Chrome on Windows”), without a version number.
• the confirmation that the files were decrypted completely and unaltered.

This information is included in the sender's transfer record (Section 6). We do not store IP addresses in the process. The pages display the sender's name or email address so that you know who the files come from. In the browser, the download page stores only whether you have hidden the notice about Slayper.

The processing is carried out on behalf of the sender. The sender's legal basis is generally Art. 6(1)(f) GDPR: the legitimate interest in secure and verifiable transmission.

6. Transfer records

For every transfer, we create a transfer record for the sender's account covering sending, delivery, download, confirmation, receipt and deletion. It contains the times and types of events, names and email addresses of the parties involved (sender, recipients with an account, confirmed recipients and uploaders), the device name, the browser indication, file sizes and checksums, failed PIN or code entries, and an encrypted part that only the sender's devices can read. Each event is signed and chained to the previous one.

Transfer records are automatically deleted ten years after the respective event. During the term of the contract, no one can modify or delete them early, not even the sender. Via the verification page, anyone who knows the fingerprint (hash) of an event can retrieve the time, type and signature of that event, but no names or addresses.

To protect against subsequent modification, we send a single fingerprint (32 bytes) covering all new transfer records every hour to public OpenTimestamps servers, which anchor it in the Bitcoin blockchain. No content or persons can be derived from the fingerprint.

The legal basis is Art. 6(1)(f) GDPR. The sender's legitimate interest lies in proving proper and data-protection-compliant transmission (accountability under Art. 5(2) GDPR). Transfer records prove download and unaltered decryption, not that a specific person has taken note of the content.

7. Service emails

Our server sends confirmation codes, notifications of new transfers in the inbox and notifications of requests from notify@slayper.com. The notifications can be turned off in the app settings; the codes cannot. Replies to these emails go to the person from whom the transfer or request originates. The emails contain no tracking pixels; the logo is embedded in the email.

Delivery runs via mailbox.org, a service of Heinlein Hosting GmbH, Schwedter Str. 8/9A, 10119 Berlin, as processor.

8. Apps for Mac and Windows

The apps store credentials and keys in the Mac keychain or protected by Windows (DPAPI), as well as a history of your transfers on the device. The apps do not send usage statistics or crash reports and do not check for updates on their own.

Digital signing

When you digitally sign a document, the app obtains a timestamp according to RFC 3161. For this, it sends only a checksum of the signature to a timestamp service, one after the other until one responds: DigiCert, Sectigo, Certum and FreeTSA. On request, the checksum of the signed document is additionally anchored with OpenTimestamps; for verification, the app queries block data from blockstream.info. No content of the document is transmitted. Through the connection, the respective service technically receives the IP address of your device. DigiCert and Sectigo are based in the USA. The feature is optional; the legal basis is Art. 6(1)(b) GDPR.

9. Outlook add-in

The add-in runs in Microsoft Outlook and loads Microsoft's Office.js library for this purpose. When an email is being written, it reads the recipients and the attachments in order to encrypt the files, and inserts a link block into the email. Microsoft is an independent controller for Outlook itself; its privacy terms apply. The logo in the link block is loaded from our server when the email is opened; we do not log these requests.

10. Integration with business software

Customers can connect Slayper to their business software, for example a CRM. We then report events relating to transfers to the customer's business software: time and type, reference ID, email address and browser indication of the person downloading, recipient list, number and size of files, name and email address of uploaders, and information on protection and expiry. In the window embedded in the business software, Slayper passes the finished link including the key and, where applicable, the PIN to the business software so that it can send the email, as well as decrypted files if the user saves them there. The customer is the controller for the processing in the business software. We delete reported events 30 days after delivery.

11. Recipients and processors

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen: servers and object storage in the Falkenstein/Vogtland data center, Germany.
• Heinlein Hosting GmbH (mailbox.org), Schwedter Str. 8/9A, 10119 Berlin: delivery of the service emails.

Data processing agreements pursuant to Art. 28 GDPR are in place with both. Beyond this, we only disclose data if you or the customer initiate it (Sections 8 to 10) or if we are legally obliged to do so.

12. Transfers to third countries

The service itself processes data exclusively in Germany. A connection to providers outside the EU arises only with optional features: digital signing (Section 8) and the use of Microsoft Outlook (Section 9).

13. Retention periods at a glance

• Transfers: 48 hours (incomplete ones 24 hours)
• Requests: valid for 2, 7 or 14 days, deleted 7 days after expiry
• Confirmation codes: 10 minutes
• Sign-in sessions: 30 days
• IP addresses for the sign-in throttle: in memory only, no more than 15 minutes
• Events reported to business software: 30 days after delivery
• Transfer records: 10 years
• Account after termination: 30 days

14. Security

Encryption with AES-256-GCM on the device, key exchange via P-256, transmission only via TLS 1.2 or 1.3, passwords and PINs hashed with scrypt, access to storage only via short-lived signed URLs, no access log on the web server. Details can be found in the Data Processing Agreement (Annex 2).

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). For data that we process on behalf of others, the sender is your point of contact (Section 2). For transfer records, erasure before the end of the retention period may be excluded as long as the sender needs them to fulfill their accountability obligation.

To exercise your rights, an email to info@slayper.com is sufficient. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Data Protection Commissioner of the State of Brandenburg (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow.

16. Automated decision-making

No automated decision-making, including profiling, takes place.

Last updated: October 18, 2026