Last updated 17 July 2026
This policy explains what personal data CloudBox collects, why, and the rights you have over it. CloudBox is a UK-based cloud storage, backup and file-transfer service operated by Octrax Holdings Limited ("CloudBox", "we", "us"), a company registered in England & Wales. We are the data controller for the personal data described here.
To provide and secure the service; to verify email addresses and send transfer links; to process payments and manage subscriptions; to prevent fraud and abuse; to respond to your requests; to meet our legal obligations; and, where you have consented or we have a legitimate interest, to tell you about relevant CloudBox features. You can opt out of marketing at any time.
We rely on: performance of a contract (running your account and transfers); legitimate interests (security, service improvement, limited marketing); legal obligation (tax, responding to lawful requests); and consent where required (e.g. non-essential communications).
Free transfers are zero-knowledge: your file is encrypted in your browser before upload and the decryption key lives only in the share link, which we never receive. We store only ciphertext and cannot read your file contents. Drive files are encrypted at rest. Because of this design, if you lose your key or link we cannot recover the contents for you.
We do not sell your personal data. We share limited data only with processors that help us run the service, under contract and appropriate safeguards: Stripe (payments), Resend / Amazon SES (transactional email such as codes and receipts), and our own UK-based infrastructure providers. We may disclose data where required by law or to protect our rights, users or the public.
Your files and drive data are stored on hardware we operate in the United Kingdom. Some processors (e.g. Stripe, email delivery) may process limited data outside the UK; where they do, we rely on appropriate safeguards such as UK/EU adequacy or standard contractual clauses.
Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. To exercise any of these, email hello@cloudbox.biz. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
We use only the cookies and local storage needed to run the service (for example, keeping you signed in). We do not use advertising or cross-site tracking cookies.
We protect your data with encryption in transit (TLS) and at rest, zero-knowledge encryption on transfers, two-factor authentication by default, access controls, and UK-based infrastructure we operate. No system is perfectly secure, but we work to protect your data and will notify you and the ICO of any breach as required.
CloudBox is not intended for children under 16. We do not knowingly collect data from children.
Questions or requests about this policy or your data: hello@cloudbox.biz. Data controller: Octrax Holdings Limited, registered in England & Wales (company number and registered office to be confirmed on request).
This policy is provided in good faith and kept up to date. If we make material changes we will update the date above and, where appropriate, notify you.