Privacy notice

Tessera is the controller for the data described below except where stated otherwise. No company has been incorporated yet, so there is no registration number, registered address, VAT or tax identifier to publish. If a legal entity is established, its registered details will appear here.

Data protection contact: [email protected].

Account & billing dataController: Tessera

Contact email, account status, plan, prepaid balance, and billing records — top-ups, credits, debits, and reported usage. Top-ups are crypto-only: our payment subprocessors hold order metadata, wallet addresses, and transaction data; we never receive card numbers, bank details, or a billing address. Basis: performance of a contract. Retention: for the life of the account plus the statutory period applicable to financial records.

Sign-in & session dataController: Tessera

Email address, hashed magic-link tokens with the request time and issuing IP, hashed session tokens with their expiry and last-seen timestamps, and hashed agent API keys with their labels. Basis: performance of a contract, and legitimate interest for abuse prevention and security. Retention: sign-in links expire within 15 minutes; session records are kept until expiry or revocation; API key records are retained in revoked form to prevent reuse.

Storage credential identifiersController: Tessera

The public half of your ed25519 storage credential, which is also your storage account identifier, plus its state and caps. We do not retain the private half in any recoverable form. Retention: until revocation, then retained in revoked state to prevent reuse.

Request & usage recordsController: Tessera

Timestamps, endpoints, response codes, byte counts, and rate-limit counters, associated with a credential. Basis: performance of a contract for metering, and legitimate interest for abuse prevention and security. Retention: a rolling operational window, then aggregated.

Security & error logsController: Tessera

IP addresses, user agents, request identifiers, and stack traces. Basis: legitimate interest in securing the service. Retention: short, and no longer than needed for the purpose.

Customer contentProcessor: Tessera

Objects you store. We process these strictly on your instruction. Content is encrypted before it reaches us and we hold no filenames, paths, or content types. If your content contains personal data, you are the controller and we are the processor.

Website visitorsController: Tessera

Standard web server logs only. The public pages set no cookies, embed no third-party scripts, load no external fonts, and run no analytics or tracking of any kind. Signing in sets one essential session cookie, required to keep you signed in and used for nothing else.

Retention follows the account lifecycle rather than a fixed period. A funded account that runs out of balance enters past due and keeps serving through a grace window. If it is still unpaid, the account is suspended: storage is paused and funding stops, but nothing is deleted yet.

If the account remains suspended, storage contracts already funded are not renewed; when they end we revoke the storage credential, delete the account's objects, and queue their slabs for pruning from the storage providers. That step is not reversible. Revoked credentials and keys are retained in revoked form so they cannot be reused. Account, billing, and audit records are kept beyond deletion for the financial and security periods that apply to them.

Content is the exception in both directions: we cannot read it, so we cannot selectively retain or redact it. It is deleted in full when the account's storage contracts end, or when you delete it.

Our data model has no field for a filename, directory path, content type, or plaintext object size. This is not a retention policy that could be changed by configuration — those columns do not exist. Content arrives already encrypted and is never assembled in our infrastructure. The practical consequence is that for most privacy questions about content, the honest answer is that we do not have the information.

We do hold placement metadata and per-slab encryption parameters, which is what allows us to repair your data without your involvement. This is described precisely on our security page.

Only with the subprocessors we publish, for the purposes we publish. We do not sell personal data, do not share it for advertising, and do not use customer content to train anything.

Our control plane runs on a Kamatera cloud server in Singapore, and its backups are logical dumps on the same server — so the account, billing, and placement records we hold ourselves are processed in Singapore. Nightly copies of those backups are encrypted (GPG, AES-256) before they leave this server and pushed to a separate Kamatera server in Hong Kong, which holds only the encrypted files. The decryption passphrase is not stored on the backup server.

If you are in the EEA or UK, that means your account data is transferred to Singapore and (as encrypted backup copies) to Hong Kong. We have not yet papered those arrangements with Standard Contractual Clauses, so if your compliance programme requires a transfer mechanism for regulated personal data, contact us before storing it. Encrypted content is a different matter: it is encrypted before it leaves your machine, and no single jurisdiction holds a reconstructable copy.

You may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest. You may also lodge a complaint with your supervisory authority. We respond within one month.

Where a request concerns content you have stored, we will route it to you as controller and assist as processor — we cannot read the content and therefore cannot identify a data subject within it.

In the event of a personal data breach we notify the relevant supervisory authority within 72 hours of becoming aware of it, and affected customers without undue delay, with what we know at the time rather than after the investigation concludes.

Material changes will be announced before they take effect. This page will carry the effective date of the version in force.