Last updated: October 29, 2026
1. Who we are
OriginDrive is operated by Loom Marketing Limited, C03, 9/F, Kato Factory Building, 2 Cheung Yue Street, Lai Chi Kok, Kowloon, Hong Kong ("we", "us"). We are responsible for the personal information described in this Policy. Contact for privacy questions and requests: [email protected].
2. Information we collect
Account information: name, email address, password (stored only as a secure hash), language, country and time zone, and, if you sign in with Google, your Google account name, email and profile picture.
Your files: the files you upload and their metadata (file names, types, sizes, folders, dates, sharing settings and the people you share with).
Payment information: your plan, invoices, payment status and payment references. Card details are entered on Stripe's secure form and processed by Stripe; we only receive the card brand, the last four digits and the expiry date. We never see or store your full card number.
Technical information: IP address, browser and device type, pages visited, login and security events, and error logs.
Offer page analytics: on our promotional pages (origindrive.app/offers/…), we record visits, the page version you saw, referral and campaign source, approximate location derived from your IP address, and your IP address.
Support messages: what you send us by email or the contact form.
3. How we use it
To provide storage, sharing, previews and your account (performance of our contract with you).
To take payments, issue invoices and refunds, and prevent fraud (contract and legal obligations).
To send service emails: account confirmation, password resets, receipts, refund confirmations, payment problems, account activation and reminders to activate or confirm your account (contract).
To protect the Service against abuse, spam and attacks (legitimate interests).
To understand how our pages perform and improve them, using analytics only after you accept them (consent).
To send a reminder if you start a checkout on an offer page and do not finish it, only if you agreed to receive such reminders (consent). Every reminder contains an unsubscribe link.
We do not sell your personal information. We do not look at, sell or use the contents of your files for advertising or to train AI models.
4. Service providers we use
Contabo GmbH (Germany): hosts our servers. Your files and account data are stored on servers in Germany.
Cloudflare, Inc.: delivers and protects the website (content delivery, DDoS protection) and provides the Turnstile anti-bot check on sign-up and contact forms.
Stripe, Inc. / Stripe Payments Europe: processes payments, refunds and subscriptions. Stripe's privacy policy: stripe.com/privacy.
Google LLC: "Sign in with Google" (only if you use it), and Google Workspace, which sends our emails.
Microsoft Corporation (Microsoft Clarity): website analytics, including heatmaps and session recordings, loaded only after you accept analytics cookies.
MaxMind GeoLite2: a database stored on our own server that estimates your country from your IP address. No data is sent to MaxMind.
These providers process data only to provide their services to us. Some of them are located outside your country, including in the United States. Where the GDPR or UK GDPR applies, these transfers are protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. Who can see your files
Only you and the people you choose to share with can see your files. Anyone with a public link can open the shared file or folder until you remove the link or it expires. Our staff access files only when needed to provide support you asked for, to investigate abuse reports, or when the law requires it. Files are encrypted in transit (HTTPS); they are not end-to-end encrypted.
We disclose information to authorities only when legally required.
6. How long we keep data
Account and files: while your account is open. When you delete your account, your files and account data are deleted immediately.
After a refund: files are kept for 30 days so you can download them, then permanently deleted.
Trash: files you delete go to Trash until you empty it or delete them permanently.
Payment records and invoices: kept for 7 years, as required by tax and accounting law, even after account deletion.
IP addresses from offer page analytics: deleted after 90 days.
Server error logs: 14 days.
7. Cookies
We use essential cookies to keep you signed in and to protect forms. Analytics cookies are used only after you accept them. See our Cookie Policy for the full list.
8. Security
We use HTTPS encryption, hashed passwords, access controls, anti-bot checks and regular updates. No online service can guarantee complete security; please use a strong, unique password and share links carefully.
9. Your rights
You can access, correct, download or delete your data. Most of this is available directly in your account: edit your profile in Account settings, download your files from your drive, and delete your account in Account settings → Danger zone. You can also object to or restrict certain processing, withdraw consent at any time, and complain to your data protection authority. To make a request, email [email protected] from your account email. We answer within one month. See also Data Subject Rights.
10. Children
OriginDrive is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has created an account, contact us and we will delete it.
11. Changes
We will post changes to this Policy on this page with an updated date, and notify you by email of material changes.