Privacy policy

Last updated: 19 October 2026

NoLoginUpload is a Nostello product. It is operated by Nostello OÜ, Ahtri Street 12, 15551 Tallinn, Estonia (“Nostello”, “we”, “us”). This policy explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

Privacy contact: Sheldon Halgreen, Privacy Officer – sheldon@noscotek.co.za.

1. Our role: controller and processor

• Form owners (account data): we are the controller. This covers the people who sign in to NoLoginUpload to connect a Google Form.
• Respondents (answers and files): we are a processor. When you fill in or upload to a form, the form owner is the controller and decides why your data is collected. We process it only on their instructions, to deliver it to their Google Form and Google Drive. Our processing for form owners is governed by the data processing terms in section 6 of our Terms of service (GDPR Art. 28).

2. What we collect

• Form owners:
  • Your Google account email and Google account ID.
  • An OAuth refresh token, stored encrypted with AES-GCM.
  • The structure of the forms you choose to connect (questions, options, titles) and your settings.
  • Billing status from Stripe. We never see full card numbers.
• Respondents:
  • The answers you type are held encrypted only until they are delivered to the form owner's Google Form, then deleted. If delivery keeps failing, they are deleted after at most 7 days.
  • Uploaded files are sent directly to the form owner's Google Drive. We do not keep a copy.
  • To prevent abuse, we record each file's name, size and type, and a one-way hash of your IP address.
• Technical data: security and error logs (for example timestamps, request paths and hashed IP addresses), and anti-bot checks via Cloudflare Turnstile.

3. Google user data and Limited Use

We request only these Google permissions:

• openid and email, to sign you in.
• drive.file, which gives access only to files you pick with the Google Picker or that NoLoginUpload creates.

We use them to read the forms you connect, create folders and files for uploads in your Drive, rename uploaded files, and post respondents' answers into your Google Form.

NoLoginUpload's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We use Google user data only to provide and improve the user-facing features described here.
• We do not sell it.
• We do not use it for advertising, credit-worthiness or lending.
• We do not use it to train general-purpose AI or machine-learning models.
• No human reads it unless you ask us to (for support), it is needed for security or abuse investigation, or the law requires it.

You can revoke our access at any time at myaccount.google.com/permissions.

4. Why we process it (lawful bases, GDPR Art. 6)

• Contract (Art. 6(1)(b)): to create your account and provide the service you signed up for, including billing.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent phishing, spam and abuse (for example rate limits, anti-bot checks and hashed IP addresses), and fix errors. You can object to this processing (see section 7).
• Legal obligation (Art. 6(1)(c)): to keep accounting and tax records and to answer lawful requests from authorities.
• Respondent data: the form owner, as controller, is responsible for having a lawful basis and giving respondents any notice that is required. We process respondent data only on their instructions.

5. Who we share it with (sub-processors) and international transfers

• Google: your Google Drive and Google Forms, where your data ends up. Sign-in also runs through Google.
• Cloudflare, Inc.: hosting, database and anti-bot checks (Turnstile).
• Stripe: payments, subscriptions and invoices.

These providers may process data outside the European Economic Area, in particular in the United States. Where they do, we rely on:

• the EU–U.S. Data Privacy Framework, where the recipient is certified under it; or otherwise
• the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)), included in each provider's data processing terms.

You can ask us for a copy of the relevant safeguards. We will update this list before adding any new sub-processor.

6. How long we keep it

• Respondent answers: until they are delivered to Google Forms, and never longer than 7 days. Files are never stored by us.
• Owner account and form settings: while your account is active. They are deleted within 30 days after you ask us to delete your account.
• Security logs and response metadata (file name, size, type, hashed IP address): 12 months.
• Accounting records: as long as Estonian accounting law requires (7 years under the Accounting Act).

7. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• have it corrected (Art. 16);
• have it erased (Art. 17);
• restrict processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21).

To use these rights, email sheldon@noscotek.co.za. We will reply within one month, as the GDPR requires.

If you are a respondent, the form owner controls what is in their Drive and Google Form. Please contact them first; we will help them answer your request.

You have the right to lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. You may also complain to the authority in the EU/EEA country where you live or work.

8. South African users (POPIA)

If you are in South Africa, you also have rights under the Protection of Personal Information Act, 2013 (POPIA), including access, correction and deletion. You may complain to the Information Regulator (South Africa). Transfers out of South Africa rely on the safeguards described in section 5.

9. Security

Our safeguards include:

• encryption in transit (HTTPS), and at rest for tokens and pending answers;
• least-privilege Google permissions;
• per-response upload sessions that expire;
• anti-bot checks and rate limits.

No system is perfectly secure. If a personal data breach is likely to put people at risk, we will notify the supervisory authority within 72 hours where the GDPR requires it (Art. 33). Where the risk is high we will also tell the people affected (Art. 34), and, as a processor, the form owners concerned without undue delay.

10. Children

The service is not directed at children under 18 as account holders.

11. Changes

We will post changes here and email account holders about material changes.