Privacy Policy

Last updated: October 24, 2026

This Privacy Policy explains how Light Speed Consulting Corporation, operating as Onlinedrive ("Onlinedrive", "we", "us"), collects, uses, stores and shares personal information when you visit onlinedrive.io, create an account, or use the Onlinedrive cloud storage service (the "Service"). It also explains the choices and rights you have.

We are based in Waterloo, Ontario, Canada, and we comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR or UK GDPR also applies and we act as the controller of your account data and as a processor of the files you store. If you are a California resident, the California Consumer Privacy Act applies. Specific rights for each are described in section 9.

1. Our approach in brief

  • Your files are yours. We do not read, scan for advertising, sell or share the content of your files. We only process them to store, preview and share them as you direct.
  • You choose where files live. File content is stored in the storage region you pick when you create a drive account and is not moved to another region.
  • We collect little. We need an email address, a password and, for paid plans, billing details. Everything else is optional or is generated by your use of the Service.
  • No data sales. We have never sold personal information and we do not do so.

2. Information we collect

Account information. Email address, name, password (stored only as a salted hash), country and province or state for tax calculation, optional company name, phone number and billing address, language and time zone preferences, your profile picture if you add one, and whether two-factor authentication is enabled. If you sign in with Google, we receive your name, email address and Google account identifier.

Billing information. Plan, billing cycle, invoices, payment history, coupon and affiliate codes, and the redemption code you used if you came from a partner offer. Card and PayPal details are collected directly by our payment processors (Stripe and PayPal); we see only the card brand, last four digits and expiry. Cryptocurrency payments are handled by NowPayments and we receive confirmation of payment, not your wallet keys.

Your files and file metadata. The files you upload (their content), and metadata we need to run the Service: file names, sizes, types, folder structure, thumbnails and previews we generate, starred and trash status, timestamps, share links and their settings (including a hashed password if you set one), the people you share with, workspaces, members and invitations.

Support and communications. Tickets, replies, attachments you send to support, emails you send us, and our records of emails we sent you (template, recipient, time and delivery status).

Usage and device information. When you use the Service we record the IP address, browser and device type, pages and actions (for example sign-in, upload, share link created, file deleted) with timestamps. On sign-in we look up the approximate location and network of the IP address to detect suspicious access. We keep an activity log of significant account events for security and for showing you what happened in your account.

Affiliate and marketing data. If you arrive through an affiliate link we record the referring affiliate in a cookie so they can be credited if you buy. If you begin a checkout and do not finish, we may store the items in your cart with your email so we can send you a reminder.

Cookies. See section 7.

We do not knowingly collect information from children under 18 and the Service is not directed at them.

3. How we use information

We use personal information to:

  • create and secure your account, authenticate you and detect fraud or unauthorised access;
  • store, serve, preview and share your files as you instruct, and operate workspaces and invitations;
  • process payments, send receipts and renewal notices, calculate taxes and prevent payment fraud;
  • provide customer support and respond to your requests;
  • send service messages (security alerts, billing, changes to terms) and, if you agree, marketing emails you can unsubscribe from at any time;
  • measure and improve the website and Service, including aggregated statistics about usage and performance;
  • operate our affiliate program and attribute referrals;
  • comply with law, enforce our Terms, and protect the rights and safety of Onlinedrive, our customers and the public.

Our legal bases under GDPR are: performance of our contract with you (providing the Service and billing), our legitimate interests (security, fraud prevention, improving the Service, limited marketing to existing customers), your consent (optional marketing, non-essential cookies and advertising pixels), and compliance with legal obligations (tax and accounting records, responding to lawful requests).

4. Where your information is stored

File content is stored on encrypted object storage in the region you selected for that drive account:

  • US West: Los Angeles, California, USA
  • US East: Virginia, USA
  • Canada: Montreal, Quebec, Canada
  • United Kingdom: London, England
  • Europe: Frankfurt, Germany
  • Asia Pacific: Singapore

We do not copy file content between regions. If you want files in another region, you open a drive account there and move them yourself.

Account and metadata (your account record, billing, support tickets, file names and folder structure, sharing records, activity logs) are stored in our application database and its backups, which are hosted on infrastructure in the United States and Canada, with encrypted nightly backups kept on object storage. Support ticket attachments are stored on encrypted object storage in North America. This means that even if your files live in Frankfurt or London, the metadata about them is processed in North America. We rely on standard contractual clauses and the UK International Data Transfer Addendum for transfers of EU and UK personal data, and Canada is recognised by the European Commission as providing adequate protection for commercial data.

5. How we protect information

  • All traffic between your browser and the Service, and between the Service and storage, uses TLS encryption.
  • Files are encrypted at rest on the storage systems in each region; database and backups are encrypted at rest.
  • Passwords are stored as salted bcrypt hashes; share-link passwords are hashed too. We cannot see them.
  • Two-factor authentication is available to every account and we encourage you to enable it.
  • Access to production systems is limited to staff who need it, protected by strong authentication, and logged. Staff may access the metadata of your account to provide support you request or to investigate abuse; they do not open your files unless you ask us to or we are legally required to.
  • Download and preview links are time-limited signed URLs.
  • We keep encrypted backups so that a hardware failure or operator error does not lose your data.

No system is perfectly secure. If we discover a breach that affects your personal information we will notify you and the relevant authorities as required by law, including PIPEDA's breach-reporting rules and the GDPR's 72-hour requirement.

6. When we share information

We share personal information only with the service providers we need to run Onlinedrive, each bound by contract to use it only for that purpose:

  • Storage providers that operate the object storage in each region (file content, under encryption).
  • Payment processors: Stripe and PayPal for card and PayPal payments, NowPayments for cryptocurrency.
  • Infrastructure and hosting providers for our application servers, database and backups.
  • Email delivery providers for transactional and marketing email.
  • Cloudflare Turnstile, which checks that sign-up and contact forms are submitted by people, not bots. It processes your IP address and browser signals.
  • Website analytics: we use Rybbit, a privacy-focused analytics tool that does not use cross-site tracking cookies, to understand how the marketing website is used.
  • Advertising measurement: our marketing pages (not the client panel) may load the Meta Pixel and Taboola Pixel so we can measure advertising campaigns. These set cookies and share limited browsing data with Meta and Taboola. They load only with your consent where the law requires consent.
  • Affiliates see aggregated statistics about referrals and commissions, never your name or email.
  • Partners who sold you a redemption code may receive confirmation that a code was redeemed, so they can honour their own terms.

We also disclose information when required by law, court order or a lawful government request; when necessary to enforce our Terms, protect against fraud or security threats, or protect the rights and safety of others; and to a successor if Onlinedrive or Light Speed Consulting Corporation is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

When you share files, the people you share with see what you choose to share, including your name or email as the sharer. Workspace members can see each other's names and email addresses.

7. Cookies and similar technologies

We use a small number of cookies:

  • od_session, od_admin_session (strictly necessary): keeps you signed in.
  • od_active_service, active-workspace (strictly necessary): remembers which drive account and workspace you are viewing.
  • od_share_* (strictly necessary): remembers that you entered the password for a protected share link, for 12 hours.
  • Affiliate referral cookie (functional): credits the affiliate who referred you, for up to 90 days.
  • Rybbit analytics (analytics): aggregated website statistics without cross-site tracking.
  • Meta Pixel, Taboola Pixel (advertising, consent-based): advertising measurement on marketing pages only.

You can delete or block cookies in your browser; blocking strictly necessary cookies will stop you signing in. Where the law requires it we show a consent notice before loading analytics and advertising cookies. We do not respond to browser "Do Not Track" signals because there is no agreed standard, but we honour the Global Privacy Control signal by not loading advertising pixels when it is present.

8. How long we keep information

  • Files and metadata: for as long as your drive account exists. Files you delete go to Trash and count against your quota until you empty it; permanently deleted files are removed from primary storage immediately and from backups within 35 days.
  • Closed or terminated accounts: files are kept for 30 days after termination so the account can be restored on request, then permanently deleted. Account records are deleted or anonymised within 90 days, except as noted below.
  • Billing records: invoices, payments and tax information are kept for 7 years as required by Canadian tax law.
  • Support tickets: 3 years after the ticket is closed.
  • Security and activity logs: 12 months.
  • Database backups: nightly backups are kept for 30 days, with one monthly backup kept for 12 months for disaster recovery. Information in a backup is not restored to production except to recover from an incident.
  • Marketing data: until you unsubscribe or 2 years after your last interaction.

9. Your rights and choices

You can view and update most account information in Profile and Billing in the client panel, download all of your files at any time, delete files, revoke share links and invitations, and close drive accounts. You can unsubscribe from marketing email with the link in every message.

Depending on where you live you may have the right to:

  • Access the personal information we hold about you and receive a copy in a portable format;
  • Correct inaccurate information;
  • Delete your information ("right to be forgotten"), subject to our legal retention obligations;
  • Restrict or object to certain processing, including direct marketing, at any time;
  • Withdraw consent where processing is based on consent, without affecting processing already carried out;
  • Lodge a complaint with a supervisory authority: the Office of the Privacy Commissioner of Canada, your EU member state's data protection authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency.

To exercise these rights, email support@onlinedrive.io from the address on your account or open a ticket at /contact. We will verify your identity, respond within 30 days (PIPEDA and GDPR) or 45 days (CCPA), and will not discriminate against you for exercising your rights.

California residents. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined by the CCPA, other than through the advertising pixels described above, which you can decline. The categories of personal information we collect, the purposes, and the recipients are described in sections 2, 3 and 6.

EU and UK residents. Our representative for GDPR purposes can be reached at the address in section 12. Transfers outside the EEA and UK are described in section 4.

10. Your files and other people's privacy

When you store or share information about other people, you are responsible for having the right to do so. If you are a business using Onlinedrive to store personal data of your customers or employees, you are the controller of that data and we process it on your instructions under our Terms of Service. Contact us if you need a data processing agreement.

11. Changes to this policy

We will post any changes here with a new "last updated" date. For material changes we will notify you by email or in the client panel before they take effect. Earlier versions are available from support on request.

12. Contacting Onlinedrive

If you have questions about this policy, want to exercise your rights, or have a concern about how your information is handled, please contact:

Onlinedrive
A division of Light Speed Consulting Corporation
Attention: Privacy Officer
299 Northfield Drive East
Suite 1A Upper
Waterloo, Ontario N2K 4H2
Canada

Email: support@onlinedrive.io
Support: onlinedrive.io/contact

We will acknowledge your message within 5 business days.