Who we are
Fylnest is run by ARKHV Group (Pty) Ltd (registration number 2026/230380/07), 7 Ravenscraig Rd, Woodstock, Cape Town, 7925, South Africa (“we”, “us”). We are the responsible party under South Africa’s Protection of Personal Information Act (POPIA) and the controller under the EU/UK GDPR for the personal information described here. Contact us, including our information officer, at hello@fylnest.com.
For files you store or send with Fylnest, you decide what’s in them. We handle those files only to provide the service to you.
What we collect and why
| What | When | Why (legal basis) |
|---|---|---|
| Email address, optional name, optional “what do you send” choice, where you signed up from, date | You join the waiting list | To tell you when Fylnest launches (your consent; you can withdraw it any time) |
| A one-way scrambled (hashed) version of your IP address | Waiting list, sign-in and upload links | To stop spam and abuse with rate limits (our legitimate interest in keeping the service safe) |
| Account details: email, name, password (stored hashed), team membership | You have a Fylnest account | To provide your account (contract) |
| Google account email and name | You choose “Sign in with Google” | To sign you in (contract). We only ask Google for your basic profile and email |
| Two-step verification secret (encrypted) and backup codes (hashed) | You turn on two-step verification | To protect your account (contract, security) |
| Connected computers and drives (names, free space, online status), share links, upload links and their settings, download counts and an activity log | You use the portal | To run the features you use (contract) |
| Files and file names | You store, send or receive files | To transfer and store them for you (contract) |
| Technical logs (such as IP address, browser and errors) kept by our hosting providers | Any visit | To run, secure and fix the service (legitimate interest) |
We don’t sell personal information, we don’t use advertising or analytics trackers on the site, and we don’t use your files to train anything.
Cookies and browser storage
We use only what’s needed: a sign-in cookie that keeps you signed in for up to 7 days, a short-lived cookie during two-step sign-in and Google sign-in, and small browser settings (such as your view choice or the line speed you entered) stored on your own device. No advertising cookies.
Who helps us run Fylnest
We use these service providers (operators/processors). They process information on our instructions only:
- Vercel: hosts the website and portal.
- Supabase: stores account, waiting-list and portal data.
- Cloudflare: domain and network, R2 storage for Fylnest cloud files, and the line speed test servers.
- Google: only if you choose Google sign-in.
- Resend: sends account emails, such as welcome and password-reset messages, as those are switched on.
- Paddle: when paid plans launch, Paddle will handle checkout and billing as merchant of record. We won’t see your full card details.
Some of these providers process data outside South Africa and the EU, including in the United States. Where that happens we rely on the safeguards the law requires, such as the providers’ data-processing terms and standard contractual clauses.
How long we keep it
Waiting-list details until launch communications are done or you ask us to remove them. Account data for as long as you have an account, then deleted within a reasonable time unless the law requires us to keep something longer (for example, billing records). Files on your own drive are never stored by us; files in Fylnest cloud until you delete them or close your account. Rate-limit counters last minutes to hours.
Security
Connections are encrypted (HTTPS). Passwords and backup codes are hashed, two-step secrets are encrypted, link tokens are stored hashed, and upload links can only write into one folder. No system is perfectly secure; if a breach affects you, we’ll tell you and the regulator as the law requires.
Your rights
You can ask to see, correct or delete your personal information, object to or restrict how we use it, take a copy of it, and withdraw consent (for example, leave the waiting list). Email hello@fylnest.com and we’ll respond within the time the law allows.
If you’re unhappy, you can complain to South Africa’s Information Regulator (inforegulator.org.za) or, if you’re in the EU or UK, your local data protection authority.
Children
Fylnest isn’t meant for children under 18, and we don’t knowingly collect their information.
Changes
If we change this policy we’ll update the date at the top, and tell you directly about important changes.