Data storage and privacy

With Document Library Pro, you can either store your documents yourself, whether this is on a service such as Dropbox or Google Drive or your own servers, or you can upload the files directly to Document Library Pro.

This page describes how we store all the information in Document Library Pro. If you make your own arrangements for storing the files, then you should also refer to the privacy policy of your chosen final storage service.

Where your data is held

Kinsta hosts your library on Google Cloud infrastructure in Frankfurt, Germany. That covers your document titles, categories, settings and any file you upload to us. We don’t move your library to another region.

A file you host somewhere else, such as Dropbox, Google Drive or your own server, stays with that service. We store the link to it and not the file itself.

Cloudflare screens traffic and delivers content in front of the service. To serve visitors quickly, Cloudflare caches public documents at edge locations around the world. Cloudflare handles connection data such as IP addresses at those locations. Stripe may handle payment data outside the UK and the European Economic Area. Where data crosses a border, we rely on our providers’ standard contractual clauses.

Barn2 Media Limited is a UK company. We’re the data controller for your account and billing details. For everything in your library, we act as your processor and you remain the controller.

How we protect your documents

• We encrypt every request to and from your library with HTTPS/TLS. That is the standard behind the padlock in your browser.
• Our hosting provider encrypts the disks that hold your documents.
• Each customer’s library runs as its own isolated site, with its own database tables.
• Only authorized staff can reach customer data.
• Stripe takes the payment. We never see or store your card number.
• Kinsta backs up the service and your library on a schedule. We can restore a library if we need to.
• Cloudflare filters malicious requests out in front of the service.
• Your library loads inside an iframe when you embed it on another website. For a password-protected library, we check the password on our server before we send any content. The embed doesn’t rely on third-party cookies.

No online service can promise to be completely secure. We’d still recommend you keep your own copies of important documents.

Who can see your library

You control who can see it. A library can be open to everyone, or you can protect it with a password on the Advanced plan. Whichever plan you’re on, you can embed your libraries on a page or website that you have made private (such as a company intranet) so nobody else will see them.

Our staff don’t read your documents. We open your library in two situations only: when you ask us for help with it, and when something has broken and we have to fix it. Only the staff who run the platform can do this.

The providers that handle your documents

• Kinsta hosts the service and your library on one of their servers in Frankfurt, Germany. Read Kinsta’s privacy policy.
• Google Cloud provides the infrastructure those servers run on. Read Google Cloud’s privacy notice.
• Cloudflare screens traffic in front of the service and caches public documents at its edge locations. Read Cloudflare’s privacy policy.

Each one acts as our processor. They use your data only on our instructions and are required to protect it.

Two other providers handle your account rather than your documents. Stripe takes payments and Mailgun sends our account emails. Neither one can reach your library. We run our own email marketing system on our own servers. Your contact details never go to a separate marketing company. We don’t sell personal data to anyone.

Your visitors

Your library works without collecting personal data from the people who read it. If you switch on lead capture, we email each address a visitor submits straight to you. We don’t store the address ourselves. We don’t set advertising cookies or third-party analytics cookies on your library.

What happens if you cancel

Your library stays online until the end of the period you’ve paid for. It then goes offline. We keep your documents and settings for the next 30 days, so you can reactivate and carry on where you left off.

We email you 14 days before that window closes. At 30 days, we permanently delete your library, documents and settings. If you’d rather we deleted everything sooner, email us and we’ll do it.

Your rights over your data

You can ask us to access, correct, delete or export your personal data, along with all your documents and the files attached to them. You can also object to or restrict some processing. Email privacy@barn2.com and we’ll sort it out. You have the right to complain to your local data protection authority too, which in the UK is the Information Commissioner’s Office.

Procurement and paperwork

If you buy the corporate plan, we can provide the extra paperwork your procurement team needs. That includes a signed data processing agreement. Tell us what your organization requires and we’ll work with you on it. Read more about the corporate plan.

Barn2 Media Limited is registered in England and Wales (company number 08565444). Our UK VAT number is GB188117584 and our EU VAT number is EU372023207. Our registered office is Harscombe House, 1 Darklake View, Estover, Plymouth PL6 7TL, United Kingdom.

More detail

You’ll find the full detail in our privacy policy and our terms of business. For anything else, email privacy@barn2.com.