Privacy policy

1. Who we are

HyperFiler is a Microsoft Outlook add-in developed and operated by Hyper Holdings Ltd, a company registered in England and Wales. In this Privacy Policy, "we", "us" and "our" refer to Hyper Holdings Ltd.

If you have any questions about this policy, please contact us at privacy@hyper-filer.com.

2. What data HyperFiler processes

HyperFiler is designed to minimise data collection. Your email content, attachments, and filing patterns pass through our infrastructure only in transit when needed to carry out the actions you initiate; we do not retain, log, or read this data afterwards. The details follow.

Data processed on your device (localStorage)

The following data is stored locally in your browser's localStorage and never transmitted to our servers:

• Your Microsoft account email address and display name (for display purposes only)
• OAuth access and refresh tokens (for authenticating with Microsoft Graph API)
• Your email filing history: a record of which folders you have filed emails to, keyed by sender email address or domain
• Your OneDrive folder preferences
• Your application settings and preferences

Data processed transiently through our Worker

HyperFiler uses a Cloudflare Worker as a secure proxy between the add-in and Microsoft Graph API. The following data passes through this Worker but is never logged or stored:

• Your Microsoft OAuth tokens (used to authenticate Graph API requests on your behalf)
• Email metadata (sender, folder ID, message ID) when filing or moving emails
• Attachment content when saving to OneDrive
• Email content when you choose to save an email copy to OneDrive

The Cloudflare Worker is stateless. No email content, attachment content, or personal data is retained after a request completes.

Data we do not collect

• We do not read, store, or transmit the body of your emails for any purpose other than the file-to-OneDrive feature you explicitly opt into
• We do not store your email addresses, contacts, or calendar data
• We do not use analytics or tracking cookies
• We do not sell your data to third parties
• We do not use your data for advertising

3. Microsoft Graph API access

HyperFiler uses Microsoft Graph API with the following delegated permissions, which you grant when you sign in:

• Mail.ReadWrite: to read your folder list and move emails between folders
• Files.ReadWrite.All: to save attachments and email copies to your OneDrive
• User.Read: to display your name and email address in the add-in

These permissions operate on your behalf only. HyperFiler has no access to any other user's mailbox or files. You can revoke these permissions at any time through your Microsoft account settings at myaccount.microsoft.com.

4. Third-party services

HyperFiler uses the following third-party infrastructure:

• Cloudflare Workers: for the secure OAuth proxy. Cloudflare may retain standard request logs (IP address, timestamp, HTTP method) in accordance with their privacy policy.
• Netlify: for hosting the add-in frontend. Standard web server logs may be retained by the hosting provider in accordance with their privacy policy.
• LemonSqueezy: for processing subscription payments. LemonSqueezy acts as Merchant of Record and handles billing, VAT, and payment data in accordance with their privacy policy.
• Microsoft: your email and OneDrive data is held by Microsoft under your existing Microsoft 365 agreement.

5. Data retention and deletion

All data stored by HyperFiler is held locally on your device in your browser's localStorage. You can delete all HyperFiler data at any time by:

• Signing out of HyperFiler using the Sign out button (clears tokens and folder cache)
• Clearing your browser's localStorage manually via browser developer tools
• Uninstalling the HyperFiler add-in from Outlook

We have no ability to access or delete data stored on your device as we do not hold a copy of it.

6. Your rights

Under UK GDPR you have the right to access, correct, or erase personal data held about you. HyperFiler does not retain personal data on our servers after a request completes (see Section 2 for what passes through our infrastructure in transit). Practically, these rights are exercised directly through your device's localStorage (see Section 5) and through Microsoft for data held in your Microsoft 365 account.

If you have a privacy concern or complaint, please contact privacy@hyper-filer.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Legal basis for processing

The legal basis for processing your data under UK GDPR is your consent, given when you sign in to HyperFiler using your Microsoft account and grant the requested permissions. You may withdraw consent at any time by revoking permissions in your Microsoft account settings.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the date at the top of this page. Continued use of HyperFiler after changes constitutes acceptance of the updated policy.