Mega
Mega.nz is a cloud storage and file hosting service.
Score
Citation
"We may: collect Usage Date to assist in the operation and improvement of our services; join Usage Data with other users' data and give it to advertisers in a way which doesn't personally identify any particular user analyse and use Usage Data for marketing or statistical purposes as well as to improve the way we do business with our users; and serve advertisements or use third-party advertising companies to serve advertisements on our services and on third party sites, as well as to assist us in analysing our marketing and other business efforts."
"We collect and keep Usage Data with your consent to provide services and support related to our services, for market and product research and to be able to give users promotional material and special offers on our services."
Even if there is a reasonable delay before the data is fully deleted (as is common), the data still counts as "permanently deleted" and satisfies the parameters for this question.
Score
Citation
"When you delete one of Your Files it will be made inaccessible, marked for deletion and removed when the next appropriate file purging process is run, subject to any retention specifically allowed under this Policy or our Terms. After account termination, all Your Files will be marked for deletion and removed when the next appropriate file purging process is run, subject to any retention specifically allowed under this Policy or our Terms."
"For paid plans MEGA and its related or affiliated entities, payment processors and resellers that you use to make payments, retain account and payment information including a record of all transactions on your account."
"We may, but shall not be obliged to, keep Your Files after your account has been suspended or terminated. In particular, we may, but shall not be obliged to, keep Your Files where we consider it necessary for evidential purposes relating to a breach of our Cookie Policy, Terms or with respect to current or anticipated action by any competent enforcement authority or other third party."
"After account suspension or termination, including where the administrator of a business account, within which you have used the services, terminates that business account (see clause 13 below), we may, but shall not be obliged to, retain all Account Data if enforcement action is likely or commenced under our Terms, our Cookie Policy, or Takedown Guidance Policy or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data that identifies you will be anonymised, but where you are a contact of, have had a folder shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users."
This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).
Note that whether the policy allows sharing aggregated user data does not affect this question.
If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).
If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).
Score
Citation
"We will never sell Your Files, Your Chats, any Account Data or any Usage Data. We will not disclose or otherwise provide Your Files, Your Chats, any Account Data or any Usage Data to a third party, or make any other use of Your Files, Your Chats, any Account Data or any Usage Data, for any purpose which is not specifically allowed under this Policy, our Cookie Policy, our Terms or our Takedown Guidance Policy or is not incidental to the normal use of our services."
"If MEGA has disclosed the Account Data to any third party (such as a compliance authority), it will inform them of any correction where possible and will also inform the individuals about the third parties to whom the data has been disclosed where lawful and appropriate."
Score
Citation
"If we think it is necessary or we are obliged by law in any jurisdiction, then we are entitled to give Your Files, Your Chats, any Account Data and any Usage Data to competent authorities, even if those items are encrypted. We reserve the right to assist any law enforcement agency with investigations, including disclosure of information to them or their agents. We also reserve the right to comply with any legal processes, including but not limited to data breach notification processes, subpoenas, search warrants and court orders initiated by enforcement authorities or other third parties."
"If MEGA has disclosed the Account Data to any third party (such as a compliance authority), it will inform them of any correction where possible and will also inform the individuals about the third parties to whom the data has been disclosed where lawful and appropriate."
Score
Citation
"Data security is very important to Mega, whether that is your personal information or any other data. That is why we publish our client-side browser and mobile app software, provide a bug bounty to encourage reporting on any issues, and why we have provided information in this Policy on collection and storage of all data whether or not it is personal information. For more information on our security practices, see our security."
"We strongly urge you to use best practices for ensuring the safety of your systems and devices (e.g. via strong unique passwords, security upgrades, firewall protection, anti-virus software, securing devices). MEGA will never send an email asking for your password, so do not be fooled by any such email since it will not be from us. We cannot guarantee the security of computers or devices nor of transmission from and to your device over the Internet and thus cannot guarantee there will be no unauthorised access. Also, if you lose or otherwise allow access to your password or encryption keys, you will lose the security of all your data. If you forget your password you will lose access to all your data unless you have exported a Recovery Key. Using the same password for MEGA as you have used at other sites can lead to others accessing and taking control of your MEGA account if one of those other sites is breached or hacked."
Score
Citation
"We may make changes to this Policy in the future. Any changes will be notified to all users."
Note that all companies operating in the EU are subject to Art. 33 of the GDPR, which requires companies to notify their data protection authority of a data breach within 72 hours of discovering it.
Score
Citation
"From time to time we may need to communicate with each other directly. Examples of direct communications include copyright or other enforcement emails, notifications under our Takedown Guidance Policy, system update information, data breach notifications, notification of major changes to our Terms, our Cookie Policy or this Policy and billing information."
Score
Citation
"We may make changes to this Policy in the future. Any changes will be notified to all users."
This includes the use of data brokers and independent verification authorities (such as background check providers).
Score
Notes
Mega does not collect any data from third parties.
Score
Citation
"We will collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our Terms. We also have a legitimate interest in processing Account Data so that we can maintain and improve our systems and services and communicate with you as referenced in this Policy."
"As noted above, we process your personal information because we have contracted with you to do so under our Terms, this Policy, our Cookie Policy and our Takedown Guidance Policy. We cannot provide our services without that data."
Some services allow users to opt-out or opt-in to of non-critical collection or use of personal data, such as collecting data for personalized advertisements.
Score
Citation
"We collect and keep Usage Data with your consent to provide services and support related to our services, for market and product research and to be able to give users promotional material and special offers on our services."
"We may: join Usage Data with other users' data and give it to advertisers in a way which doesn't personally identify any particular user analyse and use Usage Data for marketing or statistical purposes as well as to improve the way we do business with our users; and serve advertisements or use third-party advertising companies to serve advertisements on our services and on third party sites, as well as to assist us in analysing our marketing and other business efforts."
Score
Citation
"When you sign up for particular services you will need to give us the details required in our registration form and will need to keep that information up to date, including any payment account details (e.g. online payment provider account information)."
"You do not need to give us any information other than an email address to use a free MEGA account, but the volume of Your Files that you can store and some other functionality is limited with such accounts. Where you wish to access greater storage and other functionality under a paid plan, you will need to give us (including our related or affiliated entities, payment processors and resellers) the information (such as tax identification and payment information) that is required under the particular plan and our Terms in relation to those services. For paid plans MEGA and its related or affiliated entities, payment processors and resellers that you use to make payments, retain account and payment information including a record of all transactions on your account."
"You can download your Account Data at https://mega.nz/fm/account/history while you are logged into your account. This will provide your Account Data but not Your Files."
Notes
"When you use our services, our systems retain the following metadata in unencrypted form: IP address and port information for logins, API usage, file uploads, folder creations and link exports; The email address of anyone you have specifically made a contact using Mega's systems. Note that Your Files and folders can be shared privately by invitation to specified email addresses or shared more generally by creating a file or folder link and decryption key; Contact email addresses of chat participants, chat commencement time and chat duration, and moderation activity; Our communications with you; and Your personal account settings, including any avatar picture."
Last Updated
March 1, 2021
Sources
Contributors