Who operates Pigeon
WMIE S.R.L. operates Pigeon. Its registered office is Via Dante Alighieri 93, 09128 Cagliari (CA), Italy.
Its Italian VAT and tax number is 04014830923. Contact privacy@wmie.it for privacy, abuse reports, and human review.
REA: CA-356487. Certified email (PEC): wmie@legalmail.it.
WMIE is the controller for personal information used to operate and protect the service and handle privacy and legal requests.
Information we process
We process uploaded files and their filename, declared type, size, transfer identifier, creation and expiry times, and access counters.
We process comments, their display label, submission time, file association, and a file-specific substitute identifier.
Hosting and storage providers receive network information, including IP addresses and request details, when your device contacts their services.
The application uses keyed substitute identifiers for request limits, file access windows, comments, and abuse prevention. These identifiers remain personal data when linkage is possible.
If you email us, we process your message, sender address, supplied contact details, and our assessment and response.
We process your name and email where you provide them or where a formal illegal-content notice requires them.
Files and reports can include information about other people. In those cases, the uploader or reporter provides that information.
Purposes and legal grounds
We process information about you that is necessary to provide the sharing and comment functions you request under the service terms, under GDPR Article 6(1)(b).
We use limited technical information to protect users, prevent abuse, enforce access limits, and handle service disputes, under Article 6(1)(f).
Our legitimate interests are service security, protection of other people, and the prevention and resolution of misuse.
We handle mandatory illegal-content notices, valid authority orders, and data protection requests to meet legal obligations, under Article 6(1)(c).
We handle voluntary review requests and related claims under our legitimate interests in fair moderation and the protection of legal rights, under Article 6(1)(f).
We do not treat an upload as consent to unrelated processing. WMIE does not use uploaded files for advertising or AI training.
Information about other people and organizational use
The uploader chooses the file contents and intended recipients. The uploader must have a lawful reason to share information about other people.
A file can contain information that requires additional protection, including health, identity, or criminal-offence information.
Pigeon is not designed as a regulated records system or a permanent confidential archive.
If your organization needs WMIE to act as its processor under GDPR Article 28, arrange a processing agreement with us before that use.
Contact privacy@wmie.it about a file that contains your information. We assess the relevant roles, rights, and lawful grounds for the circumstances.
Who can access information
Anyone with a working share link can access its file within the access limits. Recipients can forward the link or keep their own copies.
Comments are visible to people who can access the file. Do not put confidential information in a comment.
Authorized personnel can access information when necessary for operation, support, security, a reported issue, or a legal obligation.
Cloudflare R2 provides file storage and delivery. Vercel hosts the application. Upstash stores transfer metadata, comments, and access counters.
WMIE uses its email service to handle correspondence. Google handles incoming email for wmie.it.
Providers and their authorized subprocessors process information for the services they supply.
We disclose information to competent authorities or other recipients when a valid legal obligation requires it.
International processing
Our providers operate internationally. Their processing, support, and infrastructure can involve countries outside the European Economic Area, including the United States.
A European application region does not establish that every operation or provider copy stays in the European Economic Area.
The providers publish processing terms that address international transfers and standard contractual clauses where required.
Contact privacy@wmie.it to request information about the safeguards that apply to your data and how to obtain a copy.
Retention and deletion
A transfer has a fixed expiry seven days after its creation, including upload time. It stops granting new access after twenty visitor access windows.
A visitor access window covers previews and downloads for up to five minutes. Repeated requests do not extend that window or the file expiry.
File metadata and associated comments expire at the original transfer deadline. Abuse action can stop access earlier.
Cleanup removes stored files and related records. Separate storage lifecycle rules provide a deletion backstop. Physical deletion can follow the end of link availability.
Access-window records last up to five minutes. Request counters last for their applicable windows, up to twenty-four hours.
Blocked transfer identifiers remain blocked for thirty days. Cleanup references remain until deletion succeeds and the allowance for late storage writes ends.
WMIE normally keeps request correspondence for up to 180 days from the initial email. A person reviews and deletes this correspondence.
Email replies do not extend the original file lifetime. Mailbox providers can retain residual copies under their own documented schedules.
A specific legal obligation or dispute can require separate preservation of limited information or affected files. We record the reason and restrict access.
Such preservation does not keep the ordinary sharing link available. We review the need and delete preserved material when its lawful retention ends.
Provider-managed security records and backups follow the applicable provider schedules and agreements. Contact us for the periods and safeguards relevant to a request.
We cannot delete copies that recipients keep outside Pigeon.
Browser storage and security
The pigeon_session session cookie supports file access counting and file-specific comment identities. It has no fixed persistent expiry.
A browser session restore can retain a session cookie. The browser also stores your selected display theme until you change or clear it.
The application does not use advertising trackers, Vercel Analytics, or Speed Insights. Provider security and network records are separate.
Files are not encrypted from sender to recipient in a way that excludes WMIE and its necessary providers.
Pigeon does not perform antivirus scanning. A working link or a completed upload does not establish that a file is harmless.
Your choices and rights
Comments are optional. File contents and limited technical information are necessary to perform your requested transfer.
Depending on the applicable conditions, you can request access, correction, erasure, restriction, portability, or objection under GDPR Articles 15 to 22.
Email privacy@wmie.it to exercise your rights. Identify the relevant data and include an available Pigeon file link or previous correspondence.
We request only information necessary to locate the data and establish your relationship to it. We do not request identity documents by default.
Possession of a share link alone does not establish a right to receive additional information about another person.
We respond without undue delay and normally within one calendar month. A permitted extension requires an explanation within that original month.
You can complain to the Italian Garante or another competent supervisory authority and seek a judicial remedy.
Restrictions and human review
Automatic request limits and access limits can temporarily prevent use. Illegal-content notices and review requests receive a human assessment.
Email privacy@wmie.it to request human review. We explain a restriction and available remedies when the applicable rules require it.
Review cannot restore bytes that the original retention deadline or a justified deletion already removed.