OZ Storage Privacy Policy
Version 1.0 · October 25, 2026
The Spanish version is the primary text; this translation is provided for convenience.
OZ Storage is Agencia OZ's file storage for its team and its clients. It is operated by REPUTATION DYNAMICS LLC, a limited liability company organized in the State of Wyoming (United States), with offices at 645 NE 125th Street, Suite 201-F, North Miami, FL 33161, United States, for Agencia OZ, the trade name of DELCOR-MULTIMEDIA S.A.S. (Ecuador). In this policy, "we" means the operator.
This policy explains what personal data we process, why, who we share it with, where it is stored, how long we keep it and how you can exercise your rights. It covers the website (https://app.ozstorage.app), share links (links.ozstorage.app), the OZ Storage apps for Mac and for iPhone and iPad, the API and the MCP server used to connect AI assistants (https://mcp.ozstorage.app/mcp).
Contents: 1. Summary · 2. Who decides · 3. Data we process · 4. Purposes and legal bases · 5. Sharing · 6. Location · 7. Retention · 8. Security · 9. Your rights · 10. Incidents · 11. Cookies · 12. AI assistants · 13. Minors · 14. Changes · 15. Contact
1. Summary
- We store the files that you or your organization upload, plus the minimum data needed to run the service securely.
- We do not sell data, show ads, use third-party trackers or build profiles.
- We do not use the content of your files to train artificial intelligence models, ours or anyone else's.
- Data is hosted with providers in the United States (full list in subprocessors).
- Every change is recorded in a tamper-evident audit log. Items sent to the trash can be restored for 90 days.
- You can request access, correction, deletion, portability or object to processing by writing to info@reputationdynamics.io.
2. Who decides about your data
OZ Storage is organized by organizations (for example, Agencia OZ). Each organization decides which files it keeps, whom it invites and what it shares. Therefore:
| Data | Who decides (controller) | Our role |
|---|---|---|
| Files, folders, links and whatever an organization keeps about its clients | The organization | We process it on its behalf (processor) |
| Data about visitors to a link (including name and email, if the link asks for them) | The organization that created the link | Processor |
| Accounts, sessions, security, audit log, notifications and service costs | Us | Controller |
If your question is about files an organization shared with you, you can write to that organization or to us; if you write to us, we will pass it on.
3. Data we process
3.1 If you have an account (team, administrators and invited clients)
| Data | Purpose | Source |
|---|---|---|
| Name and email | Identify you, invite you, send sign-in links and notifications | Whoever invites you, or you |
| Phone number (optional) | WhatsApp notifications that you or your organization turn on | You |
| Organization, role and per-space permissions | Know what you can see and do | Your organization |
| Passkeys: public key, device name, last use | Sign in without a password | Your device |
Google, Apple or Microsoft account you link to sign in: the identifier that provider gives you, the email it reports (with Apple it may be a private …@privaterelay.appleid.com address), the Microsoft organization (tenant) and dates of use | Sign in with that account, without a password | That provider, when you choose “Continue with…” |
| Recovery codes (only a hash, never the code) | Sign in if you lose your passkeys | Generated by the service |
| Sessions: date, IP address, browser | Security: view and close open sessions | Your browser or app |
| API keys and AI connections (only a hash of the token) | Let an app or AI act on your behalf within the scope you chose | You |
Passkeys use your device's biometrics (Touch ID, Face ID), but your fingerprint or face never leaves your device: we only receive the public key.
If you sign in with Google, Apple or Microsoft, that provider verifies who you are and returns only what is in the table (we ask for openid, email and profile; with Apple, name and email): never your password, contacts, files or emails. The email it gives us is never used to find your account: you link the external account yourself (from an invitation or in “Keys and security”) and can remove it at any time.
3.2 Files and what is done with them
- Uploaded files and their versions, names, folders, size, type, dates, SHA-256 hash and who uploaded them. They may contain any kind of personal data: that is the uploading organization's decision.
- Thumbnails and lightweight previews, generated automatically.
- If an AI saved a file, which connection it came from.
We do not look at file contents except to generate thumbnails and previews, check integrity (hashes) or when someone in your organization asks us for help with a specific file.
3.3 If you open a link someone shared with you
When you open, download or upload through a links.ozstorage.app link, we store with the event: date and time, what happened (visit, download, upload, wrong password), which file, how many bytes, your IP address, the country (derived by Cloudflare from the IP) and the browser (user agent). If the link asks for your name and email, we store them with the download. No account is needed. The organization that shared the link sees these events (the IP only for its administrators and only for 90 days).
3.4 Audit log
Every change (upload, move, rename, trash, create or cut a link, change permissions, approve a cost…) is written to an append-only log, hash-chained so it cannot be altered: who did it (or which AI connection), when, from which IP and browser, what changed (before and after) and the reason, if any.
3.5 AI connections, API and apps
- For each app or AI you connect: its name, where the authorization returns to, the permissions and spaces you chose, when you connected it and when it was used.
- The reads an AI performs (which tool, which object, whether it succeeded, how long it took), grouped per minute.
- Our servers' technical logs record which tool was called, by whom, whether it succeeded and how long it took; never tokens, arguments or file contents.
- More detail in AI use.
3.6 Notifications, email and costs
- To notify you we use your email (via Resend) and, if you gave it, your phone number (WhatsApp). Notifications do not include text written by third parties.
- Cost approvals record who asked, for what and the estimated cost.
3.7 Mac, iPhone and iPad apps
The OZ Storage apps for Mac and iPhone keep on your device a copy of the names and details of the files you see (to show them offline) and the files you open. To check for updates, OZ Storage for Mac reads a public version file (which leaves your IP on the download server).
3.8 What we do not process
We do not ask for or store card data, identity documents or people's passwords (sign-in is by passkey or with your Google, Apple or Microsoft account; the only exception is test accounts for directory reviewers, which exist only in a demo organization with fictitious data). We do not read your conversations with an AI or its history.
4. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Provide the service: store, display, share and recover files | Contract with your organization (and with you, if you have an account) |
| Security: passkeys, sessions, attempt limits, audit log, abuse detection | Legitimate interest in protecting the service and the data; legal compliance |
| Record who opened or downloaded a link | The organization's legitimate interest in knowing the delivery arrived; if the link asks for name and email, you provide them voluntarily |
| Email and WhatsApp notifications | Contract; the phone number is optional |
| Backups and disaster recovery | Legitimate interest and contract (not losing files) |
| Responding to authorities | Legal obligation |
We do not make automated decisions that produce legal effects on you. Automatic limits (for example, slowing down many downloads in a row or requiring approval for a cost) protect the service and can always be reviewed by a person.
5. Who we share it with
- Providers that help us run the service (subprocessors): storage, servers, network, email and notifications. They receive only what is needed, under contract. Full list with purpose and region in subprocessors.
- Your organization: its administrators see the audit log, link events and AI connections of their organization.
- The AI you connect: whatever that AI reads from OZ Storage goes to its provider (for example, Anthropic or OpenAI) under the agreement you have with that provider. See AI use.
- Google, Apple or Microsoft, if you sign in with them: they know you signed in to OZ Storage, because it is their sign-in service and you use it with your own account. We do not send them your files or your organization's data.
- Authorities, only when the law requires it and to the minimum extent.
- If the operator of the service changed (for example, a reorganization between REPUTATION DYNAMICS LLC and DELCOR-MULTIMEDIA S.A.S.), the data would move with the same protections and we would notify you in advance.
We never sell or rent personal data.
6. Where the data is
Files, the database and backups are in the United States: Backblaze B2 (US East), Oracle Cloud (Ashburn, Virginia), Amazon Web Services (us-east-1, Virginia) and Railway (API servers). Links are served through Cloudflare's global network, from the data center closest to each visitor.
Lightweight viewing versions of videos (proxies, thumbnails) are made by the server or by Agencia OZ equipment (a Mac of the OZ team, in Ecuador): it downloads the video through a link that expires in minutes, makes the lightweight version, uploads it and deletes everything when done. That equipment never sees the file's name or folder, and each time is recorded in your organization's activity log.
If you are in Ecuador, the European Union or another country, your data is transferred to the United States. We do so with providers that are contractually bound to protect it and with the safeguards required by applicable law.
7. How long we keep it
| What | How long |
|---|---|
| Files | As long as the organization keeps them. In the trash, 90 days; then they are deleted automatically |
| Backup copies of files in the vault (AWS, locked in compliance mode) | Up to 365 days from when each copy was made. During that period nobody can delete them, not even us: this protects against deletion and attacks. When the lock expires, they are deleted if the file no longer exists |
| Database backups | The last 30 nights |
| Account (name, email, phone, passkeys) | While you belong to an organization. If you are removed from one, you lose access and your keys and connections for that organization are revoked. If you ask to close your account entirely, we deactivate it and delete your phone, passkeys and sessions; your name and email remain only where the audit log refers to them |
| Linked Google, Apple or Microsoft account | While it stays linked. If you remove it (or your account is closed), it can no longer be used to sign in and is kept marked as removed, with its identifier and dates, for the audit log |
| Audit log | Permanent: lines are only appended, and it is chained so nobody can alter it |
| Link events (date, IP, country, browser; name and email if requested) | As long as the delivery record exists. The IP is deleted after 90 days (until then only administrators see it) |
| Reads performed by an AI | 180 days |
| Daily quotas for each AI connection | 90 days |
| Keys that prevent repeating an operation (idempotency) | 24 hours |
| Change journal used by OZ Storage for Mac to sync | 90 days |
| Internal tasks, completed / failed | 30 / 180 days |
| Completed or expired uploads | 30 days |
| Email sign-in link | 15 minutes, single use |
| Access token of a connected AI | 24 hours; renews automatically while in use, and expires if unused for 90 days |
| Address given to "save from a link" | Deleted when finished; the log keeps only the domain and a hash |
| Server technical logs (no content) | The hosting provider's log retention period |
8. Security
- Sign-in with passkeys (no passwords); sensitive actions are confirmed again with the passkey.
- Encrypted connections (HTTPS) everywhere; providers encrypt stored data.
- Each organization is isolated in the database with row-level security: one organization cannot see anything from another.
- Files never pass through our application servers: they are uploaded and downloaded directly from storage with signed links that last a few minutes.
- Nothing is deleted forever by an action of a person, a key or an AI: it goes to the trash for 90 days.
- Large actions (for example, trashing an entire project) require a separate confirmation with a passkey.
- Copies at three different providers, one of them immutable; external monitoring every minute.
No system is infallible. If you find a vulnerability, write to info@reputationdynamics.io.
9. Your rights
Depending on the law that applies to you (in Ecuador, the Organic Law on Personal Data Protection, LOPDP; in the European Union, the General Data Protection Regulation, GDPR), you can request:
- Information about how we process your data (this policy).
- Access to your data and a copy.
- Rectification and updating of anything wrong or incomplete.
- Erasure of your data when it is no longer needed or there is no basis to process it.
- Objection to processing based on legitimate interest.
- Portability: receive your data in a structured, commonly used format.
- Suspension (restriction) of processing while a complaint is resolved.
- Not to be subject to automated decisions with legal effects.
How: write to info@reputationdynamics.io from your account's email (or, if you opened a link, tell us the link and the date). It is free. We may ask you to confirm your identity. We answer within 15 days. If your request concerns an organization's files, we coordinate with that organization, because it decides about that content.
Limits: some data we must or need to keep (for example, the audit log, which protects everyone against unauthorized changes, and the vault copies while their lock lasts). In those cases we explain what is kept, why and until when, and we do not use it for anything else.
If you are not satisfied with our answer, you can complain to Ecuador's Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales) or to the data protection authority in your country.
10. Security incidents
If a breach affects personal data:
- We notify the affected organization immediately (when we act on its behalf, within 2 days at the latest).
- We notify Ecuador's Superintendency of Personal Data Protection within the legal deadline (5 days) when applicable, and authorities in other countries as their laws require.
- We notify you without undue delay if the incident may affect your rights: what happened, when, what we did and what we recommend.
11. Cookies and browser storage
We only use what is needed for the service to work; there are no advertising or analytics cookies.
| What | Where | Purpose | Lasts |
|---|---|---|---|
| Session | OZ Storage website | Keep you signed in | Until you sign out; at most 30 days |
oz_clave | Password-protected links | Not ask for the password again in that browser | 12 hours |
oz_datos | Links that ask for name and email | Not ask for them again in that browser | 12 hours |
| Download reservation | Links with a download limit | So resuming a download does not count twice | 12 hours |
| Local storage | OZ Storage website | Resume an interrupted upload | Until it finishes |
| Cloudflare Turnstile | Links, after several failed attempts | Check that you are not a robot | Set by Cloudflare |
12. AI assistants
You can connect an AI assistant (Claude, ChatGPT or another) to OZ Storage. You choose what it can do and in which spaces; you can see what it does and revoke access whenever you want. We do not train models on your files. What the AI reads goes to its provider under your agreement with that provider. Full details in AI use.
13. Minors
OZ Storage is a work tool for organizations and is not directed to people under 18. Accounts are created by organizations for adults. If you believe we hold data about a minor without proper authorization, write to us.
14. Changes
If we change this policy, we publish the new version here with its date. If the change is significant, we notify each organization's administrators by email in advance.
15. Contact
REPUTATION DYNAMICS LLC · 645 NE 125th Street, Suite 201-F, North Miami, FL 33161, United States · info@reputationdynamics.io
For Agencia OZ (DELCOR-MULTIMEDIA S.A.S., Ecuador).
Other documents: Terms of use · AI use · Subprocessors