Privacy Policy - MEGA

DATED 2025-02-28 · VERSION 20250304_rev01 · COMPARED WITH 20241102_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20241102_rev01 to 20250304_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

 . VPN bandwidth usage;
 . The email address of anyone you have specifically made a contact using MEGA's systems. Note that Your Files, including your folders and albums, can be shared privately by invitation to specified MEGA accounts identified by email addresses or shared more generally by creating and sharing a file, folder or album link and decryption key;
 . Contact email addresses of chat participants, chat commencement time, chat duration and moderation activity;
 . Takedowns and account suspensions;
 . Our communications with you; and
 . Certain account settings, including any avatar picture.
+             For Android users, MEGA VPN requests location permission only for the Trusted WiFi feature. Your location is in fact not used, only your trusted WiFi network's SSID which is stored on your device to manage connections. This data is never shared with MEGA.
 . From time to time we may need to communicate with each other directly. We will use MEGA's chat facility, internal messaging system or the email or SMS address you have included in the settings information in your account and may also give notices to you and other users via popups or other notices prominently displayed on our website. Any communication to you will be deemed to be received by you in accordance with the electronic communication provisions of the [New Zealand Contract and Commercial Law Act 2017](https://www.legislation.govt.nz/act/public/2017/0005/21.0/DLM6844033.html), no matter whether you are actively monitoring the account or its email address or not. You can communicate with us using the appropriate address on our [contacts page](https://mega.io/contact) and your email will be deemed to be received by us. Examples of direct communications include copyright or other enforcement emails, notifications under our [Takedown Guidance Policy](https://mega.io/takedown), system update information, data breach notifications, notification of major changes to our [Terms](https://mega.io/terms), any Policy and billing information.
 . Access to your account is by way of nominated email address and password. It is your responsibility to keep these safe and secure as MEGA stores the email address but does not store the password. **If you forget your password you will lose access to all your data unless you have exported and retained a Recovery Key**.
 . We will collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our [Terms](https://mega.io/terms). We also have a legitimate interest in processing Account Data so that we can maintain and improve our systems and services and communicate with you as referenced in this Policy. This includes using your Account Data for marketing or targeted advertising purposes and sending you information about MEGA's new products, upgrades and other marketing material from time to time. As further set out at clause 20, you can opt out of receiving marketing material at any time by clicking the 'unsubscribe' link in any emails you receive, or by updating your preferences in your account settings.
 . We retain Account Data as long as your account is active. After account suspension or termination, including where the administrator of a Business Account, within which you have used the services, terminates that Business Account (see clause [13]() below), we may, but are not obliged to, retain all Account Data if enforcement action is likely or commenced under our [Terms](https://mega.io/terms), our [Cookie Policy](https://mega.io/cookie), or [Takedown Guidance Policy](https://mega.io/takedown) or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data that identifies you will be anonymised, and we will never re-identify that data, but where you are a contact of, have had a folder or album shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users.
 . You can download your Account Data at [https://mega.nz/fm/account/security](https://mega.nz/fm/account/security) while you are logged into your account. This will provide your Account Data but not Your Files or Your Chats. You can request correction of Account Data if it is considered incorrect, in accordance with the [New Zealand Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html) and the GDPR. Any requests for access to, or correction of, Account Data that is not available to you when you are logged into your account, or if you cannot log in to your account, should be made to [privacy@mega.nz](mailto:privacy@mega.nz) specifying the information in question. The information will be provided promptly, and at least within one month, without charge unless the request is manifestly unfounded or excessive. Corrections will be promptly considered and actioned if appropriate.
 . If we have disclosed your Account Data to any third party (such as a compliance authority), we will inform them of any correction where possible and will also inform you about the third parties to whom the data has been disclosed where lawful and appropriate.
 . If you are a resident of California, click [here](https://mega.io/california-addendum) to read our Additional Privacy Notice for California Residents under the California Consumer Privacy Act (CCPA).
 #### **Changes to our Policy**
 . We may make changes to this Policy in the future. Any changes will be notified to all users.
+Last updated and effective 4 October 2024.
+Last updated and effective 28 February 2025.