Privacy Policy - MEGA

ARCHIVED 2026-04-05, DATE APPROXIMATE · VERSION 20260405_rev01 · COMPARED WITH 20260306_rev01

Full text changes — 20260306_rev01 to 20260405_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+MEGA's updated Privacy Policy coming into force on 2nd April 2026 can be accessed [here](https://mega.io/privacy-2026).
 ### Introduction
 When you are a user of Mega Cloud (whether a free user, or on a Pro or Business plan with MEGA VPN and MEGA PASS bundled for free), or if you are a user of MEGA S4, this is the Privacy Policy of MEGA Privacy LLC (Hungarian Cg. 13-09-239012).
 When you are a user of MEGA VPN or MEGA Pass on a standalone paid plan, this is the Privacy Policy of Mega Privacy (NZ) Limited (NZ company number 9324253).
 In all cases, throughout these terms, we refer to "**MEGA**", "**we**", "**us**" or "**our**".
 . This Policy governs the processing of your personal data as data controller. The terms "**Personal data**", "**processing**" and any other relevant terms are used as defined in the European Union's General Data Protection Regulation (EU) 2016/679 ("GDPR"). Processing includes collection, storage, and all of the ways we use, and allow you to use, personal data when we provide our services.
+. **Important**: We store Personal Data in our primary data centres in Japan, Canada and/or the European Union. In order to provide our services, Personal Data may transit or be temporarily stored on servers in other countries, the full details of which can be found on our [website](https://mega.io/server-locations). In this Policy, 'Personal Data' refers to Account Data and Usage Data, together, as those terms are defined below.
+. **Important:** We store Personal Data in our primary data centres in Japan, Canada and/or the European Union. In order to provide our services, Personal Data may transit or be temporarily stored on servers in other countries, the full details of which can be found on our [website](https://mega.io/server-locations). In this Policy, 'Personal Data' refers to Account Data and Usage Data, together, as those terms are defined below.
+. None of your Personal Data are stored in, or made available from, the United States of America. We do not collect or store any data that is not mentioned in the present Policy. We will never sell your Personal Data to a third party.
+. None of your Personal Data is stored in, or made available from, the United States of America. We do not collect or store any data that is not mentioned in the present Policy. We will never sell your Personal Data to a third party.
 . This Policy does not deal with Your Files (the actual encrypted files that you upload, access and share using our services) or Your Chats (the encrypted text, voice and video chats you engage in using our services) because they are not personal data: we cannot decrypt Your Files and Chats thus they are not information relating to an identified or identifiable individual.
 . The GDPR provides rights to European users, but, as a leading privacy company, to the extent possible, we aim to make the GDPR protections and rights available to all our users globally in respect of their Personal Data wherever they may live.
 ### Account Data
 . This is the section of this Policy that covers account information you give us, and metadata and records of financial transactions that we generate in relation to your access to the services, including, where applicable, MEGA Pass and MEGA S4. The following specific terms apply:
 . When you sign up for particular services you will need to give us the details required in our registration form and must keep that information up to date, including any payment information.
 . For paid plans, MEGA and payment processors that you use to make payments, retain account and payment information including any tax identification and a record of all transactions on your account. We do not hold your credit card data.
+. When you access our services, our systems may retain the following metadata in unencrypted form:
+. When you purchase or use paid services (including services involving cryptocurrency or other regulated payment methods), MEGA may collect and retain certain payer or identity information from you and share it with our payment processors. _Where required, we will obtain your consent before sharing such information._
+. When you access our services, our systems may retain the following metadata in unencrypted form:
 . A unique device ID for the device used to log in to our services (that device ID doesn't include the serial number, brand or model of your device);
 . Browser type, device type and/or operating system of the devices from which you have logged in to MEGA, as applicable;
 . IP address and port information used for: logging in to our services; API usage; file uploads; file, chat, folder and album links; and VPN usage (including time and dates of those events);
 . The country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database);
 . Takedowns and account suspensions;
 . Our communications with you; and
 . Certain account settings, including any avatar picture.
 . For Android users, MEGA VPN requests location permission only for the Trusted WiFi feature. Your location is in fact not used, only your trusted WiFi network's SSID which is stored on your device to manage connections. This data is never shared with MEGA.
+. We collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our Terms (GDPR 6. (1) b)). We also have a legitimate interest (GDPR 6. (1) f)) in processing Account Data so that we can (i) maintain and improve our systems and services, (ii) prevent service abuse and (iii) ensure our compliance with international regulatory requirements.
+. You can download part of your Account Data at https://mega.nz/fm/account/security while you are logged into your account.
+. We collect, store, use and otherwise process Account Data so that we can provide the services you have contracted to obtain from us under our Terms (GDPR 6(1)(b)). We also have a legitimate interest (GDPR 6(1)(f)) in processing Account Data so that we can (i) maintain and improve our systems and services, (ii) prevent service abuse and (iii) ensure our compliance with international regulatory requirements.
+. You can download part of your Account Data at [https://mega.nz/fm/account/security](https://mega.nz/fm/account/security) while you are logged into your account.
 . If we have disclosed your Account Data to any third party (such as a compliance authority), we will inform them of any correction where possible and will also inform you about the third parties to whom the data has been disclosed where lawful and appropriate.
 ### Usage Data
 . This is the section of this Policy that covers data relating to your activity using our services, including MEGA Pass and MEGA S4 ("**Usage Data**"). Our [Cookie Policy](https://mega.io/cookie) also provides more specific information on certain types of Usage Data and your rights to control whether it is collected or not and what it is used for.
 . When you use our services, our systems may retain the following metadata in unencrypted form:
 . Information necessary for price calculation (e.g. storage or bandwidth used).
 . Subject at all times to the rights you have pursuant to our Cookie Policy, the following specific terms apply:
 . We may:
 . collect Usage Data to assist in the operation and improvement of our services;
 . analyse and use Usage Data for marketing or statistical purposes as well as to improve the way we provide services to our users; and
 . serve advertisements or use third-party advertising companies to serve advertisements on our services and on third-party sites, as well as to assist us in analysing our marketing and other business efforts.
+. We collect, store, use and otherwise process Usage Data so that we can provide the services you have contracted to obtain from us under our Terms (GDPR 6. (1) b)). We also have a legitimate interest (GDPR 6. (1) f)) in processing Account Data so that we can (i) maintain and improve our systems and services, (ii) prevent service abuse; (iii) ensure our compliance with international regulatory requirements and (iv) give users promotional material and special offers on our services.
+. We collect, store, use and otherwise process Usage Data so that we can provide the services you have contracted to obtain from us under our Terms (GDPR 6(1)(b)). We also have a legitimate interest (GDPR 6(1)(f)) in processing Usage Data so that we can (i) maintain and improve our systems and services, (ii) prevent service abuse; (iii) ensure our compliance with international regulatory requirements and (iv) give users promotional material and special offers on our services.
 ### Retention
+. We retain Personal Data as long as your account is active. After account suspension or termination, including where the administrator of a Business Account, within which you have used the services, terminates that Business Account, we may, but are not obliged to, retain Personal Data if enforcement action is likely or commenced under our Terms, our [Cookie Policy](https://mega.io/cookie), or [Takedown Guidance Policy](https://mega.io/takedown) or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data and Usage Data will be anonymised, and we will never re-identify that data, but where you are a contact of, have had a folder or album shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users.
+. After account suspension or termination, we retain Personal Data as long as your account is active. After account suspension or termination, including where the administrator of a Business Account, within which you have used the services, terminates that Business Account, we may, but are not obliged to, retain Personal Data if enforcement action is likely or commenced under our [Terms](https://mega.io/terms), our [Cookie Policy,](https://mega.io/cookie) or [Takedown Guidance Policy](https://mega.io/takedown) or for 12 months, whichever is longer, or in the case of records of financial transactions relating to your account for such period of time as we are legally required to retain such information. Users sometimes request that an account be re-activated so we keep Account Data for 12 months for that purpose. Where there is no enforcement action likely or commenced and the 12 month period has expired, or after such longer period as is applicable in the case of records of financial transactions relating to your account that we are legally required to retain, Account Data and Usage Data will be anonymised, and we will never re-identify that data, but where you are a contact of, have had a folder or album shared with you by, or have chatted with, another MEGA user, those details will continue to be retained to allow services to continue for those other users.
 ### Direct marketing
 . We may use your email address for marketing or targeted advertising purposes and sending you information about MEGA's new products, upgrades and other marketing material from time to time. You can opt out of receiving marketing material at any time by clicking the 'unsubscribe' link in any emails you receive, or by updating your preferences in your account settings. We will abide by any email unsubscription request (other than those we need to send for invoicing, security or service updates and other service provider purposes).
 ### MEGA Pass
 . We collect and retain the following information concerning your use of MEGA Pass:
+. Account Data in accordance with clause 6.3 of this Policy, including your IP address, devices connected to your account, name and email address associated with your account but excluding the data set out at clauses 6.3.5 to 6.3.10 which are not relevant to your use of MEGA Pass.
+. Account Data in accordance with clause 6.4 of this Policy, including your IP address, devices connected to your account, name and email address associated with your account but excluding the data set out at clauses 6.4.1 to 6.4.7 which are not relevant to your use of MEGA Pass.
 . Usage Data in accordance with clause 12 of our Policy, including data relating to your activity using MEGA Pass such as login timestamps, how many items you store, and how much storage space you use.
 ### MEGA S4
 . As noted above, we process your personal information because we have contracted with you to do so under our Terms, this Policy, our [Cookie Policy](https://mega.io/cookie) and our [Takedown Guidance Policy](https://mega.io/takedown). We cannot provide our services without that data. Other data that is not personal information is also dealt with by us in accordance with our Terms, this Policy, our [Cookie Policy](https://mega.io/cookie), and our [Takedown Guidance Policy](https://mega.io/takedown).
 . We will process your S4 Files in compliance with applicable privacy laws, including GDPR.
 . If you are a resident of California, click [here](https://mega.io/california-addendum) to read our Additional Privacy Notice for California Residents under the California Consumer Privacy Act (CCPA).
 ### Your privacy rights
 . You have the right to:
+. access your personal information - you can obtain a confirmation that we are processing your data and information how we process it. We suggest that you make a request in writing.
+. object to the processing of your personal information, depending on the processing activity - this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting the processing of your data.
+. access your personal information and information about how we process it - you can obtain a confirmation that we are processing your data and information on how we process it. We suggest that you make a request in writing.
+. object to the processing of your personal information, depending on the processing activity - this allows you to ask us to stop processing your data at any time. Where we rely on legitimate interest, you must give specific reasons why you are objecting to the processing of your data.
 . rectify - you have a right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed.
 . erase (also known as the right to be forgotten) - in certain circumstances you can ask for the personal data we hold about you to be erased from our records. Your personal data will be erased where the data are no longer needed for their original processing purpose, or you have withdrawn your consent and there is no other legal ground for processing, or you have objected and there are no overriding legitimate grounds for the processing, or erasure is required to fulfill a statutory obligation under the EU law or the right of the national law.
 . request data portability - you can ask to have personal data we hold about you transferred to another organisation.
 . restrict processing your personal information - where certain conditions apply, you have a right to restrict the processing of your personal information.
 . withdraw your consent at any time - without affecting the lawfulness of processing based on consent before its withdrawal.
 ### Changes to our Policy
+. We may make changes to this Policy in the future. Any changes will be notified to all users.
+. We may make changes to this Policy in the future. Any changes will be notified to all users in accordance with our Terms.
+Last updated 15th April and effective 15 May 2025.
+Last updated 02.03.2026 and effective 02.04.2026