diff --git a/app/templates/views/security.html b/app/templates/views/security.html
index d03bcb66f..bf0e1c2c9 100644
--- a/app/templates/views/security.html
+++ b/app/templates/views/security.html
@@ -21,7 +21,8 @@
     <li>when it passes through the service</li>
     <li>when it’s stored on the service</li>
   </ul>
-  <p class="govuk-body">Any user data you upload is only held for 7 days.</p>
+  <p class="govuk-body">Any recipient data you upload is only held for 7 days.</p>
+  <p class="govuk-body">If you <a href="/features/email#send-files">send a file by email</a>, it will be available for the recipient to download for 18 months.</p>
   <p class="govuk-body">The Cabinet Office acts as data processor for Notify. Your organisation is the data controller.</p>
   <h3 class="heading-small">Data Protection Act</h3>
   <p class="govuk-body">Notify complies with data protection law. To make sure it stays compliant, there are regular legal reviews of the service’s:</p>