Privacy Policy

Last updated: January 2026

🔒 Your files never leave your device. All PDF processing happens entirely in your browser — we have zero access to your documents.

PDFtools.to ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights.

1. What We Collect

Account data (if you register): name, email address, hashed password, account creation date, subscription status.

Usage data: which tools you use, file sizes (not file contents), conversion counts, timestamps, and IP address. This is used for rate limiting and analytics.

Payment data: handled entirely by Stripe. We store only your Stripe customer ID — we never see or store card numbers.

Cookies: session cookies (required for login), preference cookies (theme, currency), and analytics cookies (if you consent). See our Cookie Policy.

Your files: We do NOT collect, store, or transmit your PDF files. Processing is entirely client-side in your browser.

2. How We Use Your Data

To provide and improve the Service
To manage your account and subscription
To enforce daily usage limits on free accounts
To send transactional emails (receipts, password resets, support replies)
To detect and prevent abuse
To comply with legal obligations

3. Legal Basis (GDPR)

We process your data under the following legal bases:

Contract performance: to provide the Service you signed up for
Legitimate interests: security, fraud prevention, service improvement
Consent: marketing emails, non-essential cookies (you can withdraw at any time)
Legal obligation: tax records, regulatory compliance

4. Data Sharing

We do not sell your personal data. We share data only with:

Stripe — payment processing (their privacy policy)
Email providers — to send transactional emails
Hosting providers — for server infrastructure
Law enforcement — when required by law

5. Data Retention

Account data: kept while your account is active, deleted within 30 days of account deletion
Usage logs: retained for 12 months for analytics, then deleted
Payment records: retained for 7 years for tax compliance
Support tickets: retained for 2 years after closure

6. Your Rights (GDPR)

If you are in the EEA or UK, you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten")
Restrict or object to certain processing
Portability — receive your data in a machine-readable format
Withdraw consent at any time

To exercise these rights, email [email protected]. We will respond within 30 days.

7. Cookies

We use essential cookies for authentication and optional cookies for preferences and analytics. See our Cookie Policy for full details.

8. Security

We use SSL/TLS encryption, hashed passwords (bcrypt), HTTP-only secure session cookies, and regular security reviews. However, no system is 100% secure — please use a strong, unique password.

9. Children

The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us immediately.

10. Changes

We may update this policy. We will notify you by email of material changes. Continued use of the Service constitutes acceptance.

11. Contact & DPO

For privacy questions: [email protected]
For data subject requests: [email protected]