1. Executive Summary & Privacy Principles

PDF Converter Lab ("we", "us", or "our") is dedicated to safeguarding the privacy and autonomy of our users. We believe that your documents belong strictly to you. Unlike ad-funded utilities or data brokers, our business model is funded by transparent Pro and Enterprise subscriptions—not by tracking, monetizing, or indexing your documents. We adhere strictly to the principle of Data Minimization under the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

2. Data We Collect & Data We Explicitly Avoid

We partition data collection into two distinct tiers: User Account Data and Document Payload Data.

2.1 Account & Identity Data

When you create an account or subscribe to a paid tier, we collect your email address, encrypted authentication tokens (via standard bcrypt/Argon2 or OAuth identity providers), and user preference configurations (such as default language or preferred compression ratio). Billing details (billing address, transaction identifiers) are handled directly by PCI-DSS certified processors (PayPal). We never store raw payment card credentials on our servers.

2.2 Document Payload Data (Zero-Retention)

Documents uploaded for compression, conversion, splitting, or merging are processed in ephemeral memory (RAM). When client-side WebAssembly execution is possible (such as browser-based compression, merging, or page extraction), your files never leave your device. When server-side processing is requested (such as complex OCR or office-to-PDF conversion), documents are transmitted over TLS 1.3 encryption, handled in isolated volatile containers, and permanently destroyed within 60 minutes of task completion or immediately upon manual download.

3. Cookies & Telemetry Analytics

We utilize essential session cookies necessary to maintain authenticated sessions and remember your language preference (NEXT_LOCALE). We do not employ third-party behavioral trackers or cross-site fingerprinting scripts. Aggregated performance metrics (page load latencies, error codes) are anonymized and stripped of IP addresses.

4. Third-Party Sub-processors

To operate our infrastructure reliably, we collaborate with vetted industry leaders under stringent Data Processing Agreements (DPAs): Google Cloud Platform (EU and US hosting with SOC-2 and ISO 27001 certifications), PayPal (payment processing via Orders API v2), and Google Vertex / Gemini API (strictly ephemeral document summarization with contractually enforced zero model-training exemptions).

5. Your Rights Under GDPR & CCPA

Regardless of your geographic location, you possess the right to: access all account data we hold about you, rectify any inaccurate information, demand total erasure ("Right to be Forgotten"), request structured data portability, and revoke previously granted consent at any time. To exercise these rights, submit a verified request to [email protected].

6. Retention & Cryptographic Security

All communication between your browser and our servers requires HTTPS (TLS 1.3) with HSTS enforcement. At rest, database records are encrypted with AES-256. User accounts that remain inactive for more than 24 consecutive months are automatically scheduled for complete purge alongside all historical logs.

7. Data Protection Officer (DPO) Contact

If you have inquiries regarding our data handling procedures or wish to lodge a formal complaint, please contact our Data Protection Officer at [email protected] or write to our registered legal office at PDF Converter Lab Inc., Attn: Legal Privacy Officer, 548 Market St, San Francisco, CA 94104, USA.

1. Executive Summary & Privacy Principles

2. Data We Collect & Data We Explicitly Avoid

We partition data collection into two distinct tiers: User Account Data and Document Payload Data.

2.1 Account & Identity Data

2.2 Document Payload Data (Zero-Retention)

3. Cookies & Telemetry Analytics

4. Third-Party Sub-processors

5. Your Rights Under GDPR & CCPA

6. Retention & Cryptographic Security

7. Data Protection Officer (DPO) Contact

Privacy Policy

1. Executive Summary & Privacy Principles

2. Data We Collect & Data We Explicitly Avoid

2.1 Account & Identity Data

2.2 Document Payload Data (Zero-Retention)

3. Cookies & Telemetry Analytics

4. Third-Party Sub-processors

5. Your Rights Under GDPR & CCPA

6. Retention & Cryptographic Security

7. Data Protection Officer (DPO) Contact

Privacy Policy

1. Executive Summary & Privacy Principles

2. Data We Collect & Data We Explicitly Avoid

2.1 Account & Identity Data

2.2 Document Payload Data (Zero-Retention)

3. Cookies & Telemetry Analytics

4. Third-Party Sub-processors

5. Your Rights Under GDPR & CCPA

6. Retention & Cryptographic Security

7. Data Protection Officer (DPO) Contact