Privacy Policy

1. Overview

This policy explains what personal data PDFlyHub (“PDFlyHub”, “we”, “us”) collects when you use pdflyhub.com, why we collect it, how long we keep it, who we share it with, and what rights you have over it.

It applies to our website and all of the PDF tools offered on it. By using PDFlyHub you agree to the handling of your information as described here. If you do not agree with this policy, please do not use the service.

2. The documents you process

Your documents are the most sensitive thing you give us, so we treat them separately from everything else in this policy.

Tools that run in your browser. Many of our tools process your file entirely on your own device using your browser's own capabilities. For those tools your document is never transmitted to us, never reaches our servers, and we cannot see it. Each tool page states where its processing happens.

Tools that run on our servers. Some operations - such as OCR, Office document conversion and certain repair and compression tasks - require processing power that a browser cannot provide. For these, your file is uploaded over an encrypted HTTPS connection, processed, and the result returned to you. We do not open, read, inspect or analyse the contents of your documents, and we never use them to train any model or for any purpose other than performing the operation you asked for.

Retention. Files handled on our servers are retained only as long as needed to complete your request and deliver your download, and are then deleted. We do not keep a permanent archive of processed documents. Temporary copies created during processing are removed as part of the same cycle.

Please note. We log the name and size of files processed through a signed-in account in your usage history, so you can see your own activity. We do not log file contents. If a filename itself is sensitive, rename the file before processing it.

3. Information we collect

We collect only what the service needs to work:

a) Account information. If you create an account, we store your name, email address and a securely hashed version of your password. We never store your password in a readable form and cannot recover it for you. If you upload a profile picture, we store that image and a reference to it.

b) Usage history. For signed-in users we record which tool was used, the filename and size of the document, whether the operation succeeded or failed, any error message, and a timestamp. This powers your dashboard, helps us diagnose failures and lets us detect abuse.

c) Messages you send us. When you use our contact form or email us, we receive your name, email address, chosen subject and the content of your message, so we can reply. These messages sit in our support inbox.

d) Technical data. Like virtually all websites, our servers process your IP address, browser type and request details as part of serving a request. We use this for security, rate limiting (to stop abuse of our free tools) and diagnosing errors.

e) Advertising and analytics data. Where advertising or analytics services are active on this site, they may set cookies or similar identifiers in your browser. See section 6.

We do not knowingly collect special-category data (such as health or biometric data), and we do not ask you for payment card details on this site.

4. How we use your information

We use the information above only in order to:

• perform the document operation you requested;
• create and maintain your account, and keep you signed in;
• show you your own usage history;
• reply to your support, privacy or billing enquiries;
• keep the service secure and available - detecting abuse, preventing brute-force attempts and enforcing fair-use limits;
• fix bugs and understand which tools need improvement;
• comply with legal obligations that apply to us.

We do not sell your personal data, and we do not rent or trade your email address. We do not send marketing email to people who have not asked for it.

5. Legal bases for processing

If you are in the United Kingdom, the European Economic Area or another region with comparable law, we rely on the following legal bases:

• Performance of a contract - to provide the tools and the account you asked for.
• Legitimate interests - to keep the service secure, prevent abuse, and improve how it works, balanced against your rights.
• Consent - for non-essential cookies, including advertising and analytics cookies, where consent is required. You may withdraw it at any time.
• Legal obligation - where we are required by law to retain or disclose information.

6. Cookies and similar technologies

Essential cookies. We store your authentication tokens in cookies in your browser. These are what keep you signed in and allow your session to be refreshed without asking for your password again. The service cannot provide a logged-in experience without them, so they are not optional while you are signed in. Clearing them signs you out.

Advertising cookies. This site may display advertising supplied by third-party networks, including Google. Google and its partners may use cookies or device identifiers to serve ads based on your prior visits to this or other websites, and to measure ad performance. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.

You can opt out of personalised advertising by Google at Google Ads Settings, and opt out of third-party vendor cookies more broadly at aboutads.info. You can also block or delete cookies in your browser settings, though doing so may affect how parts of this site work.

Analytics cookies. Where analytics are enabled, they tell us aggregate things like which tools are used most and where errors occur. We configure analytics to avoid collecting more than we need.

7. Service providers we use

We keep our list of processors deliberately short. Each is bound by its own agreement to process data only on our instructions:

• Cloud hosting and application infrastructure - runs the website and the server-side processing described in section 2.
• Managed database hosting - stores account records and usage history.
• Cloudinary - media and file storage used to deliver processed results and profile pictures.
• Email delivery provider - transmits contact-form messages to our support inbox and sends account-related email.
• Advertising and analytics providers, including Google - as described in section 6.

We may also disclose information where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our users.

8. International transfers

Our providers may process data in countries other than your own, including outside the United Kingdom and the European Economic Area. Where that happens, we rely on appropriate safeguards - such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a finding of adequacy for the destination country.

9. How long we keep data

• Documents processed on our servers - deleted once your request is complete (see section 2).
• Account data - kept while your account is open. Delete your account and we remove it, except where we must retain something to meet a legal obligation.
• Usage history - kept for as long as your account is open so you can review your own activity, then deleted with the account.
• Support messages - kept for as long as needed to resolve your enquiry and to keep a record of what was agreed, then deleted.
• Security and rate-limiting data - short lived; retained only as long as needed to serve its protective purpose.

10. How we protect your information

All traffic between your browser and our servers is encrypted in transit using HTTPS. Passwords are stored only as salted bcrypt hashes. Session tokens are short lived and the longer-lived refresh tokens are stored as hashes, so a database copy alone cannot be used to impersonate you; they can be revoked server-side. Sensitive endpoints are rate limited to frustrate automated attacks. Access to production systems is limited to the people who need it.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If a breach ever affects your personal data, we will notify you and the relevant regulator where the law requires it.

11. Your rights

Depending on where you live, you may have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• ask us to restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent you previously gave, at any time;
• opt out of the “sale” or “sharing” of personal information, and of targeted advertising, if you are a California resident - note that we do not sell personal information;
• not be discriminated against for exercising any of these rights.

To exercise any of these, email privacy@pdflyhub.com or use our contact form. We will respond within the period the applicable law allows - normally one month. We may need to verify your identity first, to make sure we are not disclosing your data to someone else. You also have the right to complain to your local data protection authority.

12. Children's privacy

PDFlyHub is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service changes or as the law requires. When we do, we revise the “last updated” date at the top of this page. If a change materially affects how we handle your personal data, we will give you clearer notice - for example a notice on the site or an email to your account address. Please review this page from time to time.

14. How to contact us

If you have a question about this policy or about how we handle your data, we would rather hear from you than have you wonder.