Last updated: 1 October 2026. This policy explains what personal data PDFAPPLE Ltd. collects when you use pdfapple.com/ (“Service”), why we collect it, how long we keep it, who we share it with, and the rights you can exercise. We wrote it in plain English on purpose. If anything is unclear, email our Data Protection Officer at [email protected].
In this document
1. Who we are
PDFAPPLE Ltd. is a limited company registered in England & Wales (company number 11574422) with its registered office at 71–75 Shelton Street, London WC2H 9JQ, United Kingdom. We are the data controller for the information described in this policy. For enquiries, write to [email protected] or call +44 20 3137 1234.
2. What data we collect
2.1 Files you upload
When you use a conversion tool we temporarily receive the file you upload. The file is held in an encrypted queue only for the time required to perform the conversion and offer it for download. We do not read, open, index or copy the content of your files for any purpose other than running the conversion you requested.
2.2 Account data (optional)
If you create a paid account, we store: email address, hashed password, first and last name, country, billing address, VAT number (if applicable), and a Stripe customer ID. Credit-card numbers are never stored on our servers — Stripe is our PCI DSS Level 1 payment processor.
2.3 Technical data
We automatically log: IP address, browser user-agent, HTTP method, URL path, response status, response size, request duration, and a per-visit random session identifier. These logs are kept in rotating files for 30 days for security and abuse prevention.
2.4 Usage analytics
We run a self-hosted Plausible instance to count page views, referrers, and tool usage. Plausible does not use cookies and does not collect personal data. We do not use Google Analytics on this site.
3. How we use your data
- To perform the service you requested (converting or compressing a file).
- To authenticate you and bill your subscription.
- To respond to support messages.
- To monitor service availability and prevent abuse (e.g. rate-limit violent spikes of requests).
- To comply with legal obligations (e.g. keeping tax records for 7 years as required by HMRC).
We never use your file content to train machine-learning models, sell your data, send unsolicited marketing, or share with advertisers.
4. Legal basis for processing (GDPR)
Our processing is lawful under the following Article 6 bases:
- Contract (Art. 6(1)(b)) — processing files you upload and running your account.
- Legitimate interests (Art. 6(1)(f)) — security logging, abuse prevention and privacy-friendly analytics.
- Legal obligation (Art. 6(1)(c)) — invoicing, VAT and tax records.
- Consent (Art. 6(1)(a)) — only where you explicitly opt in (e.g. newsletter).
5. How long we keep your data
| Category | Retention |
|---|---|
| Uploaded files | ≤ 60 minutes, then permanent deletion |
| Access logs | 30 days |
| Account data | Until deletion request + 30 days backup window |
| Invoices & tax records | 7 years (UK HMRC) |
| Support emails | 24 months |
6. Who we share your data with
We share personal data only with a short, named list of sub-processors that help us run the Service:
- Hetzner GmbH (Germany) — primary hosting.
- Cloudflare, Inc. (EU/US) — DDoS protection and CDN.
- Stripe Payments Europe Ltd. (Ireland) — payment processing.
- Postmark (ActiveCampaign) (US) — transactional email delivery.
- Freshdesk (Freshworks) (EU) — support ticketing.
Each sub-processor is bound by a data-processing agreement that includes GDPR Article 28 obligations and Standard Contractual Clauses where applicable.
7. Cookies & tracking
We use only strictly-necessary and preference cookies (session ID, dark-mode toggle, cookie-banner acknowledgement). We do not set advertising or cross-site tracking cookies. See the full Cookie Policy.
8. Security measures
- TLS 1.3 encryption on every endpoint.
- AES-256 encryption at rest for queued files.
- Hashed, salted passwords (Argon2id).
- Role-based access controls — only two engineers can SSH into production.
- Annual penetration test by an independent CREST-accredited firm.
- SOC 2 Type II report available on request under NDA.
9. Your rights
Under the UK GDPR / EU GDPR / California CPRA you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your account and associated data (“right to be forgotten”).
- Port your data to another service in a machine-readable format.
- Object to processing or restrict it.
- Withdraw consent at any time.
- Lodge a complaint with your local data-protection authority (UK: the ICO; EU: your national DPA; California: the CPPA).
To exercise any of these rights, email [email protected]. We respond within 30 days.
10. Children’s privacy
PDFAPPLE is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with data, email us and we will delete it immediately.
11. International transfers
Our primary data centres are in the EU (Germany). When data is transferred outside the EU (e.g. US email delivery via Postmark) we rely on the EU–US Data Privacy Framework, UK Addendum, and Standard Contractual Clauses.
12. Changes to this policy
We will post updates on this page and, for material changes, notify logged-in users by email at least 14 days before the change takes effect. Previous versions are archived at privacy-policy-history.
13. Contact us
Email: [email protected]
Post: Data Protection Officer, PDFAPPLE Ltd., 71–75 Shelton Street, London WC2H 9JQ, UK
Phone: +44 20 3137 1234 (Mon–Fri 09:00–18:00 GMT).