Privacy Policy

The controller of your personal data is Traffic Corsar SAS, 27 avenue Jean Médecin, 06000 Nice, France, RCS Nice 999 455 512. For any question about your data or to exercise your rights, write to privacy@pdfora.click or to our postal address. We have not appointed a data protection officer.

• Browser tools process your files on your device. They are never uploaded.
• Server tools upload your file for conversion. It is deleted once converted; the result is deleted after 60 minutes. We never read or reuse your files.
• We use no advertising and no tracking cookies, and we do not sell your data. Usage statistics are processed for us by Mixpanel, without cookies.
• Marketing emails are sent only if you switch them on.

Browser tools (merging, splitting, rotating, signing, forms, images to PDF and the other tools not listed below) run in your browser. The file stays on your device and never reaches our servers.

Server tools (PDF to Word, PDF to Excel, Word to PDF, Excel to PDF, and PowerPoint to PDF) upload your file to our server, where our conversion service converts it:

• The uploaded file is written to a temporary folder and deleted as soon as the converted file has been returned.
• The converted file and its file name are stored on our server for 60 minutes so that you can download it. After 60 minutes it can no longer be downloaded and it is deleted by an automatic clean-up.
• The download link is random and the download requires a Pro subscription. The file is not linked to your account.

We process the content of your files only to perform the conversion you asked for. We do not look at it, analyse it, use it to train anything or share it. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).

• Your account

  Data

  Name, email address, one-time sign-in codes (stored only as a secure hash, valid 10 minutes), a password hash only for accounts created before October 2026, language, email verification status, account role, creation date

  Legal basis (GDPR)

  Contract (Art. 6(1)(b))

• Sign in with Google (optional)

  Data

  Your Google account ID, name, email address and profile picture link, and the sign-in tokens Google returns. We do not use them to access your Google data.

  Legal basis (GDPR)

  Contract (Art. 6(1)(b))

• Keeping you signed in and secure

  Data

  Session token, expiry date, IP address and browser user agent at sign-in; one-time sign-in codes. Your IP address is also held briefly in memory to limit abusive requests.

  Legal basis (GDPR)

  Contract; legitimate interest in security (Art. 6(1)(f))

• Task history

  Data

  For each task: tool, processing engine, file size, number of pages, duration, success or error code, time. Never the file or its name. Linked to your account if you are signed in, so that you can see the last 30 days in your account; anonymous otherwise.

  Legal basis (GDPR)

  Contract; legitimate interest in running and improving the service

• Usage statistics

  Data

  Events such as "tool opened", "file selected", "task done" or "task failed", "download", "paywall shown", "checkout started" or "pricing viewed", with the tool, processing engine, file size, number of pages, duration, error code, number of files and time; sign-up and sign-in (with the method: email or Google); subscription events (started, cancelled, resumed, ended, payment failed, refunded, country not served) with the plan, currency, billing country, introductory offer and amount; device type (mobile, tablet or desktop) and page language. Linked to your account if you are signed in; otherwise to a pseudonymous identifier calculated from your IP address and browser user agent, which changes every day and cannot be turned back into your IP address. No cookie is used, nothing is stored on your device and your IP address is not stored with them. Never your files, file names, email address or name. These events are also sent to Mixpanel, our analytics provider, which stores them in the EU.

  Legal basis (GDPR)

  Legitimate interest in understanding how the service is used and improving it (Art. 6(1)(f)); you can object (section 9)

• Service emails

  Data

  Email address, name and language: one-time sign-in codes, email verification and, for subscribers, the order confirmation, the reminder before the first monthly charge, cancellation confirmations and withdrawal or cancellation acknowledgements (payment receipts and invoices come from Link)

  Legal basis (GDPR)

  Contract

• Marketing emails

  Data

  Email address and your choices (product news, tips, offers, surveys), with the date you made them

  Legal basis (GDPR)

  Consent (Art. 6(1)(a)), off by default

• Subscription and payment (when you subscribe)

  Data

  Plan, status, renewal and cancellation dates, Stripe customer and subscription IDs. Card details are entered in Stripe's form; we never receive them.

  Legal basis (GDPR)

  Contract; legal obligation for invoices (Art. 6(1)(c))

• Placing an order

  Data

  Plan, currency, the country you declare, the time and text version of your request to start immediately, and the billing country from Stripe (to sell only where we may)

  Legal basis (GDPR)

  Contract; legal obligation to prove the request (Art. 6(1)(b) and (c))

• Withdrawals and cancellations

  Data

  Name, email address, the contract, type and requested date of a cancellation, the reason if you give one, time of receipt and what we did

  Legal basis (GDPR)

  Legal obligation (consumer law) and contract

• "Tell me when it's available" list

  Data

  Email address, country, language and the date of your consent

  Legal basis (GDPR)

  Consent (Art. 6(1)(a)); withdraw it at any time by writing to us

• Support

  Data

  Your messages and our replies

  Legal basis (GDPR)

  Contract; legitimate interest

• Audit log

  Data

  Record of sensitive actions: changes to your email choices (proof of consent), subscription cancellations, account deletions, and actions by our staff on accounts (with the email address concerned)

  Legal basis (GDPR)

  Legitimate interest in security and proof; legal obligation to prove consent

Only our authorised staff can access account data in our administration tools, when they need it for support or security.

We do not sell or rent your data. We share it only with the service providers that process it on our behalf, under contracts that require them to protect it:

• Hostinger International Ltd

  Role

  Hosting of the website, the database and the conversion service (virtual private server)

  Location

  Servers in Germany (Frankfurt); company in Cyprus (EU)

• Plus Five Five, Inc. (Resend)

  Role

  Sending emails

  Location

  United States

• Sold through Link, LLC (Stripe)

  Role

  Seller of record of your Pro payments ("Sold through Link"): payment processing, tax, receipts and invoices, fraud prevention, disputes and payment support. Link and Stripe act as independent controllers for these purposes under their own privacy policies; the card payment itself is processed by a Stripe acquiring company (for example Stripe Technology Europe Limited, Stripe Payments Canada Ltd. or Stripe Payments Australia Pty Ltd.)

  Location

  United States, Ireland, Canada, Australia and other countries where Stripe operates

• Mixpanel, Inc.

  Role

  Product analytics (usage statistics)

  Location

  EU (stored); United States (access)

• Google Ireland Limited

  Role

  Sign in with Google, only if you use it. Google processes this data as an independent controller under its own privacy policy.

  Location

  Ireland (EU); Google LLC in the United States

We may also disclose data when required by law, for example to a court or authority.

Resend (Plus Five Five, Inc. (Resend)) processes email data in the United States. The transfer relies on its certification under the EU-U.S. Data Privacy Framework and, in addition, on the European Commission's Standard Contractual Clauses (Decision 2021/914). Mixpanel (Mixpanel, Inc.) stores usage statistics in the EU but may access them from the United States; this relies on the same two mechanisms (its Data Privacy Framework certification and the Standard Contractual Clauses). Stripe and Google transfer data to the United States under the same mechanisms, as described in their privacy policies. You can ask us for a copy of the safeguards at privacy@pdfora.click.

• Files uploaded to server tools

  Kept for

  Deleted as soon as converted

• Converted files

  Kept for

  60 minutes, then deleted

• Account (and Google sign-in link)

  Kept for

  Until you delete your account

• Sign-in sessions

  Kept for

  30 days after the last renewal, or until you sign out

• One-time sign-in codes and email links

  Kept for

  10 minutes (sign-in codes); 24 hours (email verification links) and 1 hour (password-reset links, accounts created before October 2026 only)

• Task history

  Kept for

  Shown for 30 days; deleted after 12 months, or when you delete your account

• Usage statistics

  Kept for

  13 months, or until you delete your account

• Usage statistics at Mixpanel

  Kept for

  24 months, then deleted

• Marketing choices

  Kept for

  Until you delete your account; proof of consent in the audit log as below

• Audit log

  Kept for

  3 years

• Support emails

  Kept for

  3 years after the last exchange

• Invoices and payment records

  Kept for

  10 years (French accounting law)

• Withdrawal and cancellation notices

  Kept for

  3 years

• "Tell me when it's available" list

  Kept for

  24 months after your consent, or until you withdraw it

When you delete your account, we delete it immediately together with your sessions, sign-in methods, subscription record, task history and usage events. For the usage events linked to your account at Mixpanel, we ask Mixpanel to delete them within 30 days. Only the audit-log entry recording the deletion (with your email address) and records we must keep by law remain, for the periods above.

The site is served only over HTTPS. Sign-in codes are single-use, expire after 10 minutes and are stored only as hashes, never in plain text; the same applies to the passwords of accounts created before October 2026. The session cookie cannot be read by scripts. The conversion service runs isolated, with a read-only file system and temporary storage only. Access to the database is restricted to the application and authorised staff.

Under the GDPR you have the right to:

• access your data and get a copy;
• rectify it (you can change your name in your account);
• erase it (you can delete your account yourself in your account settings);
• data portability for the data you gave us;
• object to processing based on our legitimate interest, including usage statistics;
• restrict processing in the cases provided by law;
• withdraw your consent to marketing emails at any time in your account's notification settings, without affecting earlier processing;
• give instructions on what happens to your data after your death (French law).

Write to privacy@pdfora.click from the email address of your account. We answer within one month. We may ask you to confirm your identity.

You can also lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the authority of the EU country where you live or work.

You must be at least 16 years old to create an account and 18 to buy a subscription. We do not knowingly collect data from younger children; if you think we have, write to us and we will delete it.

We use only cookies and browser storage that are strictly necessary or that remember choices you make. They are listed in our Cookie Policy.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

This policy applies wherever you live. If you live outside the EU/EEA (for example in Australia, Canada, the United Arab Emirates or the United States), your data is processed by the providers and in the countries listed above, and you have the rights described in section 9, in addition to any rights under your local law. Contact us at the address above with any question or complaint.

We will update this policy when our processing changes, and change the date at the top. If a change matters to you, we will tell you by email or on the site before it applies.