Privacy Policy

Who we are

pdfconversionapi.com and the API at https://api.pdfconversionapi.com are run by Zeel Shekhaliya, an individual based in Surat, Gujarat, India. In this policy, "we" and "us" mean Zeel Shekhaliya.

• Based in: Surat, Gujarat, India
• Privacy questions and requests: privacy@pdfconversionapi.com
• Grievance officer (India): Zeel Shekhaliya, at privacy@pdfconversionapi.com

We have not appointed a data protection officer, and we have not appointed a representative in the European Union or the United Kingdom. Send every privacy question to privacy@pdfconversionapi.com.

Two kinds of data, two roles

This policy covers personal data that we decide how to use: what we receive when you create an account or email us, the records we keep when you call the API, and what our website and account pages handle when you visit them. For this data we are the controller under the GDPR and UK GDPR, the business under California law where that law applies to us, and the data fiduciary under India's Digital Personal Data Protection Act, 2023, where that Act applies.

The files you send to the API are different. We process them for the customer whose API key sent them, and only to convert them. For those files we are a processor (GDPR and Indian law) and a service provider (California). Our Data Processing Addendum sets the rules. If a file contains your personal data and a customer of ours sent it, that customer decides what happens to it. Contact them first; if you write to us, we will pass your request on to them.

What we collect

When you create an account

You create an account, and get a free API key, by signing in with Google or GitHub at app.pdfconversionapi.com. You choose which one. Google and GitHub are sign-in providers, not companies that work for us: they do not receive the files you convert, and their own privacy policies (Google, GitHub) cover what they do when you sign in with them.

What we receive:

• From Google: your email address, whether Google has verified it, and your Google account id (the OpenID sub value). We ask only for the openid email scopes, which don't include your name or picture.
• From GitHub: your public GitHub profile (your user id, username and anything else you made public there) and the email addresses on your GitHub account with whether each is verified. We ask only for the user:email scope.

We keep only the verified email address (for GitHub, your verified primary address) and the Google or GitHub account id. We keep nothing else from them: not your name, your picture, your other addresses or anything about your repositories. We never receive or keep your Google or GitHub password.

There is one account for each verified email address. If you sign in with Google and with GitHub using the same verified address, both open the same account. In a Cloudflare D1 database we keep:

• your email address;
• which of Google and GitHub you have signed in with, and each one's account id for you;
• your plan;
• for your API key: its SHA-256 hash, its last four characters (so you can tell keys apart) and the date it was made. We never store the key itself;
• the effective date of the Terms you agreed to when you signed up, and the time your account was created;
• for each sign-in session: a hash of the session cookie, never the cookie itself, and when the session started and ends.

To check API requests, Cloudflare Workers KV also holds your key's SHA-256 hash with your account identifier, your plan and the time the key was made. A key cannot be recovered from its hash. If you lose your key, replace it on the key page; the old key is revoked.

The cookies the account pages set are described under Cookies and browser storage.

Deleting your account

You can delete your account on the key page at any time. That deletes your account record, its sign-in identities and its sessions, and revokes your API key.

Deleting your account does not delete:

• this month's conversion count (see When you use the API). It is kept under an id made from a one-way hash of your email address, not under the address itself, so that deleting and re-creating an account does not reset the month's free allowance. It holds no file contents or file names. It is deleted shortly after the calendar month ends;
• usage records, request logs and stored results, which are deleted on their normal schedule (see How long we keep it);
• emails you sent us.

When you use the API

• API key: see When you create an account.
• Monthly count: for each account, we keep a count of its successful conversions this calendar month and of the conversions running right now, to apply your plan's limits. The count is kept in Cloudflare Durable Objects under an id made from a one-way hash of your email address. It holds no file contents or file names.
• Usage records: for each conversion request that reaches a conversion engine, we record your account identifier and plan, the source and target formats, which of our conversion pools handled it, the HTTP status, how long it took, the size of the request in bytes, whether it succeeded, and the time. These records go to Cloudflare Workers Analytics Engine. They contain no file names and no file contents. We use them to count usage, plan capacity and, once billing opens, to bill.
• Request logs: see Logs.

The API does not use cookies.

Files you convert

Here is what happens to a file you send to the API:

1. It travels over HTTPS to Cloudflare and passes through our API gateway, a Cloudflare Worker. Requests up to 25 MB are held in the gateway's memory so a busy conversion server can be retried; larger ones stream through.
2. It is converted in a Cloudflare Container that has no internet access. The file is held in memory and, for engines that run as separate programs, written to a temporary directory created for that one conversion. The directory is deleted when the conversion ends. An engine that runs longer than 120 seconds is stopped.
3. The result comes back in the API response. Unless you ask us to store it, we keep no copy of the file or the result.
4. If you send StoreFile=true, each result file is saved in Cloudflare R2 in the United States jurisdiction, under a random 128-bit id and its file name, with your account identifier and an expiry time attached. Its download link stops working 3 hours after the conversion. A job that runs every 15 minutes deletes files whose links have expired. As a backstop, a storage rule removes any stored file more than 1 day old; Cloudflare applies such rules typically within 24 hours. You can delete a stored result earlier with DELETE /v2/d/{id}.

We do not open or read the files you send, with two exceptions: when you send us a file and ask us to look at it, and when we must investigate a report of abuse or the law requires it (for example, to report apparent child sexual abuse material). Because we keep nothing unless you set StoreFile=true, there is usually nothing left to look at.

We do not use your files, or anything in them, to train machine learning or AI models. Our OCR engine uses models that were trained before we received your file; they read your pages and learn nothing from them. If we ever want to change this, we will ask you first, and we will never apply the change to files you sent before.

Logs

Cloudflare Workers Logs keeps a record of each request to our API gateway, and the log lines our conversion containers write. A record can include:

• the time, method, URL and response status of a request, and how long it took (for a download link, the URL includes the stored file's id and name);
• request metadata and headers that Cloudflare captures, which can include your IP address, your approximate location (country) and your browser's user agent;
• for conversions: the formats, the number of output files, the conversion time, and the engine's error message when a file cannot be converted (for example, that the file is password-protected);
• errors from our own code, tagged with the request's id.

Logs do not record file contents. Cloudflare deletes these records within 7 days.

The account pages do not write a log entry for each request. If one fails with an error, the page's path and the error message are kept in Cloudflare Workers Logs for up to 7 days.

Cloudflare also keeps its own records of traffic to our domains, such as traffic statistics and security events, which can include IP addresses and user agents, and shows them to us in its dashboard. Cloudflare decides how long it keeps them. We use them only to investigate attacks and errors.

Email you send us

If you email us, we receive your email address, your name if you include it, your message and any attachments, and we keep them in our mailbox. Please do not attach files that contain other people's personal data unless we ask for them; if you do, we delete them when your question is answered.

Visits to this website

The website is a set of static pages served by Cloudflare. We run no analytics, no advertising or social-media pixels and no session recording, and our fonts are served from our own domain. The website and the account pages load no third-party code. When you choose to sign in with Google or GitHub, your browser goes to that company's sign-in page and then comes back to ours. See Cookies and browser storage.

Why we use it

We do not send marketing email. If we start, we will ask first, and every message will have a working unsubscribe link.

You do not have to give us any personal data. Without a Google or GitHub account and the verified email address it gives us, you cannot create an account or get a key, and without a file we cannot convert it.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

How long we keep it

If the law requires us to keep something longer, for example after a valid legal hold, we keep only what the law requires and only for as long as it requires.

Who we share it with

• Cloudflare, Inc. (San Francisco, California) runs our network, website, account pages, API gateway, conversion containers, file storage, databases and logs, and receives the email sent to our @pdfconversionapi.com addresses and forwards it to our inbox. It processes personal data for us under its customer data processing addendum. Its privacy policy describes how Cloudflare handles data. Cloudflare is the only company that handles the files you send to the API.
• Google LLC (Mountain View, California) hosts the Gmail inbox those addresses forward to. It holds the emails you send us and the replies we send you, under Google's own terms and privacy policy.

Our subprocessors page names every company that processes personal data for us, and we update it before adding one.

When you sign in with Google or GitHub, they are not acting for us: they are sign-in providers you choose, as described under When you create an account. Google appears on the subprocessors page only for our email inbox.

Billing is not open yet, so no payment processor receives your data. Before billing opens, we will update this policy and the subprocessors page.

We also disclose personal data:

• when the law requires it, for example under a court order, or to report apparent child sexual abuse material to the police or the National Center for Missing and Exploited Children (NCMEC). Unless the law forbids it, we tell the affected customer before we disclose anything;
• to protect someone from serious harm;
• if we sell or merge our business, to the buyer, who must keep following this policy. We will tell you before that happens.

We do not sell or share personal information, as California law defines those words, and we do not use it for targeted advertising. We have not done either in the past 12 months.

Where your data is processed

Cloudflare runs our service on its global network. Your request is handled at a Cloudflare location near you, and a conversion runs in a Cloudflare location that has free capacity, which can be in another country. Stored conversion results stay in Cloudflare R2's United States jurisdiction. The account database, monthly conversion counts, request logs, usage records and API key hashes are stored where Cloudflare places them, which can be outside the United States. We do not offer EU-only processing yet.

We run the service from India. When we look at the account database, request logs or usage records, for example to fix an error or answer your request, we do so from India.

If you are in the European Economic Area, the United Kingdom or Switzerland, your data is processed outside your country, including in the United States and India. Cloudflare's data processing addendum with us relies on the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses (with the UK and Swiss additions). We are not certified under the Data Privacy Framework ourselves. For files that customers send us, our Data Processing Addendum includes the Standard Contractual Clauses. To get a copy of the safeguards, write to privacy@pdfconversionapi.com.

Cookies and browser storage

Our website and our API set no cookies, and the site runs no analytics. The account pages at app.pdfconversionapi.com set two cookies, both needed to sign you in, and no analytics or advertising cookies:

• __Host-session: keeps you signed in. It holds a random session token; we store only a hash of it. It is HttpOnly (page scripts cannot read it), Secure (sent only over HTTPS) and SameSite=Lax, and lasts 30 days. Signing out or deleting your account ends the session.
• A sign-in cookie, set when you start signing in with Google or GitHub. It is signed by us, holds the state of that sign-in, and lasts 10 minutes.

On the website:

• Code examples: when you pick a language tab (curl, Python or Node.js) in a code example, your browser remembers the choice in its local storage under the name code-lang. It never leaves your device. Clearing your browser's site data removes it.
• Security challenges: Cloudflare serves the site and protects it from attacks. If Cloudflare ever shows you a security challenge on our domain, it sets a cf_clearance cookie when you pass it, so you are not challenged again, and uses it for nothing else. Cloudflare lists its cookies on its cookies page.

No company other than Cloudflare collects information about you through our site, and no one uses it to follow you across other websites. When you choose to sign in with Google or GitHub, you use that company's own sign-in page. That is why we show no cookie banner. If we ever add analytics or any cookie that is not strictly necessary, we will update this section first and ask for your consent where the law requires it.

Do Not Track and Global Privacy Control

We do not track visitors across other websites, and we do not let anyone else do so through our site. We therefore treat every visit the same way, whether or not your browser sends a Do Not Track signal.

We do not sell or share personal information, so a Global Privacy Control signal has nothing to opt you out of today. If that ever changes, we will treat a Global Privacy Control signal as a valid request to opt out.

Your rights

What you can ask us

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data;
• give you your data in a machine-readable format (we use CSV or JSON);
• stop using your data for a purpose that relies on our legitimate interests.

You can also delete your account yourself on the key page at app.pdfconversionapi.com. Deleting your account explains what that removes and what stays.

To make a request, email privacy@pdfconversionapi.com from the address we have for you, or tell us which address to look for. We confirm that we received your request within 10 business days and answer within one month. If a request is complex, we may need longer (up to two more months under the GDPR, or 45 more days under California law); if so, we tell you why within the first month. Requests are free.

To protect your data, we check that a request comes from you, normally by asking you to reply from the email address we have on file. We do not ask for a photo ID. Someone else can make a request for you if you give them written permission; we may confirm it with you directly.

If we refuse a request, we tell you why. You can appeal by replying with the word "appeal"; we will review the decision again and answer within 45 days.

We will not treat you differently, charge you more or give you a worse service because you used any of these rights.

In the EU, the UK and Switzerland

You also have the right to restrict how we use your data, to withdraw any consent you gave us (this does not affect what we did before), and to complain to a data protection authority. In the EU, that is the authority in the country where you live or work, or where you think the problem happened. In the UK, it is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would like the chance to fix the problem first, so please write to us too.

In India

You can also nominate someone to use these rights for you if you die or become unable to use them yourself. Our grievance officer is Zeel Shekhaliya: write to privacy@pdfconversionapi.com with any complaint about how we handle your personal data, and we will resolve it within one month of receiving it. If you are not satisfied with our answer, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, where that Act applies.

In California and other US states

About 24 US states, California among them, have privacy laws that give residents rights such as access, correction, deletion and portability, and the right to opt out of the sale of personal data, targeted advertising and some profiling. We honor the access, correction, deletion and portability requests above from everyone. We do not sell personal data, share it for targeted advertising or use it for profiling, so there is nothing to opt out of. You can use an authorized agent and appeal a decision, as described above.

California notice

This table lists the personal information we collect, using the categories in California law.

Sold or shared in the past 12 months: none. Sources, purposes and retention for each category are described above.

Children

The service is for businesses and developers, and you must be 18 or older to use it. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, email privacy@pdfconversionapi.com and we will delete it.

Security

Our security page describes the controls in detail. In short: API keys are stored only as SHA-256 hashes (with their last four characters), session cookies only as hashes, conversions run in containers with no internet access, each conversion's working files are deleted when it ends, and results are kept only when you ask. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Changes to this policy

When we change this policy, we update the effective date at the top of this page. If a change reduces your rights or lets us use your data in a new way, we email the address on every account at least 30 days before it takes effect, and we do not apply it to data we collected before the change. To get an earlier version, write to privacy@pdfconversionapi.com.

Contact us

• Email: privacy@pdfconversionapi.com
• Grievance officer (India): Zeel Shekhaliya, at the same address

We do not have a postal address for privacy requests. Zeel Shekhaliya is based in Surat, Gujarat, India.