Subprocessors
Effective 2026-11-05. All legal pages
In short
Cloudflare carries every request, runs the conversions, holds accounts and sign-in sessions, stores the results you ask us to keep, holds our logs and forwards the email sent to our addresses. Google hosts the inbox that email goes to. When you sign in with Google or GitHub, they are sign-in providers you choose, not subprocessors. A payment provider and automatic email are not in use yet. We email every account at least 14 days before we add or replace a subprocessor.
This summary is for convenience. The full text below is what applies.
Contents (5 sections)
A subprocessor is a company we use that processes personal data for us, including any personal data inside the files you convert. This list is part of our Data Processing Addendum. We list only companies that actually handle that data, not every vendor we might use one day.
In use
| Company | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Network and HTTPS for the API, this website and the account pages, the API gateway, the conversion containers, storage of results you ask us to keep, the account database and sign-in sessions, API key records, usage records and logs; forwarding the email sent to our @pdfconversionapi.com addresses | Files you convert and their names, request metadata including IP addresses, account holders' email addresses and Google or GitHub account ids, account ids, API key hashes, session hashes; emails sent to us | Cloudflare's global network. Stored results stay in the United States. |
| Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Hosts the Gmail inbox our @pdfconversionapi.com addresses forward to | Emails you send us and our replies, including your email address, name and any attachments | Google's data centers |
Cloudflare processes this data under its Customer Data Processing Addendum (version 6.4, dated 2026-04-03). That addendum covers transfers of personal data out of the EU, the UK and Switzerland, using the EU-US Data Privacy Framework and the Standard Contractual Clauses. Cloudflare has its own subprocessors under that addendum and gives 30 days' notice before it changes them. Google holds our email under its terms for Gmail and its privacy policy; we have not signed a separate data processing agreement with Google.
What each Cloudflare service handles
| Service | What it does for us | Data | Where | How long |
|---|---|---|---|---|
| Network and TLS | Receives every request to the API, to this website and to the account pages over HTTPS | Your requests, including uploaded files, and your IP address | The Cloudflare data center that receives the request | Passes through |
| Workers | Runs the API gateway (checks keys and rate limits, sends each file to a converter) and the account pages at app.pdfconversionapi.com (sign-in with Google or GitHub, the key page, account deletion; limits sign-in attempts from each IP address) | The request, with any uploaded file held in memory, and your IP address for the sign-in rate limit | The data center that receives the request | The length of the request. Rate limit counts are kept in memory, not stored. |
| Containers | Runs the conversions, with no internet access | Uploaded and converted files | The nearest location with an instance ready; not pinned to a country | Until the conversion ends |
| R2 | Stores results when you send StoreFile=true | Converted files and their names | United States (R2 us jurisdiction) | The link works for 3 hours. A job that runs every 15 minutes deletes expired files; a 1-day lifecycle rule is the backstop. |
| Workers KV | Holds API key records, which the API gateway checks | The SHA-256 hash of each key, account id, plan, and when the key was made | Not pinned to a region | Until the key is replaced or the account is deleted |
| Durable Objects | Counts each account's successful conversions this month and the conversions running now, to apply plan limits | The count, kept under an id made from a hash of the account's email address. No file contents or file names. | Not pinned to a region | Until shortly after the calendar month ends, then deleted. Not deleted early when the account is deleted. |
| Workers Analytics Engine | Usage records, to count usage and, once billing opens, to bill | Account id, plan, formats, status, duration, upload size | Not pinned to a region | 3 months |
| Workers Logs | Request logs for the API gateway and the conversion containers, and errors from the account pages | Request metadata, described under Logging | Not pinned to a region | Up to 7 days |
| Email Routing | Receives email sent to our @pdfconversionapi.com addresses and forwards it to our Gmail inbox | Each email, and a delivery record (sender, recipient, subject, result) shown in our dashboard | Cloudflare's network | Messages pass through and are not stored. Cloudflare decides how long it keeps delivery records. |
| D1 | Stores accounts, their sign-in identities and sessions | Email address, plan, the effective date of the Terms agreed to at sign-up, when the account was made; the API key's SHA-256 hash, last four characters and date made; which of Google and GitHub was used and that provider's account id; for each session, a hash of the session cookie and its start and end times | Not pinned to a region | Until the account is deleted. Signing out deletes that session, and a daily job deletes sessions that have ended. |
The security page has the full retention table and explains how each period is enforced.
Sign-in providers you choose
To create an account and sign in, you choose Google or GitHub. They are not subprocessors: they do not process data for us and do not receive the files you convert. We keep only the verified email address and the Google or GitHub account id from a sign-in, and nothing else from them. Their own privacy policies cover what they do when you sign in with them. Our Privacy Policy has the details.
Planned, not in use yet
| Purpose | Company | Status |
|---|---|---|
| Payments and invoices | Not chosen yet | Not in use yet. Billing is not open. |
| Automatic email, such as account notices | Not chosen yet | Not in use yet |
None of these receives any data until it has gone through the notice process below and appears in the table under "In use".
How we announce changes
- At least 14 days before we add or replace a subprocessor, we email the address of every account and update this page. Every account has a verified email address, because you sign up with one.
- If you object to a change, email legal@pdfconversionapi.com within those 14 days. If we can't resolve the objection, you can stop using the service. The Data Processing Addendum sets out the details.
- Questions about this list: privacy@pdfconversionapi.com.
Changes to this list
- 2026-11-05: first version. Cloudflare, and Google for our email inbox.