Summary: We process your uploaded files solely to perform the requested PDF operation. Files are automatically and permanently deleted from our servers within 1 hour. We do not sell your data. We do not use your file contents for training AI or any other purpose.
1. Who We Are
AllPDFStuff ("we", "us", "our") operates the website allpdfstuff.com, an online PDF processing service that provides tools to convert, compress, merge, split, rotate, and edit PDF documents.
For the purposes of applicable data protection law including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the Personal Data Protection Act (PDPA), we are the data controller of your personal information.
Contact: For any privacy-related queries, please contact us via our Contact page.
2. Information We Collect
2.1 Information You Provide Directly
- Account information: When you create an account, we collect your name and email address.
- Payment information: When you subscribe to a paid plan, payment is processed by Stripe. We do not store your full card details — only a payment reference token.
- Uploaded files: Files you upload for processing are temporarily stored on secure servers for the duration of the processing task only.
- Communications: If you contact us via email or our contact form, we retain that correspondence.
2.2 Information Collected Automatically
- Usage data: Pages visited, tools used, time and duration of visits, browser type, operating system, and referring URL.
- IP address: Collected for security, fraud prevention, and approximate geolocation (country/region level only).
- Cookies and similar technologies: See our Cookie Policy for full details.
3. How We Use Your Information
| Purpose | Legal Basis |
|---|
| Processing your uploaded files and delivering results | Contract performance |
| Creating and managing your account | Contract performance |
| Processing subscription payments | Contract performance |
| Sending transactional emails (receipts, password resets) | Contract performance |
| Improving our services and fixing bugs | Legitimate interests |
| Security monitoring and fraud prevention | Legitimate interests |
| Complying with legal obligations | Legal obligation |
| Sending marketing emails (only with consent) | Consent |
4. File Processing & Data Retention
Your uploaded files are automatically and permanently deleted within 1 hour of processing. We do not access, read, analyse, share, or retain the content of your files for any purpose other than performing the requested operation.
Other data retention periods:
- Account data: Retained while your account is active and for 30 days after deletion request.
- Payment records: Retained for 7 years to comply with financial regulations.
- Usage logs: Retained for up to 90 days for security and debugging purposes.
- Contact form messages: Retained for up to 2 years.
5. Sharing Your Information
We do not sell, rent, or trade your personal information. We may share information with:
- Service providers: Supabase (database/authentication), Stripe (payments), iLovePDF API (PDF processing), Vercel (hosting). Each operates under their own privacy policies and data processing agreements.
- Legal authorities: When required by law, court order, or to protect the rights and safety of our users or the public.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.
6. International Data Transfers
Our service providers may process data outside your country of residence. Where we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): Request deletion of your personal data.
- Right to restriction: Request that we limit processing of your data.
- Right to data portability: Receive your data in a machine-readable format.
- Right to object: Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
- CCPA rights (California residents): Right to know, right to delete, right to opt-out of sale (we do not sell data), and right to non-discrimination.
To exercise any of these rights, please contact us via our Contact page. We will respond within 30 days.
8. Security
We implement industry-standard security measures including:
- HTTPS/TLS encryption for all data in transit
- Encrypted storage for all personal data at rest
- Strict access controls — only authorised personnel can access systems
- Regular security audits and vulnerability assessments
- Automatic file deletion to minimise data exposure
No system is 100% secure. If you discover a security vulnerability, please contact us responsibly via our Contact page.
9. Cookies
We use cookies and similar tracking technologies. Please see our dedicated Cookie Policy for full details on what cookies we use, why, and how to control them.
10. Children's Privacy
Our service is not directed to children under the age of 13 (or 16 in the EU/UK). We do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us immediately and we will delete the information.
11. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and/or by prominently posting a notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of our service after changes take effect constitutes acceptance of the revised policy.
13. How to Contact Us
For any privacy-related questions, requests, or complaints, please use our Contact page.
If you are in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.