Privacy Policy

Effective date: February 16, 2026 · Last updated: February 16, 2026

    Plain English summary: We collect only what we need to run the service. We don't sell your data. Your documents and templates are yours. EU/international users can request deletion at any time by emailing us.
  

1. Who This Policy Applies To

This Privacy Policy describes how PDeffortless ("we," "us," or "our") collects, uses, and protects information about users of pdfortless.com and its associated API. It applies to all users regardless of location, including users in the European Union, United Kingdom, and other jurisdictions with data protection laws.

2. Information We Collect

Information you provide directly:

Account registration: first name, last name, email address, industry/use case, and password (stored as a hashed value — we never store your plain-text password)
Payment information: billing details submitted through Stripe. We do not store credit card numbers — Stripe handles all payment data directly
PDF templates and data you upload to generate documents
Communications you send to us (e.g. support emails)

Information collected automatically:

Usage data: number of documents generated, API call timestamps, error logs
Technical data: IP address, browser type, and device information collected via standard web server logs
Session cookies used for authentication (see Section 8)

3. How We Use Your Information

Purpose	Data used	Legal basis (GDPR)
Providing the service	Account data, uploaded templates and data	Contract performance
Billing and invoicing	Email, usage counts, Stripe customer ID	Contract performance
Transactional emails (verification, invoices)	Email address, first name	Contract performance
Fraud and abuse prevention	IP address, email, account activity	Legitimate interests
Product improvement	Aggregated, anonymised usage data	Legitimate interests
Customer support	Email, account data, support correspondence	Legitimate interests

We do not use your data for advertising, profiling, or sell it to third parties under any circumstances.

4. Your Documents and Templates

PDF templates you upload and data you provide for document generation are used solely to perform the service. We do not read, analyse, or share the content of your documents beyond what is technically necessary to fill and return them to you. Documents are not retained on our servers after generation unless you explicitly save a template for reuse.

5. Third Parties We Work With

Provider	Purpose	Data shared
Stripe	Payment processing	Email, billing details
Resend	Transactional email delivery	Email address, first name
Render	Cloud hosting and infrastructure	All data (hosted on their servers)
PostgreSQL / Neon	Database storage	All account and usage data

All third-party providers are contractually required to handle your data in accordance with applicable data protection laws. We do not share your data with any other parties except where required by law.

6. Data Retention

Account data is retained for as long as your account is active
Usage logs and job history are retained for up to 12 months for billing and support purposes
Uploaded PDF templates (if saved) are retained until you delete them or close your account
Upon account closure, your personal data is deleted within 30 days, except where we are required to retain it for legal or financial compliance reasons (e.g. billing records may be retained for up to 7 years)

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request that we correct inaccurate or incomplete data
Deletion: Request that we delete your personal data ("right to be forgotten")
Portability: Request your data in a machine-readable format
Objection: Object to processing based on legitimate interests
Restriction: Request that we restrict processing in certain circumstances

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. We do not charge a fee for reasonable requests.

    EU / UK users: If you are located in the European Union or United Kingdom, you have rights under GDPR and UK GDPR respectively. You also have the right to lodge a complaint with your local supervisory authority if you believe we have handled your data unlawfully.
  

8. Cookies

We use a minimal number of cookies:

Authentication token: A session token stored in your browser's local storage to keep you logged in. This is strictly necessary for the service to function and is not used for tracking.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not use Google Analytics or any behavioural tracking tools.

9. Data Security

We take reasonable technical and organisational measures to protect your data, including:

Passwords stored as bcrypt hashes — never in plain text
All data transmitted over HTTPS/TLS
API keys required for programmatic access
Access to production systems limited to authorised personnel

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please disclose it responsibly by emailing [email protected].

10. International Data Transfers

PDeffortless operates from the United States. If you are located outside the US, your data will be transferred to and processed in the United States. Our hosting infrastructure (Render) may also process data in other regions. By using the service, you consent to this transfer. We take steps to ensure adequate protections are in place for international transfers in compliance with applicable law.

11. Children's Privacy

PDeffortless is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes. The effective date at the top of this page will always reflect the most recent revision. Continued use of the service after a policy update constitutes acceptance of the revised policy.

13. Contact

For privacy questions, data requests, or concerns, contact us at