The short version
Most tools on this site run inside your web browser: your files are opened, processed and saved on your own device and never reach us. A few tools, marked “Runs on our servers”, send the file to our servers because the work cannot be done in a browser; those files travel over an encrypted connection, are stored encrypted, are read by software only, and are deleted automatically, within the hour unless you have an account and asked to keep them longer. Accounts are optional and hold only an email address. We set no advertising cookies and sell nothing about you. The rest of this policy explains the details.
Who we are
pdfTool is made and operated by UV ResearchLabs (“we”). We are responsible for how this website handles personal data.
Your files in the browser tools
When you choose a file for a browser tool, your browser reads it into its own memory and the tool works on it there, using code that this site delivers to your browser. Downloads are made on your device too. Closing the tab discards the file. No copy of your file, its text, its pictures or its properties is sent to our servers or to any third party.
Text recognition (OCR) and spell checking download language data from this site the first time they are used, in the same way that fonts and scripts are downloaded. The data flows one way, from us to you.
Your files in the server tools
The tools marked “Runs on our servers” (converting Office documents to PDF and back, repairing damaged files, and printing web pages to PDF) upload your file, or fetch the page you named, and process it on servers we control. For these tools:
- The upload and the download use an encrypted connection (HTTPS), and the file is stored encrypted while it waits for and after processing.
- Processing happens automatically in an isolated environment that is wiped after each job. Nobody reads your files; they are handled by software only.
- The result is deleted from our servers as soon as your browser has fetched it. A file whose job did not finish, or a result you did not fetch, is deleted automatically after one hour, or after the period you chose in your account (one hour, one day or seven days).
- We record, for each job, the tool, the file’s size and type, timings and the outcome, without the file’s name being used as anything but a label for you, so that we can keep the service fair and find faults. These records are deleted with the job.
- Your files are not used for anything else: not to improve the tools, not to train software, and not for advertising.
Accounts
You can use every tool without an account. An account lets you run more server jobs, use larger files and keep results longer. To create or use an account we hold:
- Your email address, which is also how you sign in: we email you a link that works once and for a short time. We send no other email, and no marketing.
- A session cookie that keeps you signed in on that browser for up to 30 days, and a record of when the account was made.
- Your credits and their history: the credits the account started with, what each server job used, and refunds for jobs that failed.
- Your retention choice: how long the files of your jobs are kept.
You can delete the account yourself on the account page. Deleting it removes the address, the sessions, the credit history and every remaining job and file at once.
What we receive
Using the site sends the following to us or to our hosting provider:
- Server logs. Like every website, our hosting provider records each request: the address of the page or file requested, the time, your browser’s self-description (“user agent”) and your IP address. These logs exist to keep the site running and secure, and are kept for a limited time by the provider.
- Usage statistics. We measure which pages are visited and how the site performs, in aggregate: page views, countries, device types and load times. The measurement sets no cookies, stores no IP addresses and does not follow you to other sites. It cannot identify you.
- Error reports. If something breaks in your browser, a short report can be sent to us so that we can fix it: the error message, the part of the code involved, the page you were on, the site language and your browser’s self-description. Error reports never include your file or anything from it.
- Two small cookies. Choosing a language stores that choice in a cookie so the site opens in it next time. Using a server tool sets a cookie holding a random number that identifies your browser to us and to nobody else; it lets us give each browser its fair share of free server jobs a day, and lets your browser see its own jobs. Neither cookie is used for advertising or shared.
What we do not do
- We do not require an account for any tool, and an account holds nothing but an email address and what is listed above.
- We do not show advertising and use no advertising or tracking cookies.
- We do not sell, rent or share personal data.
- We do not use your files for anything, including training software.
Why we process this data
We process the data above to provide the service you asked for (including running the server tools on the files you give them), to keep the site working, fair and secure, to understand which tools are useful, and to find and fix errors. Where a law asks for a legal basis, these are the delivery of the service you requested and our legitimate interests in operating it. The language and browser cookies are strictly necessary for what they do.
Who else is involved
The site is hosted by Vercel Inc., which operates the servers that deliver the pages and receive the requests described above. Files given to the server tools are stored with Cloudflare, Inc. (R2 object storage) and processed on servers we rent from Fly.io, Inc. in Singapore; job and account records live in a database run by Supabase, Inc. in London; sign-in links are sent through Resend, Inc. Each of them processes data on our behalf, under its own privacy terms. No other company receives data from this site.
How long we keep data
Server logs and error reports are kept for up to 30 days, or as long as our hosting provider retains them, and are then deleted. Usage statistics are kept only in aggregate form. Files given to the server tools are deleted as described above, and their job records with them. Account data is kept until you delete the account or until it has been unused for two years.
Your rights
Depending on where you live, you may have rights to access, correct, delete or object to the processing of personal data about you, and to complain to a supervisory authority. Everything we hold about an account is shown on the account page, where the account can also be deleted. Logs and reports cannot be tied to a person, so there is usually nothing more we can look up; still, write to us and we will help where we can.
Children
The site is a general-purpose tool and collects no personal data on purpose from anyone, children included.
Changes
When the site changes in a way that matters for this policy, this page will be updated first and the date at the top will change.
Contact
Questions about this document can be sent to uvresearchlab@gmail.com.