Last updated: 16 August 2026 | Effective: 16 August 2026 | Version 2.0
PDFXINET ("we", "us", "our") operates the online PDF processing service accessible at pdfxinet.com and via our API.
localStorage)Files you upload for processing (PDFs, DOCX, images, etc.) are processed in-memory and on temporary storage only. We do not read, analyse, index, or use the content of your files for any purpose other than performing the requested operation.
If you register or log in via Google, GitHub, or Microsoft, we receive from that provider: your email address, display name, and provider-assigned user ID. We do not receive your password from these providers.
| Processing purpose | Lawful basis | Article 6 ground |
|---|---|---|
| Providing the PDF processing service | Contract performance | Art. 6(1)(b) |
| Account creation and management | Contract performance | Art. 6(1)(b) |
| Processing payments and managing subscriptions | Contract performance + legal obligation | Art. 6(1)(b)(c) |
| Sending transactional emails (activation, reset, invoices) | Contract performance | Art. 6(1)(b) |
| Fraud prevention and security monitoring | Legitimate interests | Art. 6(1)(f) |
| Improving and developing our service | Legitimate interests | Art. 6(1)(f) |
| Responding to support requests | Contract performance / legitimate interests | Art. 6(1)(b)(f) |
| Complying with legal obligations (tax, financial records) | Legal obligation | Art. 6(1)(c) |
| Marketing emails and product updates | Consent (or soft opt-in for existing customers) | Art. 6(1)(a) |
| Server and access logging | Legitimate interests (security/debugging) | Art. 6(1)(f) |
Where we rely on legitimate interests, we have carried out a balancing test confirming our interests do not override your fundamental rights and freedoms. You may request a copy of this assessment by contacting privacy@pdfxinet.com.
| Data category | Retention period | Basis |
|---|---|---|
| Uploaded files (input) | Deleted immediately after processing | Technical |
| Output files — guest users | Exactly 24 hours from creation (hard-deleted automatically) | Service operation |
| Output files — registered users | Until deleted by the user via the dashboard (no automatic expiry) | Contract / user control |
| Account data | Duration of account + 90 days after closure | Contract |
| Activity logs | 12 months (rolling) | Security / legitimate interests |
| Payment records | 7 years | UK financial regulations / HMRC |
| Support ticket content | 3 years from resolution | Legitimate interests |
| Server access logs | 90 days | Security / legitimate interests |
| Marketing consent records | Duration of consent + 3 years | Legal compliance |
| DSAR / rights request records | 3 years from completion | Legal obligation |
We do not sell, rent, or trade your personal data. We share data only as described below, under appropriate legal agreements:
| Recipient | Processing purpose | Location | Safeguard |
|---|---|---|---|
| Stripe / PayPal | Payment processing | US/EEA | DPA + SCCs / Adequacy |
| AWS (Amazon Web Services) | Cloud hosting and storage | UK/EEA | DPA + SCCs / UK adequacy |
| Email service provider (SMTP) | Transactional emails only | Configurable | DPA |
| Law enforcement / regulators | Legal obligation or court order | UK / EU | Legal obligation (Art. 6(1)(c)) |
All third-party processors are bound by Data Processing Agreements requiring them to process data only on our documented instructions and maintain appropriate security measures.
Some of our service providers are located outside the UK and European Economic Area (EEA). Where personal data is transferred to countries without an adequacy decision, we ensure adequate protection through:
You may request copies of the specific transfer mechanisms applicable to your data by emailing privacy@pdfxinet.com.
Depending on your location, you have the following rights. To exercise any right, visit our GDPR Rights Centre or email privacy@pdfxinet.com. We will respond within 30 days (extendable to 60 days for complex requests with notice).
| Right | Description | How to exercise |
|---|---|---|
| Access (SAR) | Obtain a copy of all personal data we hold about you | GDPR Rights Centre / email |
| Rectification | Correct inaccurate or incomplete data | Profile page or email |
| Erasure | Request deletion of your personal data (subject to legal retention obligations) | GDPR Rights Centre / email |
| Restriction | Request we limit processing while a dispute is resolved | |
| Portability | Receive your data in JSON/CSV format for transfer elsewhere | GDPR Rights Centre / email |
| Objection | Object to processing based on legitimate interests or for direct marketing | Email / unsubscribe link |
| Withdraw consent | Where processing is consent-based, withdraw at any time without affecting prior lawfulness | Profile page / unsubscribe / email |
| No automated decisions | Not to be subject to solely automated decisions with significant effects |
Right to complain: You have the right to lodge a complaint with:
We encourage you to contact us first at privacy@pdfxinet.com as we can often resolve issues quickly.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following additional rights:
To exercise CCPA rights, contact us at privacy@pdfxinet.com with subject line "CCPA Request". We respond within 45 days (extendable by additional 45 days with notice). Authorised agents may submit requests with written authorisation.
Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for their direct marketing purposes.
If you are located in Canada, processing of your personal information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation. You have the right to access your personal information, challenge its accuracy, and withdraw consent where processing is consent-based. Contact our Privacy Officer at privacy@pdfxinet.com. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are located in Brazil, your personal data is processed in accordance with the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018). You have the rights of access, correction, anonymisation, portability, deletion, information about sharing, information about the possibility of denying consent, and revocation of consent. Contact our DPO at dpo@pdfxinet.com.
We implement technical and organisational security measures proportionate to the risks involved:
To report a security vulnerability, see our Security Policy or email security@pdfxinet.com.
Our Service is not directed to children under the age of 16 (or 13 in the United States under COPPA). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact privacy@pdfxinet.com immediately and we will delete it promptly.
We do not make automated decisions about you that produce legal or similarly significant effects without human review. Usage limits and plan tier restrictions are applied automatically as a contractual feature of our service tiers, not as profiling under GDPR Article 22.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, as required by UK/EU GDPR Article 33. Where the breach poses a high risk to individuals, we will also notify affected users without undue delay in accordance with Article 34.
We may update this policy to reflect changes to our practices or applicable law. We will post the updated policy with a new "Last updated" date. For material changes affecting your rights, we will notify registered users by email at least 30 days before the change takes effect.
Continued use of the Service after the effective date of a material change constitutes acceptance of the updated policy.