1. Definitions
The following terms have these meanings throughout this document. Where a term is capitalised it carries this meaning.
| Term | Meaning |
|---|---|
| "Site" | The website operated at https://pdff.online, together with any subdomain, mobile, or progressive web application version of it. |
| "Service" | Any tool, function, or feature made available through the Site, including but not limited to merging, splitting, rotating, compressing, converting, OCR, redaction, annotation, form filling, signing, page numbering and metadata handling. |
| "User", "you", "your" | The person or legal entity accessing the Site. |
| "Document" | Any PDF, image, spreadsheet, or word-processing file that you open, process, or export through the Site. |
| "Local Processing" | Document handling performed entirely within your web browser, without transmission of Document contents to a server operated by or for the Site operator. |
| "Personal Data" | Any information relating to an identified or identifiable natural person, as defined by applicable data protection law, including the UK GDPR, the EU General Data Protection Regulation, or equivalent local legislation. |
| "Controller" and "Processor" | The roles allocated under applicable data protection law. The Site operator is a Controller of the Personal Data described in the Privacy Policy. The Site operator is not a Processor in respect of Documents, because Documents are not transmitted to or processed on the operator's systems. |
| "Third-Party Provider" | An operator of a separate service integrated with, linked to, or advertised on the Site, including analytics and advertising providers, hosting and payment providers, and any affiliate-linked provider. |
| "Operator" | The natural person or entity that publishes and operates the Site, reachable at accts.pak@gmail.com. |
Privacy Policy
The architectural fact this document rests on
Every PDF tool on this Site performs Local Processing. When you open a Document, your browser reads it from your device. Parsing, editing, conversion and export all execute as JavaScript inside the tab you already have open. The contents of your Document are not transmitted to the Operator, and are not stored on any system operated by or for the Operator.
This is a factual statement about how the software is built, and it is verifiable: open any tool, load any Document, and observe that no upload request is made. It is also why certain statutory obligations described below do not arise in the form they would for a service that uploads files.
The single feature that transmits data to a server
AI Document Architect. This feature sends the text you type into its drafting prompt to Google's Gemini application programming interface in order to generate a draft. Only text that you yourself enter is transmitted. The Document itself is not sent, opened, or referenced. If you do not use this feature, no content leaves your device.
This is disclosed here rather than generalised into a claim that the entire Service is server-free, because generalising it would be false.
2. Who is the Controller
The Operator is the Controller for the Personal Data described in this policy. The Operator can be contacted at accts.pak@gmail.com. Where the Operator acts on behalf of a business customer in respect of a service, that business acts as Controller and the Operator acts as Processor.
3. Categories of data and why they are processed
The following table states every category of data the Service touches, the purpose of processing, and the lawful basis relied on. Data not listed here is not collected.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Document contents (PDF, image, spreadsheet, word-processing files) | To perform the tool you requested, entirely within your browser | Not processed by the Controller. Processing occurs on your device and is not transmitted. No legal basis is required because no processing by the Controller takes place. | Zero. No copy is received. The in-memory copy ceases to exist when you close or reload the tab. |
| Drafting prompt text entered into AI Document Architect | To generate a draft using Google's Gemini API | Consent, given by your act of submitting the prompt. You may withdraw it at any time by not using the feature; past submissions cannot be recalled from Google. | Retained by Google under its own API terms. The Operator does not store prompt text. |
| Analytics data: page views, referrer, approximate location, device and browser, timestamp | To measure which tools are used, identify broken pages, and prioritise maintenance | Legitimate interests: understanding usage of a free service and diagnosing faults, balanced against your interest in privacy. You may object; see section 9. | Google Analytics retention defaults to 14 months for user-level data, then aggregated. The Operator holds aggregated reports indefinitely. |
| Email address, where you submit a form | To send what you asked for, or to reply to an enquiry | Contract, where you requested a specific deliverable; legitimate interests, where you simply asked a question. | Retained for as long as needed to fulfil the request, then deleted. Enquiries are deleted within 24 months. |
| Server security logs: IP address, timestamp, request path, user agent | To detect abuse, automated scraping, and denial-of-service attempts | Legitimate interests: maintaining the security and availability of the Service. | 14 days, then deleted. |
| Usage counter stored in your browser's local storage, recording how many tasks you completed | To decide whether to show the review prompt. This is a gate so that people are asked for a review only after real use. | Legitimate interests: soliciting genuine review evidence rather than cold requests. It never leaves your device. | Until you clear your browser storage. You may reset it at any time by clearing site data. |
| Advertising data, if advertising is enabled | To serve and measure advertising, via Adsterra | Consent, as required by ePrivacy rules in most jurisdictions. Withdrawing consent does not affect the Service, because no feature depends on advertising cookies. | Adsterra's advertising retention, currently up to 13 months. The Operator holds no advertising profile of you. |
| Contact and support correspondence | To answer you and, where a security report is made, to fix the issue | Legitimate interests; contract where you requested support for a specific matter. | 24 months from last contact, then deleted. |
4. Why the lawful bases apply
Contract
Where you submit an email address in order to receive something specific, or ask for support on a specific matter, processing is necessary to perform that request.
Legitimate interests
Analytics, security logging, and abuse prevention are undertaken to operate a free public service without spending disproportionate cost on monitoring. This has been assessed as a balancing exercise: the benefit is keeping the Service available and funded by advertising; the impact on you is limited to page-view data that does not identify you individually and never includes Document contents. You may object at any time, and we will stop the processing concerned.
Consent
Marketing and advertising cookies, where used, rely on consent because they are not necessary for the Service to function. You may withdraw consent without any loss of Service functionality. Submitting a drafting prompt to AI Document Architect is treated as consent to transmit that prompt to Google, revocable by ceasing to use the feature.
5. Claims this policy does not make
Earlier versions of this Site described PDFF as "GDPR compliant" and referenced HIPAA. That language has been removed. No organisation can declare itself compliant with a legal framework by writing the words down; compliance is a factual and evidential state. Stating it without evidence would repeat the same error this policy exists to correct.
What can be evidenced is architectural: because Document processing is local, your Documents never become the Operator's data. This removes the largest category of privacy risk for a document-handling service, and it is a stronger position than a compliance badge, because it is verifiable by inspection rather than by assertion.
For the same reason this policy contains no claim of HIPAA compliance, no SOC 2 or ISO 27001 certification, and no penetration-test attestation. None has been obtained. No such certification should be inferred from anything on this Site.
What advertising never receives
No advertising provider receives anything about your document. There is no upload, so there is no file for an ad network to receive, log, associate with an identity, or pass to an advertiser. An ad provider learns that an advert was displayed. It learns nothing about the PDF open in the same tab.
Advertising formats that interrupt the page, and adult or age-restricted advertising categories, are disabled for this site. See the disclosure page.
6. International transfers
The Operator is established in Pakistan. Where Personal Data is processed outside your jurisdiction, transfers are made under an adequacy decision or the European Commission's Standard Contractual Clauses, as applicable.
In practice, the relevant recipients are Google Ireland Limited and Google LLC, which process analytics data on behalf of the Operator, and Adsterra and its advertising partners, which process advertising interaction data if advertising is enabled. The providers' own transfer mechanisms apply to those relationships and are documented by them. You may request details of the applicable safeguard, and a copy of any standard contractual clauses relied upon, by writing to accts.pak@gmail.com.
7. Your rights
The rights in this section are granted in full. Where a right cannot be exercised in practice, that is stated plainly instead of leaving a clause that promises something the architecture makes moot.
Subject to the legal bases above, and where the GDPR or UK GDPR applies to you, you have the right to:
- Access to the Personal Data the Operator holds about you.
- Rectification of inaccurate Personal Data.
- Erasure of Personal Data, where no overriding legal obligation requires its retention.
- Restriction of processing while accuracy or legal basis is contested.
- Portability of Personal Data you provided, in a structured, commonly used, machine-readable format.
- Objection to processing based on legitimate interests, on grounds relating to your particular situation.
- Withdraw consent at any time, where processing relies on consent, without affecting prior lawful processing.
- Complaint to your supervisory authority. The authority for the United Kingdom is the Information Commissioner's Office; for the European Union, the authority in your country of residence; for Pakistan, the relevant provincial data protection authority.
Access requests in practice
Because Documents are never transmitted, an access request will not return the contents of any file you processed. That is not a refusal; there is nothing held to hand over. Analytics data is held in aggregate and, where an identifiable event exists, it consists of a page path, a timestamp, an approximate location, and a referrer.
Automated decision-making
The Operator does not use automated decision-making or profiling within the meaning of Article 22 GDPR. No decision producing legal or similarly significant effects is made by automated means.
Complaint route
You are encouraged to raise a concern with the Operator first. A complaint will be acknowledged within seven days and addressed within one month, or within the period required by applicable law where that is shorter. Escalation to a supervisory authority remains available at any time.
8. Security
Because Documents are processed locally, the large majority of the risk that a document-handling service ordinarily carries does not arise. There is no document storage to breach, no upload channel to intercept, and no database of user files to exfiltrate.
For the data that is handled centrally:
- All traffic is served over TLS, and the Site is configured for HSTS.
- Administrative access to deployment and hosting is limited to the Operator and protected by multi-factor authentication.
- Analytics access is limited to aggregate reporting.
The Operator does not claim to hold an independent security certification. If the Service ever does, the claim will be published with the certificate identifier, which is verifiable, rather than asserted in general terms.
9. Objecting and withdrawing
To object to analytics, to withdraw advertising consent, to request erasure, or to exercise any other right, email accts.pak@gmail.com with the subject line beginning "Data request". Requests are actioned within one month. There is no charge unless a request is manifestly unfounded or excessive, and the Operator would rather explain a concern than invoice for it.
Withdrawing consent for advertising cookies will not degrade the Service. Every tool runs locally and depends on no tracker.
10. Children
The Service is not directed at children under 13, or under the applicable age of digital consent in your jurisdiction where that is higher. The Operator does not knowingly collect Personal Data from children. If you believe a child has submitted Personal Data, email accts.pak@gmail.com and it will be deleted.
11. Automated tools and minors using school devices
A common and legitimate use of this Service is schoolwork on a managed device. Where a minor's Personal Data reaches the Operator through an institutional account rather than an individual one, that institution is the Controller and the Operator its Processor, and the institution's policy governs the data.
12. Changes to this policy
This policy may be updated. The version number and effective date at the top reflect the current revision. Where a change materially affects your rights, the change will be identified in the revision note rather than left implicit. Material changes are announced on the Site and, where you have provided an email address, by email.
13. Contact
Data protection queries, rights requests, and complaints: accts.pak@gmail.com. Please begin the subject line with "Data request". The Operator is based in Pakistan.
Frequently asked questions
Does pdff.online upload my PDF to a server?
No. Your document is opened and processed as JavaScript inside your own web browser tab. It is never transmitted to a server, so it cannot be stored, read, or leaked by the site operator. You can verify this by opening your browser's network panel and running any tool.
Does pdff.online comply with GDPR and HIPAA?
No compliance claim is made. A website cannot simply declare itself compliant, and this site does not assert what it has not evidenced. What can be evidenced is architectural: because processing happens locally, your documents never become the operator's data, which removes the largest category of privacy risk.
Is any part of my document sent anywhere?
Only one feature transmits data. AI Document Architect sends the text you type into its drafting prompt to Google's Gemini API to generate a draft. It never sends the PDF file. If you do not use that feature, nothing is transmitted.
What happens to my data when I close the tab?
It ceases to exist. Nothing is stored server-side, so there is no copy to delete and no purge timer to wait for, because there was never an upload in the first place.
Do you use advertising cookies?
Google Analytics is used to count visits, and advertising cookies may be set if advertising is enabled. The operator does not use personalised advertising profiles and does not sell personal data. Declining cookies costs you nothing but the analytics, because every tool runs locally.
How can I get a copy of the data you hold about me?
Email the address given in the privacy policy with 'Data request' in the subject line. Requests are acknowledged within seven days and actioned within one month. Note that an access request will not return the contents of any file you processed, because no such copy is held.
Can I delete your use of analytics permanently?
Yes. Use the Google Analytics opt-out browser add-on, enable Global Privacy Control or Do Not Track, or block third-party cookies. The site honours privacy signals by not loading analytics at all, and no feature of the Service depends on it.
No analytics on this page
This page ships without a tracking script. Aggregate analytics are collected only on the tool pages, and only if you accept them in the cookie banner. Your documents are processed locally and are never transmitted. See the privacy policy.