Data Processing Addendum
For customers processing personal data of EU/UK/Swiss data subjects, and for Indian Data Fiduciaries routing processing through pdfcraft ai under the DPDP Act 2023. Auto-executed when you subscribe to any paid plan.
Roles
For GDPR purposes you are the Controller of personal data in documents you upload; pdfcraft ai is the Processor acting only on your documented instructions. For DPDP Act 2023 purposes (India), you are the Data Fiduciary and pdfcraft ai is the Data Processor — we process personal data only on your instruction and do not determine the purpose or means of processing.
Subprocessors
We engage the following sub-processors: Hostinger International Ltd (web hosting, EU), Cloudflare Inc. (CDN and DDoS protection, global), Google LLC (Google Analytics 4 and Google Sign-In, US), Microsoft Corporation (Clarity usability analytics, US), and Razorpay Software Pvt. Ltd. (payments, IN). We will give at least 30 days' notice of material changes to this list, including new payment processors added when international payment support launches.
International transfers
Where personal data is transferred outside the EEA or UK, we rely on the applicable EU Standard Contractual Clauses and UK IDTA. Under DPDP Act s. 16, Indian personal data may be transferred to any country not restricted by the Central Government's notified list — no current sub-processor is in a restricted jurisdiction. Data residency options (EU-only, IN-only) will be made available on Studio plans as our infrastructure build-out completes.
DPDP Consent Manager (forward-looking)
The Ministry of Electronics and Information Technology (MeitY) is expected to notify operational rules and the Consent Manager framework under the DPDP Act 2023 in 2026. Once the CM framework is live and registered Consent Managers are operational, pdfcraft ai will integrate consent artefact lifecycle (issuance, withdrawal, audit trail) via the designated Consent Manager(s) of the Data Fiduciary's choice. Until then, consent is collected directly (see our cookie banner and the /cookies page) and stored in first-party cookies with a full audit trail.
Security measures
See our Security page for the technical and organizational measures (TOMs) we apply, including encryption, access controls, and our in-progress SOC 2 readiness program.
Data subject / Data Principal rights
We assist you in responding to access, rectification, deletion, and portability requests within 30 days of your forwarded request (GDPR) or within 15 days for DPDP Act grievances. Our Grievance Officer is reachable at support@pdfcraftai.com.
Audits
You may audit our compliance annually via written request. We will share in-progress readiness reports under NDA. Requests: support@pdfcraftai.com.
Questions about this document? Email support@pdfcraftai.com.