Privacy Policy
We designed pdfcraft ai to do the least possible with your data. This policy tells you exactly what that means — and how we handle personal data under the GDPR (EU/UK), the DPDP Act 2023 (India), and comparable regimes elsewhere.
What we collect
Account info (email, name, password hash), usage metadata (tool name, credits spent, timestamps), and billing info processed by our payment providers. We do not store document contents after processing — see Retention.
Retention
Uploaded files are deleted from processing servers within 60 minutes of your session ending. Output files are available to you for 24 hours, then permanently deleted. On Studio plans, you can opt into zero-retention mode where we never persist any file.
Who sees your files
No humans — not us, not contractors. AI tools route through our isolated inference environment or through your own API key if BYOK is on. We never train models on your content.
Cookies & analytics
We use a first-party cookie for session auth and a first-party cookie to remember your consent choice. Product analytics (Google Analytics 4 and Microsoft Clarity) are CONSENT-GATED: they only load if you click "Accept all" on the banner. Essential cookies (sign-in, CSRF, consent memory) always load because the service cannot function without them. We do not sell personal data. See the /cookies page for the full inventory and a one-click withdrawal button.
Advertising (Google AdSense)
When advertising is active on this site we use Google AdSense, a third-party advertising network operated by Google LLC. Google may use the DoubleClick DART cookie to serve ads based on your visit to this site and other sites on the internet. You can opt out of personalized advertising at any time by visiting Google Ads Settings (https://www.google.com/settings/ads), Google's advertising principles (https://policies.google.com/technologies/ads), or aboutads.info (US) / youronlinechoices.eu (EU). Advertising cookies are CONSENT-GATED via the same banner as analytics — if you reject "Accept all", no advertising cookies are set. We do not share personally identifiable information with advertisers. Ad-supported content is clearly labelled "Sponsored" or "Ad" per Google's program policies.
Payments
Payments are processed by Razorpay Software Pvt. Ltd. on our behalf. International payment support is rolling out — customers outside India can join the waitlist on the pricing page and we will email when international checkout becomes available. Card details are entered directly into the payment provider's hosted iframe; we never see, store, or transmit full card numbers.
Sub-processors
We engage a small number of vetted sub-processors: Hostinger International Ltd (web hosting, EU), Cloudflare Inc. (CDN and DDoS protection, global), Google LLC (Google Analytics 4 and Google Sign-In, US), Microsoft Corporation (Clarity usability analytics, US), and Razorpay Software Pvt. Ltd. (payments, IN). We will give at least 30 days' notice of material changes, including any new payment processors added when international support launches.
International transfers
Where personal data is transferred outside the EEA or UK, we rely on the applicable EU Standard Contractual Clauses and the UK International Data Transfer Addendum. For Indian residents under the DPDP Act 2023 s. 16, transfers outside India are limited to countries not restricted by the Central Government's notified list; none of our current sub-processors are in restricted jurisdictions.
Your rights (GDPR / UK DPA)
If you are in the EU, EEA, UK, or Switzerland you have the rights of access, rectification, erasure, portability, restriction of processing, and objection under the GDPR framework. You can export all your data or delete your account instantly from Settings. For anything else email support@pdfcraftai.com — we respond within 30 days.
Your rights under the DPDP Act (India)
If you are a Data Principal in India, the Digital Personal Data Protection Act 2023 grants you: (1) the right to access your personal data and a summary of processing activities (s. 11); (2) the right to correction and erasure (s. 12); (3) the right of grievance redressal within 15 days (s. 13 + s. 8(10)); (4) the right to nominate another person to exercise these rights in the event of death or incapacity (s. 14); (5) the right to withdraw consent at any time, as easily as it was given (s. 6(3)). You can exercise all of these by emailing support@pdfcraftai.com. Our Grievance Officer for DPDP purposes is reachable at the same address.
Children
pdfcraft ai is not directed at children under 13, and under the DPDP Act 2023 s. 9 we do not knowingly process personal data of individuals under 18 without verifiable parental consent. If you believe a child has created an account without consent, email us and we will delete the account and any associated data.
Contact
Privacy and security questions, and DPDP Grievance Officer requests: support@pdfcraftai.com. We respond within 15 days for DPDP grievances and within 30 days for other privacy requests.
Questions about this document? Email support@pdfcraftai.com.