Privacy policy

Who is responsible for your data

The data controller is Emmanuel Jégo EI (entrepreneur individuel), 26 B rue Émile Bernard, 35700 Rennes, France, registered in the French national business register (RNE), SIREN 850 238 825.

For any question about your data, write to contact@visualpdf.com. Full publisher details are on the legal notice page.

We are the controller for the tools, accounts, workspaces, billing records and security. Sold through Link, LLC, a Stripe affiliate, handles Premium payments as merchant of record. Link and Stripe are independent controllers for the payment data they collect.

The short version

Here is what matters most:

• Almost every tool runs in your browser, so those files never leave your device. The Word, Excel and PowerPoint converters are the exception: they use our server, as explained below.
• You can use the tools without an account. You need one only to buy Premium, save signatures and watermarks, or join a workspace.
• Our analytics are self-hosted, cookieless and cannot follow you across the web.
• We show no ads and we never sell or share your data for advertising.
• Payments go through Stripe. We never see or store your card number.
• Data sent for a single task (a feedback message, a file sent for Office conversion) is deleted on a fixed schedule. If you create an account, its data stays until you delete the account, which you can do yourself from your account page.

Files processed in your browser

When you use our client-side tools (merge, split, compress, sign, watermark, crop and all others except the Office converters), the whole job runs on your own device. The file is never uploaded: we cannot see it, store it or scan it. The only things our analytics learn about it are the number of files, their total size, and counts such as how many pages a tool changed (see Audience analytics).

Two things can still reach our servers from these tools: anonymous usage events (see Audience analytics) and a signature or watermark you choose to save to a Premium account, stored encrypted as described below. The document you are working on is never part of either.

Office to PDF conversions

Converting Word, Excel or PowerPoint files to PDF requires software that cannot run in a browser yet, so these three tools use our server. Here is exactly what happens to your file:

• Your file is sent over an encrypted connection to our server, which forwards it to Microsoft (OneDrive) for the conversion itself.
• We delete the copy sent to Microsoft right after the conversion, and an automated sweep removes any leftover within 75 minutes. The deletion is permanent: the file skips the OneDrive recycle bin, so Microsoft keeps no copy afterwards.
• The converted PDF is held in our storage (Cloudflare R2) so you can download it, then deleted automatically about an hour after it was made (75 minutes at most), with a 1-day storage rule as a safety net.
• Your download link stops working 30 minutes after your conversion finishes.
• To show progress and name your downloads, we store the names of your files with the conversion job. The job is deleted 24 hours after it was created, whether or not you are signed in. When you are signed in, the job is also linked to your account until then.
• Premium members have a daily conversion allowance. A counter of the bytes and files converted that day is kept against your account for up to about 3 days.
• We never read the content of your documents, and our code does not write file names to our server logs.
• We process your file and its name only to perform the conversion you asked for. The legal basis is our contract with you (GDPR Art. 6(1)(b)).

Your account

An account is optional. You need one to buy Premium, to save signatures and watermarks, and to join a workspace. You sign in with Google or with a link we email you. There is no password. An email address is required to create an account: without it we cannot sign you in, and you can still use the free tools without an account. A display name is optional.

We use your account data to sign you in and to give you what you signed up or paid for. The legal basis is our contract with you (GDPR Art. 6(1)(b)). Your account stays until you delete it: we do not close inactive accounts.

Sign-in session records stay in our database (Cloudflare D1) until you sign out on that device, the session expires or you delete your account, with a cached copy (Cloudflare KV) that expires with the session. We delete expired sessions within 15 minutes of their expiry. We keep the IP address and browser string seen at sign-in to investigate abuse and account takeover, on the basis of our legitimate interest (Art. 6(1)(f)).

Here is what an account holds:

• Your email address, and whether it is verified.
• A display name. Google provides it if you sign in with Google, and you can change it on your account page (1 to 100 characters).
• The language of the site when you last signed in or switched languages while signed in. Our emails to you use it, apart from the sign-in link, which follows the page you asked for it from. We also send it to Stripe so its payment pages and emails can use it.
• If you sign in with Google: your Google account identifier, the address of your Google profile photo, and the access, refresh and ID tokens Google returns. Google is asked only for your basic profile and email address (the "openid", "email" and "profile" scopes), so these tokens give no access to your Drive, mail or other Google data. We keep them until you delete your account.
• Your sign-in sessions. Each one holds a random token, the IP address and browser identification string seen when you signed in, and its start and expiry dates. A session lasts 7 days and renews itself while you use the site.
• When you ask for a sign-in link: the email address you typed, held in a pending request that is deleted once the link is used, and otherwise within 25 minutes, even if you never finish signing in. The link itself is valid for 10 minutes.
• Your Premium status, your workspace memberships and your saved items, described in the sections below.

Deleting your account

You can delete your account yourself: open your account, go to "Account" and use "Delete account". For your security, deletion needs a sign-in less than 24 hours old. If yours is older, we ask you to sign in again first.

Deletion is refused while you own a workspace whose subscription is still running. End the subscription, or hand the workspace to a member from the "Teams" page, then delete the account.

Deletion immediately erases your account, your sessions, your Google tokens, your saved signatures and watermarks, your conversion jobs, your Premium Week records and the workspace you own. We email that workspace's members to tell them it was closed.

A few things remain after deletion:

• Payment, invoice and order records at Stripe. Deleting your Visual PDF account does not reach them (see Premium payments).
• Your email address in invitations other workspaces sent you, until 30 days after they expire, and in those workspaces' activity logs, for 30 days after each entry.
• Short-lived counters and files: the hashed sign-in email counter (about 35 minutes), converted files (75 minutes), download links (30 minutes after the conversion finishes) and the daily conversion counter (up to about 3 days). Rate-limit counters are held by Cloudflare, not by us.
• A line recording each Premium Week purchase and its end date, which no longer points to you.
• Server technical logs, for 7 days.
• Database restore points, which our host keeps for 30 days (Cloudflare D1 Time Travel). We use them only to recover from an incident.

Workspaces and teams

Every account comes with its own workspace. With a Premium subscription, the owner can share Premium with other people, one seat each, by invitation.

To invite someone, the owner types their email address: that is where we get it from. We store it in the invitation and email that person the workspace name and the inviter's name, or the inviter's email address if they have not set a name. The email is in the language of the invited person's account if the address already has one, and in the inviter's otherwise. Anyone who holds the invitation link sees the workspace name, the owner's first name, the inviter's name and a masked version of the invited address. When the owner or inviter has not set a name, we use the part of their email address before the @ in its place, and the default workspace name is built the same way.

Invitations expire after 7 days and are deleted 30 days after that. The workspace activity log keeps the invited address for 30 days. After that, the entry stays without it.

We process workspace data to run the service you or your organization signed up for (contract, Art. 6(1)(b)), and keep it until the workspace is closed. For a person who is invited but has no account yet, and for the invited address the activity log keeps for 30 days, the basis is our legitimate interest and the workspace owner's in delivering invitations and keeping a record of who was given access (Art. 6(1)(f)). A workspace closes only when its owner deletes their account. If a member deletes their account, activity log entries stop pointing to them, apart from the address recorded on an invitation, which stays until the invitation is 30 days old.

When an organization runs a workspace for its staff, it is responsible for its own use of its members' data. Business customers can ask us for a data processing agreement at contact@visualpdf.com.

Here is who sees what in a workspace:

• Every member sees the other members' names, email addresses and roles, and when they joined.
• Every member also sees the workspace name, the owner's first name (or the part of their email address before the @ if they have no name), the number of seats and the renewal date, plus the signatures and watermarks shared into the workspace, with their author's name.
• The owner also sees pending invitations (email address and expiry) and an activity log: invitations, arrivals, departures and removals, seat and plan changes, renames, shared items, failed payments and ownership transfers, with the names of the people involved, or their email addresses when they have no name.
• Nobody in a workspace, the owner included, sees your documents, your conversions, the saved items you did not share, your sessions or your IP address.
• Removing a member, or leaving, ends access to the workspace and deletes the shares that member made into it. It does not delete their own account.

Saved signatures and watermarks

With Premium you can save signatures and watermarks to your account. Saving is always your choice. Text watermarks (text, color, font, opacity), typed signatures and drawn signatures go to our database (Cloudflare D1). A drawn signature is kept as pen strokes, without their timing or pressure. Watermark images, up to 1 MB, go to our file storage (Cloudflare R2). You can hold up to 10 signatures and 20 watermarks.

Everything is encrypted with a key of your own (AES-256), which is itself locked by a server key. This is encryption at rest, not end-to-end: our server decrypts an item each time it sends it to you, or to a workspace you shared it with. A copy of these items taken from our database or storage is unreadable without the server key.

You can share an item with a workspace that has 2 or more seats. Its members then see it with your name, for as long as you are both members and the subscription is running. The owner can remove an item from their workspace. Leaving the workspace, or being removed, deletes your shares into it.

If Premium ends, you can still view, download and delete your items, but not create or edit them, and your shares stop showing.

Items stay until you delete them or your account. Deleting an item removes it and its image at once. Deleting your account destroys your key first, then the images, then the records. Database restore points, kept for 30 days, may still hold encrypted copies together with your locked key; we use them only to recover from an incident. The legal basis is our contract with you (Art. 6(1)(b)).

Premium payments

Premium is sold through Stripe Managed Payments. The merchant of record is Sold through Link, LLC, a Stripe affiliate: it takes your payment, calculates VAT, and sends your receipts and invoices. You enter your card, billing address and any tax ID on Stripe's own pages. We never see or store your card number, and no Stripe script runs on our pages.

Stripe and Link are independent controllers for the payment data they collect. They keep it under their own privacy policies and legal duties, and deleting your Visual PDF account does not delete it. If you ask Link to delete your data, Stripe cancels the Premium subscriptions you bought through Link and removes your data from our Stripe account.

What we send to Stripe. For a subscription: the workspace name, the owner's email address and our workspace identifier, and the new owner's email address after an ownership transfer. For Premium Week: your email address, your name and our account identifier. With each of these, we also send the language set on the account of the person concerned.

What Stripe shares with us. Under Link's terms, Stripe makes your order data available in our Stripe account: your name, email address, phone number, billing address, tax ID if you gave one, payment information (never your full card number) and what you bought. We use it for support and for our accounting. Our own systems copy none of it, apart from the identifiers below.

What we keep in our own database. The Stripe customer identifier. For a subscription: its plan, status, seat count, monthly or annual interval, current period, and cancellation or trial dates, for as long as the workspace exists. A scheduled seat reduction is kept until 30 days after it takes effect. For Premium Week: the Stripe checkout and payment identifiers and the start and end dates, deleted 30 days after the pass ends. A pass purchase also leaves a line in an internal activity log, with the pass end date. That line has no time limit: it stays after you delete your account, but no longer points to you.

Legal bases: our contract with you (Art. 6(1)(b)) to deliver Premium, our legitimate interest in answering support requests, refunds and withdrawals (Art. 6(1)(f)), and our legal obligation to keep accounting records (Art. 6(1)(c)). The order data stays in our Stripe account for as long as Stripe keeps it there. It is wiped if you ask Link to delete your data.

Emails we send

We send emails only when the service needs them, never marketing. The legal basis is our contract with you (Art. 6(1)(b)).

Our code keeps no copy of the emails it sends. If a send fails, the provider's error message goes to our server logs, which are kept 7 days.

To stop anyone flooding an inbox, we count the emails sent to each address over 10 minutes. The counter is stored under a hash of the address, not the address itself, and deleted within about 35 minutes. That hash is pseudonymised, not anonymous: anyone who already knows your address could compute it.

Receipts, invoices and payment reminders come from Link and Stripe, not from us.

Our emails come from noreply@mail.visualpdf.com and go out through Cloudflare Email Sending, which receives your address and the content of the email. We send:

• Your sign-in link, valid 10 minutes.
• A workspace invitation, to the address the owner typed.
• A notice when your seat in a workspace is removed.
• A notice to the owner when a payment fails.
• A notice to every member when Premium through a workspace ends.
• A notice to both people when a workspace changes owner, naming the other person (or giving their email address if they have not set a name).
• A notice to members when a workspace is closed because its owner deleted their account.
• Notice, 30 days before they apply, of significant changes to this policy or to our terms, of price changes for subscribers, and of changes that make Premium noticeably worse.

Help and feedback form

When you send us a message through the "Help and feedback" form, we receive: the reason you selected, your message, your email address (so we can answer you), the page you wrote from, your interface language, your browser identification string, your country (derived from your connection; the IP address is not stored with your message), and the file you chose to attach, if any.

We use this data for one purpose only: understanding and answering your request. Your message and its attachment are deleted automatically 30 days after your request is handled, and at the latest 12 months after you sent it. The legal basis is our legitimate interest in answering the people who write to us and improving the service (Art. 6(1)(f)), or our contract with you when your message concerns a purchase or your account.

When a message arrives, our team gets a notification in a Discord channel with the message number, the reason, the language, the country, the page address and the attachment's file name and size. Your message and your email address are not sent to Discord. These notifications stay in the Discord channel until we delete them.

Emails you send us

When you write to contact@visualpdf.com, your message and address are stored in our mailbox at IONOS SE, in Germany. We use them only to answer you. The legal basis is our legitimate interest (Art. 6(1)(f)), or our contract with you when you write about a purchase, a withdrawal or your account.

Nothing deletes these emails automatically. We keep them as long as we need them to answer you and to handle any follow-up, such as a refund or a dispute, then delete them by hand.

Tool ratings

When you rate a tool, we store the tool name, your rating and, if you add one, your comment. Nothing else is stored with it: no IP address, no identifier, no account, even if you are signed in. The "you already rated this tool" flag lives only in your own browser. Separately, our analytics record that a tool was rated, with the rating but without the comment (see Audience analytics).

Because ratings are anonymous, we keep them indefinitely as product statistics. Please do not include personal information in a rating comment: we have no way of knowing who wrote it, so we cannot link it back to you to delete it.

Audience analytics

We measure how the site is used with Rybbit, an open-source, cookieless analytics tool that we host ourselves on a server in France (OVH). Nothing is shared with an advertising network, and no profile of you is built.

What is recorded: pages viewed (their full address, including an invitation link if you open one), referring site, browser and operating system family, screen size, country and region. Your IP address is used at the moment of the visit to derive the country and region, then discarded: it is not stored with your visits. To count visits, Rybbit links them with a pseudonymous identifier computed from your IP address and browser string. That identifier does not change from day to day, so visits from the same IP address and browser are linked over time, until either of them changes. If you open an invitation link, its address is recorded too, and that one visit could be linked to the invitation. When an Office conversion fails, the event carries the request number of the conversion, so for the 7 days our server logs are kept we can match it with that request.

We also record events about how the tools are used, so we can fix bugs: a tool opened, finished, stalled or failed (with a truncated technical error message or an error code), the number and total size of the files, which options you picked, result counts (for example pages changed or images found), how you downloaded the result, and whether we suggested opening the page outside an in-app browser. We also record that you sent a feedback message (its reason and whether a file was attached) or rated a tool (the tool and the rating), without the message, comment or email address.

For accounts and Premium, we record these steps: sign-in started, completed or failed (method, new or returning account), sign-out, account deleted, the free limit reached, the Premium prompt shown and why, checkout started (offer, seats, monthly or annual) and completed, seat changes, cancellation, invitations sent, accepted or declined, member removed and ownership transferred. None of these events carries your name, your email address or an account identifier.

Analytics events are kept for a maximum of 24 months, then deleted.

This processing rests on our legitimate interest in understanding and improving the service. It is configured to stay within the audience-measurement exemption of the French CNIL, which is why no consent banner is required.

Security and abuse prevention

These measures rest on our legitimate interest in keeping the service available and accounts safe (Art. 6(1)(f)).

To protect the service and your account, we use the following mechanisms, several of which process your IP address:

• Rate limiting: requests are counted per IP address, or per account when you are signed in, over one-minute windows. Cloudflare's rate-limiting service holds these counters, so their lifetime is up to Cloudflare. They are never stored with any submission or message.
• Cloudflare Turnstile: the anti-bot check that runs when you send a feedback message, rate a tool, ask for a sign-in link, or start an Office conversion without Premium. It is operated by Cloudflare, which processes your IP address, your browser identification string, a technical fingerprint of your connection and the identifier of our site to tell humans from bots. Turnstile sets no advertising cookie, is never used to track you across websites, and Cloudflare does not use this data to build a profile of you.
• Sign-in email limit: a counter per email address, kept for about 35 minutes under a hash of the address (see Emails we send).
• Sign-in sessions keep the IP address and browser identification string seen when you signed in (see Your account).
• A sign-in link only works in the browser that asked for it, through a cookie that holds a digest of the link.
• Server logs: our host, Cloudflare, records technical logs of the requests our server handles, including the address requested, your IP address and your browser identification string. They are kept 7 days and used only to fix errors and investigate abuse. The messages our code writes to these logs can include your account, workspace or Stripe identifiers and the addresses of invitation and download links, but never your email address or the content of your files.

Google services

Sign in with Google: if you choose it, Google tells us your name, your email address, whether that address is verified, the address of your profile photo and your Google account identifier. We store them, with the tokens Google returns, as described in Your account.

Your profile photo: if you signed in with Google, your browser loads your photo straight from Google's servers on the pages that show your avatar. Google then receives your IP address and browser identification string, as it does for any image it hosts.

Google Drive import: if you choose to import a file from Google Drive, the whole exchange happens between your browser and Google: our servers are never involved. The permission you grant covers only the files you pick (Google's "drive.file" scope), and the temporary access token is kept in your browser's local storage, nowhere else. This feature only runs when you click it.

Google's own privacy policy governs what Google does with this data.

How long we keep data

Data tied to a single task is deleted on a fixed schedule. Data tied to your account stays until you delete it, your account, or the workspace it belongs to. Here is each case:

Cookies and third-party content

We set no advertising or third-party tracking cookies, which is why you see no cookie banner.

Third-party content loads in your browser only where needed: Cloudflare Turnstile on the forms it protects and on sign-in, Google's sign-in page and your Google profile photo if you use Sign in with Google, Google's scripts if you open the Drive import, and Stripe's payment and billing pages, which we send you to when you buy or manage Premium. Fonts are served from our own domain, not from Google Fonts servers.

The cookies we use are all strictly necessary, so they are exempt from consent. Only the first one can be set without signing in. The others exist only while you sign in or are signed in:

• "i18n_redirected": remembers your language preference once a language has been chosen or detected. It contains no identifier and lasts one year.
• "__Secure-better-auth.session_token": your sign-in session. Scripts on the page cannot read it, it is shared by visualpdf.com and its subdomains, and it lasts 7 days, renewed while you use the site.
• "vpdf_session": tells the page that a session exists, so it can show your account right away. It holds only the value 1 and has the same lifetime as the session cookie.
• "__Host-vpdf_ml": ties a sign-in link to the browser that asked for it. It holds a digest of the link, never the link itself, and lasts 10 minutes.
• "__Secure-better-auth.state": a security cookie that lasts 5 minutes while you sign in with Google.

Local storage

A few settings are kept in your browser's storage, read only by our pages and never sent to our servers:

• "vpdf_account": your name, email address, initials, avatar color, Google photo address and Premium status, so the header and its account menu can show your account before our server answers. It holds no account identifier, and it is cleared when you sign out or delete your account.
• "vpdf_r7k": the free plan's count of tasks in the last hour.
• "vpdf_currency": the currency and exchange rate used to show Premium prices as an estimate in your currency, kept 24 hours. Our server picks the currency from the country Cloudflare attaches to your connection, and does not store it.
• "nuxt-color-mode": your light or dark theme choice.
• "visualpdf:ratings": the tools you have already rated or declined to rate, and when we last asked.
• "visualpdf:viewer-zoom": your preferred zoom level in the editor.
• If you use the Google Drive import: the temporary Google access token.
• In session storage, which empties when you close the tab: a flag that helps the page recover after a failed update.

Service providers and recipients

Your data is never sold, rented, or shared for advertising. It goes only to these recipients, each for the purpose stated:

• Cloudflare, Inc. (United States): hosting, databases, file storage, content delivery, server logs, security (including Turnstile) and the delivery of our emails. Bound by a data processing addendum with EU standard contractual clauses.
• Microsoft (United States): performs the Word, Excel and PowerPoint conversions only, as described above.
• OVH SAS (France): hosts our self-hosted analytics.
• Google (United States): Sign in with Google, your profile photo if you use it, and the optional Drive import, which runs in your browser.
• Stripe, including Sold through Link, LLC (United States): Premium payments, VAT, receipts and invoices, as merchant of record and independent controller.
• Discord, Inc. (United States): internal notifications to our team. For a feedback message: its number, reason, language, country, page address, and the attachment's file name and size. For a failed email: the error code only. Never your message or your email address.
• IONOS SE (Germany): stores the emails you send to contact@visualpdf.com.
• Other users: the members of a workspace you belong to and the people you invite see what the "Workspaces and teams" section describes.

International transfers

Some of our providers are in the United States or may process data there: Cloudflare (which hosts our databases and storage), Microsoft, Google, Stripe and Discord. Those transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and on the European Commission's standard contractual clauses otherwise. You can ask us for a copy of these safeguards at contact@visualpdf.com.

Your rights

Under the GDPR you can ask us to access, correct, delete, or hand over the data we hold about you, and you can object to or restrict its processing. If you have an account, that covers your account, your workspace data and your saved items.

Some of this you can do yourself: change your name on your account page, delete your saved items, and delete your account (see Deleting your account). For anything else, including a copy of your account data in a portable format, write to contact@visualpdf.com. We answer within one month.

Right to object: you can object at any time, on grounds relating to your situation, to the processing we base on our legitimate interest: audience analytics, security measures, session records and server logs. Write to contact@visualpdf.com. For analytics, you can also stop it yourself by blocking requests to www.visualpdf.com/api/e/ with any content blocker: the site keeps working.

For payment data, you can also contact Stripe or Link directly. Their privacy policies are linked in the Premium payments section.

You can also give us instructions on what should happen to your data after your death (Loi Informatique et Libertés, article 85). Without instructions, your account stays until your heirs ask us to delete it, which they can do by writing to contact@visualpdf.com with proof of death. You can tell us at the same address whether your data may be passed to someone you name.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr). You can also complain to the data protection authority of the EU country where you live, where you work, or where the alleged infringement took place.

Profiling and age limits

We make no automated decisions about you and build no profiles. The tools need no account and are meant for a general audience.

Accounts are for people aged 15 and over. Purchases are for adults, or for minors with a parent's permission. We do not knowingly collect data from children under 15.

Changes to this policy

If our practices change, we update this page and its "last updated" date before the change takes effect. If a change significantly affects account holders, we also email them 30 days before it applies.