Privacy Notice

Last updated 2 October 2026

This Privacy Notice explains what personal data PDFreamly ("we," "us") collects when you use pdfreamly.com (the "Service"), why, and what rights you have over it.

1. Who is responsible for your data

Contact: support@pdfreamly.com. No dedicated Data Protection Officer or EU representative is appointed — under GDPR Art. 37 this generally isn't required unless your core activity involves large-scale, systematic monitoring or large-scale processing of special-category data, neither of which applies here at current scale.

2. What we collect

Account data: your email address, used to send you a one-time sign-in link and, if you subscribe, service-related emails.
Files you upload: processed automatically to provide the tool you selected, then deleted (see Section 4).
Usage and billing data: which tools you used, how many free actions and credits you've used, your credit balance, and (if you subscribe or buy credits) your subscription/purchase status. We do not store your full card number — payments are handled directly by Stripe, our payment processor.
Consent records: a timestamped record that you accepted these Terms/this Notice at checkout, kept as evidence of consent.
Technical data: standard server logs (e.g. IP address, browser type) generated automatically by our hosting infrastructure for security and reliability purposes.

We do not currently collect analytics/tracking cookies beyond what's strictly necessary to run the Service.

3. Why we process your data, and on what legal basis

To provide the Service you request (contract performance) — account creation, file processing, credit/subscription management.
To process payments and comply with tax and accounting obligations (legal obligation / contract performance).
To keep the Service secure and prevent abuse (legitimate interest).
To email you about your account or purchases (contract performance); marketing emails only with your separate opt-in consent, if and when we introduce a newsletter.

4. How long we keep your data

Uploaded files, generated results, and extracted text: automatically and permanently deleted within 1 hour of upload/processing, regardless of whether you downloaded the result.
Account data (email, credit/subscription status): kept for as long as your account is active, plus a reasonable period after in case you return; deleted on request (see Section 6).
Billing/invoice records: kept for 7 years.

We use a small number of service providers ("processors") to run PDFreamly, each of whom processes data only on our instructions:

Supabase — authentication, database, and file storage.
Stripe — payment processing.
Railway — application hosting/deployment.
Cloudflare — DNS and cookieless, privacy-preserving website analytics (page views, referrers, country); no advertising or cross-site tracking.

We do not sell your personal data, and we do not share your files with anyone other than these processors acting on our behalf to run the Service.

Your account and file data sits in Supabase's EU (Ireland, eu-west-1) region for both database and file storage. The application itself (the Next.js web service that handles your requests) runs on Railway in the US (San Francisco) region — meaning some processing of your data happens on US-based infrastructure even though it's stored at rest in the EU. Where this involves a transfer of personal data outside the EU/EEA, we rely on our provider's standard contractual safeguards for that transfer.

6. Your rights

If you are in the EU/EEA (or another jurisdiction with similar protections), you have the right to: access the personal data we hold about you; correct it; request its deletion; request a copy in a portable format; object to or restrict certain processing; and withdraw consent at any time where processing is based on consent. To exercise any of these, contact us at support@pdfreamly.com. You also have the right to lodge a complaint with your local data protection authority — for example, in Hungary, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

7. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them.

8. Changes to this Notice

We may update this Notice from time to time. If we make material changes, we will make a reasonable effort to notify active users before the changes take effect.