Privacy Policy

Last updated:

This policy explains what personal data is processed when you use pdfdots.com, why, and what rights you have. We have kept it as short and concrete as we can, because the honest answer for most of our tools is simple: your files never leave your device unless you choose to save them to My files.

Using pdfdots requires a free account, created by signing in with Google. pdfdots shows no ads, sends no newsletter and does not sell data to anyone.

Who is responsible

The website pdfdots.com is operated by Mobtive, which is the data controller for the processing described here. For any question or request about your personal data, including requests under the GDPR or the Turkish Personal Data Protection Law (KVKK), please write to contact@pdfdots.com.

Your account

To use the tools you sign in with your Google account. When you do, Google shares your name, e-mail address, profile picture and Google account ID with us. We use these only to create and identify your pdfdots account, show you who is signed in and let you contact us about your account. We never receive your Google password.

After sign-in we set a session cookie that keeps you signed in. It is strictly necessary for the service you asked for, so it does not require consent, and it is not used for tracking or advertising. It is removed when you sign out or when it expires.

Your account data is kept as long as your account exists. You can delete your account at any time from the Studio; this removes your account data and all stored files immediately.

My files: optional cloud storage

Signed-in users can choose to save files to My files. Nothing is saved there unless you click Save to my files. Saved files are stored on our servers at Hetzner in Germany and are encrypted at rest with AES-256-GCM. Each account has 1 GB of storage.

A saved file is kept until you delete it or delete your account. Deleting your account removes all of your stored files immediately. We do not open, analyse or share stored files, and we do not use them for any other purpose.

Your files: in-browser tools

Most pdfdots tools run entirely inside your web browser. When you use them, your files are processed locally on your own device and are never transmitted to our servers unless you choose to save the result to My files. We cannot see, store or access these files.

Your files: server-side tools

A few conversions cannot be done reliably in a browser, so they run on our server. These tools are labeled as such on their pages. They are: PDF to Word, Word to PDF, Excel to PDF, PowerPoint to PDF, PDF to Excel, PDF to PowerPoint, PDF to PDF/A, Grayscale PDF and HTML/URL to PDF.

When you use one of them, your file (or, for HTML/URL to PDF, the web address you enter) is sent over an encrypted HTTPS connection to our server in Germany. It is processed in a temporary folder, the result is returned to you, and the temporary folder is deleted immediately after the response. File contents are not stored, not shared with anyone and not used for any other purpose. The maximum file size is 50 MB.

To protect the service from abuse, requests to these tools are rate-limited per IP address. This counter is kept in memory only and is discarded after 10 minutes.

Server logs

Like any web server, our hosting and reverse-proxy setup may record technical request data: IP address, time of the request, requested URL, status code and user agent (browser type). We use this data only for security and troubleshooting, and keep it only as long as necessary for those purposes.

Analytics and cookies

We set one strictly necessary cookie: the session cookie that keeps you signed in. Because the service cannot work without it, it needs no consent. Analytics cookies are different and are only set with your consent.

We use Google Analytics 4, provided by Google Ireland Limited, to understand how the site is used. Google Analytics is loaded only after you click Accept in the cookie banner. If you reject, no analytics cookies are set and the Google Analytics script is not loaded at all.

With your consent we measure page views and anonymous tool events: the tool name, the number of files, file sizes in bytes and whether the operation succeeded. We never send file names or file contents to Google Analytics.

The cookies set by Google Analytics are _ga and _ga_<ID>. You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of every page.

In addition, the site uses your browser's local storage (not cookies, and never sent to us) for a few small things:

  • your cookie consent choice, so we don't ask again on every page;
  • whether you dismissed the language suggestion hint;
  • an internal "exclude from analytics" flag used by our own team.

Legal bases

We rely on the following legal bases:

  • Performance of a contract, for your account, Google sign-in, the session cookie and My files storage.
  • Consent, for analytics cookies and Google Analytics.
  • Performance of the service you request, for processing your files on our server-side tools.
  • Legitimate interest, for technical server logs kept for security and troubleshooting.

Recipients and processors

We work with a small number of service providers:

  • Hetzner Online GmbH hosts the website and the server-side tools in its data center in Nuremberg, Germany.
  • Cloudflare, Inc. provides DNS and e-mail forwarding for our domain. Cloudflare is used for DNS only; website traffic is not proxied through Cloudflare.
  • Google Ireland Limited provides Google sign-in, and Google Analytics only if you have given consent.

International transfers

Our website and server-side tools are hosted in Germany. If you consent to analytics, data may be transferred to Google LLC in the United States. Such transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. E-mails you send us are forwarded via Cloudflare, Inc., a US company.

Retention

Account data is kept until you delete your account. Files in My files are kept until you delete them or your account; account deletion removes them immediately. Files processed by server-side tools are deleted immediately after the response. Rate-limiting data is kept in memory for 10 minutes. Server logs are kept only as long as necessary for security and troubleshooting. Analytics data is handled by Google Analytics according to its settings. E-mails you send us are kept as long as needed to handle your request.

Your rights

Depending on the law that applies to you, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

If you are in Turkey, you have the rights listed in Article 11 of KVKK and the right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). If you are in the EU/EEA, you have the right to lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, write to contact@pdfdots.com. You can also view and delete your stored files and delete your whole account yourself in the Studio.

Changes to this policy

We may update this policy when our service or the law changes. The date of the latest version is shown at the top of this page.