Privacy Policy

Summary of changes: we set out how long uploaded files are kept and when they are deleted (Section 2.1.4); uploaded content is not used for analytics (Section 3.4); we clarified which providers receive file content (Sections 3, 3.1 and 5.1); we replaced our contact email throughout and added response times (Section 6); we updated our U.S. States Privacy Notice (Section 9) and our data retention terms (Section 10); and we removed references to payments, as the Service is free of charge (Sections 2.1.3, 3.7 and 5.1).

IMPORTANT PRIVACY INFORMATION

In order to use our Service, we will ask you to create an account by providing your email.

When you access our website, we automatically collect from your device cookies, language settings, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, hardware ID, other unique identifiers (such as IDFA and AAID) and information about your interactions with the website. We need this data to provide our services, analyze how our customers use the website, and measure ads.

For providing services, improving the website, and serving ads, we use third-party solutions listed in Sections 3 and 5 of this Privacy Policy. Therefore, some of the data is stored and processed on the servers of such third parties. This enables us to (1) provide certain services; (2) analyze different interactions (what products our users viewed); (3) serve and measure ads (and show them only to a particular group of users).

Please read our Privacy Policy below to know more about what we do with data (Section 3), what data privacy rights are available to you (Section 6) and who will be the data controller (Section 1). If any questions remain unanswered, please contact us at support@pdffly.com.

PRIVACY POLICY

This Privacy Policy explains what personal data is collected when you use our PDFFly website (the "Website"), the services and products provided through it (together with the Website, the "Service"), how such personal data will be processed.

By using the Service, you promise us that (i) you have read, understand, and agree to this Privacy Policy, and (ii) you are over 16 years of age (or have had your parent or guardian read and agree to this Privacy Policy for you). If you do not agree or are unable to make this promise, you must not use the Service. In that case, you must (a) contact us and request deletion of your data; and (b) leave the Website and not access or use it.

Any translation from the English version is provided for your convenience only. In the event of any difference in meaning or interpretation between the English language version of this Privacy Policy, and any translation, the English language version will prevail. The original English text shall be the sole legally binding version.

"GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

"EEA" includes all current member states of the European Union and the European Free Trade Association. For the purpose of this policy, EEA shall include the United Kingdom of Great Britain and Northern Ireland.

"Process," in respect of personal data includes collecting, storing, and disclosing to others.

TABLE OF CONTENTS

1. PERSONAL DATA CONTROLLER
2. CATEGORIES OF PERSONAL DATA WE COLLECT
3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA
4. UNDER WHAT LEGAL BASES WE PROCESS YOUR PERSONAL DATA (Applies only to EEA-based users)
5. WITH WHOM WE SHARE YOUR PERSONAL DATA
6. HOW YOU CAN EXERCISE YOUR PRIVACY RIGHTS
7. AGE LIMITATION
8. INTERNATIONAL DATA TRANSFERS
9. U.S. STATES PRIVACY NOTICE
10. DATA RETENTION
11. CONTACT US

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect data you give us voluntarily (for example, your email address). We also collect data automatically (for example, cookies and technical information about your device).

2.1. Data we receive directly from you

2.1.1. Identifiers

You may provide us with your name and email address when you create an account with the Service or contact us by any other means.

2.1.2. Account Data

This includes your login information (email and password) and user ID.

2.1.3. Payments

The Service is free of charge. We do not process payments and do not collect payment card or other payment details.

2.1.4. Content

Our Service accesses and processes the content, i.e., documents or files you upload, to perform the conversion, edit, or other action you request. If you use our signing feature, we process your signature to apply it to your document. Files that are not saved to your account, including the result of your action, are deleted from our servers within 2 hours after the requested action is complete; please download your result within that time, as after that it is no longer available. Files for which no action is completed are deleted within 24 hours of upload. Files saved to your account (My files) are stored until you delete them. You can delete any file from My files at any time, or ask us to delete your data as described in Section 6. If you use our AI tools, OpenAI's handling of your document is described in Section 3.1. We do not use the content of your files for analytics, advertising, or training AI models.

2.1.5. Feedback/Communications

We may also process your email and other information provided by you to us through customer support and other communications.

2.2. Data we collect automatically

2.2.1. Data about how you found us

We collect data about your referring app or URL (that is, the app or place on the Web where you were when you tapped/clicked on our ad).

2.2.2. Device and Location data

We collect data from your mobile device. Examples of such data include: language settings, IP address, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, and hardware ID.

2.2.3. Usage data

We record how you interact with our Service. For example, we log what pages you have viewed, the features and content you interact with, how often you use the Website, and how long you are on the Website.

2.2.4. Advertising IDs

Our service providers may collect your Apple Identifier for Advertising ("IDFA"), Identifier for Vendor ("IDFV") or Google Advertising ID ("AAID") (depending on the operating system of your device) when you access our Website from a mobile device. You can typically reset these identifiers through the settings of your device's operating system (but we do not control this).

Some of the information we and our third-party partners collect automatically is captured using cookies, which are text files containing small amounts of information that are downloaded to your device or related technologies, such as web beacons, local shared objects, and tracking pixels, to collect and/or store information. To learn more, please refer to our Cookie Policy.

3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

Please note: apart from our hosting and cloud storage providers, which store your files on our behalf until they are deleted as described in Section 2.1.4, and OpenAI, which receives the content of your document when you use the AI tools described in Section 3.1, the third-party providers named below in this Section 3 do not receive the content of the files you upload for processing. If you attach a file to a support request, it is received by Zendesk (see Section 3.3). File content is never shared with our analytics, advertising, or marketing providers.

We process your personal data:

3.1. To provide our Service

This includes enabling you to use certain functions of the Service, use of the Service in a seamless manner and preventing or addressing Service errors or technical issues. As a result of such processing, we will, for example, use your email to create your account and process the content you upload so that the tool you selected can run. Uploaded files are retained or deleted as described in Section 2.1.4.

If you use our AI tools to summarize or analyze a document, the content of your document is sent to the OpenAI API to generate the result. Apart from our hosting and cloud storage providers, OpenAI is the only service provider that receives the content of the files you upload for processing. OpenAI does not use this content to train its models. OpenAI may retain this content for up to 30 days, including for abuse monitoring, unless longer retention is required by law, and then deletes it. If you prefer that no document content is sent to OpenAI, please do not use our AI tools. To learn more, please visit OpenAI's Privacy Policy.

3.2. To provide you with customer support

We process your personal data to respond to your requests for technical support, Service information or to any other communication you initiate. For this purpose, we may send you notifications or emails, for example, about the performance of our Service, security, or notices regarding our Terms and Conditions of Use or this Privacy Policy.

3.3. To communicate with you regarding your use of our Service

We may communicate with you through various means, including email. These messages may include, for example, emails with information about the Service. To opt out of receiving emails, you need to follow the instructions in the footer of the emails.

We use Zendesk ticketing system to handle customer inquiries. When you send us inquiries via contact form or via email, we will store the details provided by you via Zendesk ticketing system, which enables us to track, prioritize and quickly resolve your requests. To learn more, please visit this Privacy Policy.

We use ZeroBounce, which is an email verification service provider that helps us validate, check and verify emails instantly. ZeroBounce allows us to improve our email deliverability and open rates by removing invalid, spammy and inactive addresses from our lists. ZeroBounce stores email validation results up to 30 days, and then deletes them automatically.

3.4. To research and analyze your use of the Service

This helps us to better understand our business, analyze our operations, maintain, improve, innovate, plan, design, and develop the Service and our new products. We also use such data for statistical analysis purposes to test and improve our offers. This enables us to better understand what categories of users use our Services. As a consequence, we often decide how to improve the Service based on the results obtained from this processing.

Amplitude is an analytics service provided by Amplitude Inc. We use this tool to understand how customers use our Service. Amplitude collects various technical information, in particular, time zone, type of device (phone, tablet or laptop), unique identifiers (including advertising identifiers). Amplitude also allows us to track various interactions that occur in our Website. As a result, Amplitude helps us to decide what features we should focus on. Amplitude provides more information on how they process data in its Privacy Policy.

We use Firebase Analytics, which is an analytics service provided by Google. In order to understand Google's use of data, consult Google's partner policy, the Firebase Privacy information, and Google's Privacy Policy.

We also use Clarity, a Microsoft analytics product, to identify how people use website and uncover specific trends. Clarity's Data Privacy and Security Policy.

We also use Hotjar, a behavior analytics tool that analyzes Service use, providing feedback through tools such as heatmaps, session recordings, and surveys. For more details, please refer to Hotjar's Privacy Policy.

3.5. To send you marketing communications

We process your personal data for our marketing campaigns. As a result, you will receive information about our products, such as, for example, special offers or new features and products available on the Website. If you do not want to receive marketing emails from us, you can unsubscribe by following the instructions in the footer of the marketing emails.

To send you marketing communications, we use Customer.io, a cross-channel marketing platform that allows us to send you in-app messages, push notifications, and emails. Customer.io Privacy Policy.

3.6. To personalize our ads

We and our partners use your personal data to tailor ads and possibly even show them to you at the relevant time. For example, if you visited our Website, you might see ads of our products in your Facebook's feed.

How to opt out or influence personalized advertising

iOS: On your iPhone or iPad, go to Settings > Privacy > Apple Advertising and deselect Personalized Ads.

Android: To opt out of ads on an Android device, go to Settings > Privacy > Ads and enable Opt out of Ads personalization. In addition, you can reset your advertising identifier in the same section (this also may help you to see fewer personalized ads). To learn even more about how to affect advertising choices on various devices, please look at the information available here.

macOS: To disable personalized ads on your MacBook, go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, and deselect Personalized Ads.

Windows: On a laptop running Windows 10, select Start > Settings > Privacy and then turn off the setting for "Let apps use advertising ID to make ads more interesting to you based on your app activity." If you have a different Windows version, please follow the steps here.

To learn even more about how to affect advertising choices on various devices, please refer to the information available here.

In addition, you may get useful information and opt out of some interest-based advertising by visiting the following links:

• Network Advertising Initiative – https://optout.networkadvertising.org/
• Digital Advertising Alliance – https://optout.aboutads.info/
• Digital Advertising Alliance (Canada) – https://youradchoices.ca/
• Digital Advertising Alliance (EU) – https://www.youronlinechoices.com/
• DAA AppChoices page – https://www.aboutads.info/appchoices

Browsers: It may also be possible to stop your browser from accepting cookies altogether by changing its cookie settings. You can usually find these settings in the "options" or "preferences" menu of your browser. The following links may be helpful, or you can use the "Help" option in your browser.

• Cookie settings in Internet Explorer
• Cookie settings in Firefox
• Cookie settings in Chrome
• Cookie settings in Safari web and iOS

Google allows its users to opt out of Google's personalized ads and to prevent their data from being used by Google Analytics.

We value your right to influence the ads that you see, thus, we are letting you know what service providers we use for this purpose and how some of them allow you to control your ad preferences.

Google Ads is an ad delivery service provided by Google that can deliver ads to users. In particular, Google allows us to tailor the ads so that they appear, for example, only to users who have taken certain actions on our Website. Some other examples of events that may be used for tailoring ads include, in particular, visiting our Website. Google allows its users to opt out of Google's personalized ads and to prevent their data from being used by Google Analytics.

We use Microsoft Advertising to promote our Services. You may find more information on how we do it in Microsoft Advertising privacy policy.

3.7. Payments

The Service is free of charge, so we do not process payments and do not use payment processors.

3.8. To enforce our Terms and Conditions of Use and to prevent and combat fraud

We use personal data to enforce our agreements and contractual commitments to detect, prevent, and combat fraud. As a result of such processing, we may share your information with others, including law enforcement agencies (in particular, if a dispute arises in connection with our Terms and Conditions of Use).

3.9. To comply with legal obligations

We may process, use, or share your data when the law requires it, in particular if a law enforcement agency requests your data by available legal means.

4. UNDER WHAT LEGAL BASES WE PROCESS YOUR PERSONAL DATA (Applies only to EEA-based users)

This section outlines the legal bases we rely on for each particular purpose of processing. For more information on a particular purpose, please refer to Section 3. This section applies only to EEA-based users.

We process your personal data under the following legal bases:

4.1. To perform our contract with you

Under this legal basis, we:

• Provide our Service (in accordance with our Terms and Conditions of Use);
• Provide you with customer support;
• Communicate with you regarding your use of our Service.

4.2. To pursue our legitimate interests

We rely on legitimate interests:

• to communicate with you regarding your use of our Service;

This includes, for example, sending you an email to notify you that we have released a new product. The legitimate interest we rely on for this purpose is our interest to encourage you to use our Service more often.

• to research and analyze your use of the Service;

Our legitimate interest for this purpose is our interest in improving our Service so that we understand users' preferences and are able to provide you with a better experience (for example, to make the use of the Website easier and more enjoyable, or to introduce and test new features).

• to send you marketing communications;

The legitimate interest we rely on for this processing is our interest to promote our Service, including new products and special offers, in a measured and appropriate way.

• to personalize our ads;

The legitimate interest we rely on for this processing is our interest to promote our Service in a reasonably targeted way.

• to enforce our Terms and Conditions of Use and to prevent and combat fraud;

Our legitimate interests for this purpose are enforcing our legal rights, preventing and addressing fraud and unauthorized use of the Service and non-compliance with our Terms and Conditions of Use.

• to investigate and respond to any comments or complaints that you may send us.
• In the event of a merger or acquisition of our business and/or all or any portion of its assets, your information may be disclosed to the prospective purchaser, our advisers, and any other prospective purchaser's advisers and will be one of the assets that is transferred to a new owner; and
• in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of information in connection with government agency requests, legal process or litigation).

Where we process your information based on legitimate interests, you can object to this processing in certain circumstances. In such cases, we will cease processing information unless we have compelling legitimate grounds to continue processing or where it is needed for legal reasons. To exercise your right to object, please see Section 6 of this Privacy Policy.

4.3. To comply with legal obligations, including, but not limited to, responding to requests by government or law enforcement authorities conducting an investigation

5. WITH WHOM WE SHARE YOUR PERSONAL DATA

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our Service. We may share some sets of personal data, in particular, for purposes and with parties indicated in Section 3 of this Privacy Policy. The types of third parties we share information with include, in particular:

5.1. Service providers

We share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We may share your personal information with the following types of service providers:

• hosting and cloud storage providers
• data analytics providers (Firebase, Appsflyer, Amplitude, Clarity)
• measurement partners
• technology partners (OpenAI)
• communication service providers
• marketing partners (in particular, social media networks, marketing agencies, email delivery services; Facebook, Google, TikTok)

Please note: apart from our hosting and cloud storage providers, which store your files on our behalf until they are deleted as described in Section 2.1.4, and OpenAI, which receives the content of your document when you use our AI tools (see Section 3.1), the service providers listed in this Section 5.1 do not receive the content of the files you upload for processing. If you attach a file to a support request, it is received by Zendesk (see Section 3.3).

5.2. Law enforcement agencies and other public authorities

We may use and disclose personal data to enforce our Terms and Conditions of Use, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, and to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, or in other cases provided for by law.

5.3. Third Parties as part of merger and acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers' information is generally one of the transferred business assets in these types of transactions. We may also share such information with any affiliated entity (e.g. parent company or subsidiary) and may transfer such information in the course of a corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

5.4. Affiliates

We may share your personal information with our partner organizations that are part of our corporate group – these are companies that are owned by, own, or are jointly owned with us. These partner organizations will use the information in ways that align with this Privacy Policy.

6. HOW YOU CAN EXERCISE YOUR PRIVACY RIGHTS

To be in control of your personal data, you have the following rights:

Accessing / reviewing / updating / correcting your personal data. You may review, edit, or change the personal data that you had previously provided on the Website.

Deleting your personal data. You can request erasure of your personal data as permitted by law.

When you request deletion of your personal data, we will use reasonable efforts to honor your request. In some cases, we may be legally required to keep some of the data for a certain time; in such cases, we will fulfill your request after we have complied with our obligations.

Objecting to or restricting the use of your personal data. You can ask us to stop using all or some of your personal data or limit our use thereof.

Additional information for EEA-based users:

If you are based in the EEA, you have the following rights in addition to the above:

• The right to lodge a complaint with supervisory authority. We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State where you reside, work or where the alleged infringement has taken place.
• The right to data portability. If you wish to receive your personal data in a machine-readable format, you can send a respective request to us as described below.

To exercise any of your privacy rights, please send a request to support@pdffly.com.

We will respond to your request without undue delay and in any event within one month of receiving it. Where necessary, taking into account the complexity and number of requests, we may extend this period by two further months; if we do, we will inform you within one month of receiving your request and explain the reason for the delay. For residents of U.S. states, the total response period will not exceed 90 days.

7. AGE LIMITATION

We do not knowingly process personal data from persons under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us.

8. INTERNATIONAL DATA TRANSFERS

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Service set forth in the Terms and Conditions of Use, and for purposes indicated in this Privacy Policy. If these countries do not have the same data protection laws as the country in which you initially provided the information, we deploy special safeguards.

In particular, if we transfer personal data originating from the EEA to countries that do not provide an adequate level of data protection, we use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission (details available here), or (ii) the European Commission adequacy decisions about certain countries (details available here).

9. U.S. STATES PRIVACY NOTICE

Applicability

If you reside in a state that has enacted consumer privacy laws, this section applies to you. This U.S. States Privacy Notice ("Notice") supplements our Privacy Policy and provides disclosures required by laws in states such as California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia.

This Notice is designed to supplement our Privacy Policy to ensure compliance with state-specific laws and applies to the collection, use, and sharing of your Personal Information through our websites, mobile applications, and other online or offline services (collectively, the "Services").

For California residents, this also serves as our California Notice at Collection.

The definition of "Personal Information" may vary by state law. Generally, it refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

9.1. Categories of Personal Information We Collect and For What Purposes

The table below outlines the categories of Personal Information we collect, along with purposes of such collection. For more details, refer to other sections of our Privacy Policy.

For additional details on the purposes of processing and third parties with whom data is shared for each specific purpose, please refer to Section 3 of this Privacy Policy.

We may also process de-identified data, ensuring it cannot reasonably be linked back to you. We commit to maintaining and using de-identified data responsibly and will not attempt to re-identify such data unless required to validate our de-identification measures.

9.2. What Personal Information We Share

Certain state privacy laws, such as those in California, require us to disclose the categories of Personal Information that we have shared with third parties for business purposes over the past 12 months. During this period, we have disclosed all categories of Personal Information outlined in the "Categories of Personal Information We Collect" section for business purposes. From 24 September 2026, uploaded content is disclosed only to our hosting and cloud storage providers and, when you use our AI tools, to OpenAI. For example, we may share IP addresses and device identifiers with service providers that assist us with crash monitoring and reporting.

Some U.S. states grant residents the right to opt out of sharing their Personal Information with third parties in exchange for valuable consideration (which may be classified as a "sale" or "share" under state privacy laws, even if no monetary transaction occurs). If you reside in one of these states and would like to limit the disclosure of your Personal Information to third parties for advertising or marketing purposes, please refer to Section 9.4. below.

For details regarding the categories of third parties with whom we share Personal Information, please refer to Section 3 and Section 5 of this Privacy Policy.

9.3. Your Privacy Rights Under State Laws

Certain U.S. state privacy laws grant residents specific rights regarding their personal information. If you reside in a state with such laws, you may have the following rights:

To exercise any of these rights, submit a request to our customer support team via email:

📧 support@pdffly.com

Verification

To ensure that we properly handle the requests you make regarding your rights, we are required to verify those requests. Depending on the type of request, this may include your email, date of last activity, date of account creation or some other Service use data that will reasonably identify you as an owner of the account. We may also ask you for additional proof of identity, if necessary.

Right to Appeal

If we deny your request, you may have the right to appeal our decision. To do so, please contact us and explain your concerns. If you are dissatisfied with the result of the appeal, you may escalate the matter by contacting the Attorney General's office in your state of residence.

Authorized Agents

If you are an authorized agent acting on behalf of a consumer, you may submit an opt-out, access, deletion, or correction request by contacting us. If you are making a request on behalf of a California resident, you may be required to submit proof of authorization, such as:

• A valid power of attorney
• Written permission signed by the consumer, along with identity verification from the consumer

California "Shine the Light" Law

California's Shine the Light law gives California residents the right to ask companies once a year what personal information they share with third parties for those third parties' direct marketing purposes. Learn more about what is considered to be personal information under the statute.

To obtain this information from us, please send an email message to support@pdffly.com, which includes "Request for California Privacy Information" on the subject line and your state of residence and email address in the body of your message. If you are a California resident, we will provide the requested information to you at your email address in response.

Retention of Personal Information

We retain the categories of personal information listed above as reasonably necessary to fulfill the purposes outlined in this notice, unless a longer retention period is required or permitted by law. In many situations, we must retain all, or a portion, of your personal information to comply with legal obligations, resolve disputes, enforce our agreements, protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes. Uploaded content is retained only as described in Section 2.1.4.

9.4. Sales, Sharing, and Targeted Advertising

Privacy laws in some U.S. states broadly define the term "sale" to include sharing of information via cookies, pixels, and similar tracking technologies for certain targeted advertising activities. We do not sell Personal Information for monetary compensation. However, when you visit our websites, we and our advertising partners may collect device data and behavioral insights through tracking technologies, which could be interpreted as a "sale" or "sharing" under state laws, even if no money is exchanged.

We do not knowingly engage in sales, sharing, or targeted advertising using the personal information of individuals under 18.

More information about our data-sharing practices is available in the table below.

Opt-Out Rights

You may opt out of sales, sharing, or targeted advertising by contacting us at support@pdffly.com.

Your opt-out settings apply per device and browser. If you switch devices, clear cookies, or use a different browser, you may need to reapply your opt-out settings.

Do Not Track and Global Privacy Control. Some browsers send a "Do Not Track" (DNT) signal. Because there is no industry standard for responding to DNT signals, we do not respond to them. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information under this Section 9.4.

10. DATA RETENTION

We will store your personal data for as long as it is reasonably necessary for achieving the purposes set forth in this Privacy Policy (including providing the Service to you, complying with our legal obligations, and enforcing Terms of Use and our other agreements).

Please note that personal information may be retained for longer if it becomes the subject of a legal claim or is somehow relevant for litigation or other proceedings. Uploaded files are retained or deleted as described in Section 2.1.4.

11. CONTACT US

You may contact us at any time for details regarding this Privacy Policy and its previous versions. For any questions concerning your account or your personal data, please contact us at support@pdffly.com.

Effective as of: 24 September 2026