Privacy Policy

Last updated: 2026-08-03

1. What data we collect

• Account: email address, password (never in plain text, see section 4), or your Google account identifier if you sign in with OAuth.
• Billing: fully managed by Creem Payments as Merchant of Record. We only receive payment confirmation and a customer identifier — never your card number.
• Technical usage: IP and device fingerprint, always stored as an irreversible hash, used solely to enforce the free demo limit and prevent license sharing among multiple people.
• Conversion metadata: file size, duration, page count, result (success/error). Never the file contents.

2. Most importantly: your files are never stored

The HTML file you upload is streamed to our conversion engine, processed in memory/temporary disk, and guaranteed to be deleted immediately after returning your result — even if the conversion fails. We keep no copies, we do not use them to train any model (in fact, no AI model participates in the conversion: it is a deterministic engineering process), and no employee has access to them at any point.

3. Legal basis for processing (GDPR Art. 6)

• Performance of a contract (Art. 6.1.b): processing your file to deliver the result you requested.
• Legitimate interest (Art. 6.1.f): preventing abuse of the free service and shared licenses.
• Consent (Art. 6.1.a): optional product communications, if you opt in.

4. Data security

• Passwords: PBKDF2-HMAC-SHA256 hash with 600,000 iterations and a unique salt per user. Never reversible.
• Sessions: random 256-bit token; only its SHA-256 hash is stored in the database.
• IP and device fingerprints: always hashed with a server-side salt before being stored.
• Transport: TLS 1.2+ across all communication, including traffic to the conversion engine.
• Database: Cloudflare D1, encrypted at rest by Cloudflare infrastructure.

See the full technical detail on our Security page.

5. Your rights (GDPR / POPIA)

From your account panel you can at any time:

• Access a complete export of your personal data (Art. 15).
• Request deletion of your account and all associated data (Art. 17, right to erasure).
• Rectify incorrect data by contacting support.
• Object to the processing of your data for purposes other than providing the service.

You may also file a complaint with your local data protection authority.

6. Third parties we share data with

• Creem Payments (payment processing) — acts as an independent controller for payment data.
• Google (if you choose to sign in with OAuth) — only receives the standard OAuth 2.0 authentication request.
• Infrastructure provider (Cloudflare for the site/database, Fly.io for the conversion engine) — process data solely as technical processors, under their own security commitments.

We do not use third-party analytics or advertising pixels on the site.

7. Data retention

• Uploaded/generated files: 0 seconds of retention beyond the request processing time.
• Account data: while the account remains active, or until you request its deletion.
• Conversion metadata (no content): up to 24 months, then anonymized.
• Security audit logs: up to 12 months.

Contact

To exercise any of your rights: [email protected]