1. Scope
EDITRONPRO S.R.L. is the controller for account, authentication, support, and service administration data. Where we process document content on behalf of a business customer acting as controller, we act on that customer's instructions as a processor.
This notice covers PDFly accounts, document processing, wallet records, and support. Independent services, including Google sign-in, publish their own privacy notices.
2. Information We Collect and Lawful Bases
We collect your name, email address, authentication data, and verification status to provide your account and perform our contract with you (Article 6(1)(b) GDPR). Passwords are stored as hashes, not as readable passwords.
We process uploaded PDF, JPG, and PNG files, file names, selected settings, operation status, and wallet entries to perform your requested service. We use technical logs and request information for our legitimate interests in security, abuse prevention, and troubleshooting (Article 6(1)(f) GDPR). Records required by law are processed to meet legal obligations (Article 6(1)(c) GDPR).
3. Documents and Files
PDFly automatically reads and processes file contents only to carry out the tool you choose, including text extraction and optical character recognition where requested. We do not use documents to train machine-learning models or create advertising profiles.
You retain ownership of your documents. We do not routinely conduct human reviews of their contents. Do not send sensitive documents to support unless they are needed to resolve your request.
4. How We Use Information
We use information to authenticate accounts, process files, validate results, calculate charges, maintain wallet history, send verification and recovery messages, respond to requests, and secure the service.
Account information is necessary to process and download documents. Optional information supplied to support is used to answer your request. We do not make automated decisions that produce legal or similarly significant effects on you.
5. Account and Wallet Data
Wallet records include balances, reservations, releases, and completed operation charges. PDFly does not directly collect or store full card numbers or card security codes. If paid top-ups are made available, the checkout will identify the payment provider and its applicable notice before payment.
Promotional and test credits are distinct from monetary purchases. Administrative virtual credit adjustments do not represent a card payment.
6. File Retention
Source files are scheduled for deletion when processing finishes; abandoned or unprocessed uploads have a 24-hour fallback expiry. Live-storage cleanup normally runs hourly. Generated results remain available in My files for 7 days after processing, then expire and are scheduled for automatic deletion.
Live-file expiry does not mean immediate removal from every backup. Restricted operational backups are rotated separately: the current setup retains three daily snapshots and two pre-deployment snapshots. Backup copies are not available through normal downloads.
Account records are retained while needed to provide your account. Wallet, operation, support, and security records may be kept longer for accounting, legal obligations, security, or dispute resolution. Retention is based on those purposes and applicable requirements; you may request further information or deletion.
7. Security
PDFly uses HTTPS for public file transfers, private object storage, account access controls, and time-limited signed download links. Uploaded files and results are validated before a completed operation is charged. Anyone who obtains an active signed link may use it, so share links carefully.
The PDF password-protection tool can create an AES-256 protected output. This is separate from storage security and does not establish a general guarantee that all stored files and backups are encrypted at rest.
8. Service Providers and International Transfers
Hosting, storage, authentication, transactional email, and support providers may process information needed to deliver their services. Google receives information when you choose Google sign-in. We may disclose information where required by law or to protect the service.
Where a transfer outside the EEA or UK is subject to data-protection law, the applicable transfer requirements must be met. Contact help@pdfly.tech for details about relevant providers, processing locations, and transfer safeguards. Registration in Romania alone does not determine where every provider processes data.
10. Your Privacy Rights
Depending on applicable law, you may request access, correction, erasure, restriction, objection, or portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to a supervisory authority, including ANSPDCP in Romania or the ICO in the UK.
Send requests to help@pdfly.tech. We may verify your identity and normally respond within one month. If a lawful extension is needed, we will explain it. Account deletion does not require erasure of records that must be retained by law.
11. Children's Privacy
PDFly is not directed to children. If you believe a child has provided personal data, contact us so we can review and address the request.
12. Changes and Contact
We may update this notice when the service or applicable requirements change. The date above identifies the latest revision. Material changes will be communicated where required.
Data controller: EDITRONPRO S.R.L., Romania. Privacy and customer support: help@pdfly.tech.