PDFLean
Data Protection & Privacy

Privacy Policy

Effective date:

Executive Summary

PDFLean is local-first: tools marked 'Local' run in your browser and don't upload your file. We keep only minimal account and billing data. Optional cloud jobs are encrypted; cloud files are kept by plan (7 days on Free, 30 days on paid plans), task records are kept up to 7 days, and you can delete them instantly anytime.

This page is not yet available in your language; the English version is shown and is authoritative.

1. Local-First Processing Principle

All utilities marked with the "Local" badge run directly within your browser sandbox via WebAssembly (WASM) and HTML5 APIs. Whether you are merging contracts, organizing pages, or compressing invoices, your documents are never uploaded to our servers.

2. Account & Identity Data

When you create an account, we collect only your email address and display name for credential verification. Paid subscriptions are processed directly through PCI-DSS Level 1 certified payment processor Stripe. PDFLean never sees or stores full credit card numbers.

3. Ephemeral Cloud Storage & Purge

Compute-heavy cloud tasks (such as large OCR jobs you explicitly run with Pro cloud) stream over TLS 1.3 into isolated storage. Temporary processing artifacts follow one uniform retention policy: cloud task files are kept by plan (7 days on Free, 30 days on paid plans), and task records are kept up to 7 days — you can delete them instantly in your portal at any time. Files you explicitly save to your cloud storage are retained under your plan's storage quota until you delete them. We use a short list of sub-processors (Cloudflare for hosting/compute/storage, Stripe for payments, Resend for transactional email, DeepSeek for optional AI features); see our Security Center for details. EU data residency is available on request for paid plans.

We deploy only strictly necessary HttpOnly cookies required to authenticate your active session. The free tier may display advertising and affiliate links; we do not use third-party behavioral ad trackers, fingerprinting scripts, or cross-site pixels. You may adjust functional, analytics or advertising preferences at any time via our Cookie Policy.

5. Privacy-Preserving Telemetry

To identify operational bottlenecks and improve tool performance, we aggregate anonymous telemetry such as tool invocation frequency and processing latency. For tools marked Local, we never see or index your file contents. For tools marked Cloud, content is processed only to complete the task you requested and is never used for advertising. PDFLean does not use your files to train its models. Where optional AI features are used, only the minimum necessary content is sent to our AI provider (DeepSeek), and we instruct providers contractually not to use submitted content for model training.

6. User Rights & GDPR / CCPA

In accordance with GDPR (EU 2016/679) and California Consumer Privacy Act (CCPA), you retain full rights to: access and export your account data, demand immediate shredding of cloud documents, and permanently terminate your account with complete data erasure. To execute an enterprise data processing agreement, view our Data Processing Addendum (DPA).

7. Contact Data Protection Officer

For inquiries regarding personal data processing, compliance reviews, or audit requests, please reach our Data Protection Officer at: support@pdflean.com.