Privacy Policy

You are viewing the privacy policy of the paid offering of SimplePDF

As such, the data collection differs from SimplePDF's one to enable the paid features of SimplePDF Portals.

Introduction

Privacy is one of the key distinctive features of SimplePDF - you may have noticed that there is no cookie banner: that's because we don't use any third-party services to track you.

Read on if you are interested in knowing more about what we do to protect your privacy.

What data is collected

• Account data: your email address, your language preference and, if you provide them or sign in with Google, your name and profile picture
• Anonymous usage statistics (like "a PDF was loaded" or "a PDF was edited") - we cannot identify who performed these actions
• Documents loaded and saved in the portal are saved on the server
• Document submissions are saved on the server
• Connected app records: if you connect an AI assistant such as ChatGPT to SimplePDF, we store which app you connected, the organization you chose, your consent, and the app's access and refresh tokens (stored only in hashed form)

Legal basis for processing

We process your personal data based on the following legal grounds:

• Contract performance: processing necessary to provide you with the SimplePDF service, including account management, PDF processing, and payment processing for paid subscriptions
• Consent: when you explicitly opt in, such as sending a broken PDF for investigation or subscribing to marketing emails
• Legitimate interest: for security and fraud prevention purposes to protect you and our service

Third party services collecting your data

No third-party service tracks you. These are the providers involved in operating the service:

• DigitalOcean (hosting and storage, Frankfurt, Germany): runs our servers, database and document storage
• Mailgun (transactional emails, EU region): sends login codes and notification emails
• Stripe (payment processing): handles your payment details for paid subscriptions - Stripe acts as its own data controller for payment data
• Google (optional sign-in): if you choose "Continue with Google", you authenticate directly with Google under Google's own terms - Google acts as an independent controller, not on our behalf. We receive your name, email address, verified-email status and profile picture; we do not store Google access tokens and request no access to your Google data
• OpenAI (ChatGPT, only if you connect it): when you use SimplePDF in ChatGPT, the results of the actions you ask for are sent to OpenAI, which processes them under its own terms and privacy policy. These results can include document and field names, the values submitted or prefilled in your forms and any context attached to them, links that open or fill your documents (some of which do not expire), and short-lived download links

How will we use your data?

• To allow you to log into your account (if you decide to create one)
• To carry out, on your behalf, the requests of the AI assistants you connect to your account
• Improve the product using the events generated by your usage of SimplePDF: otherwise we would not know what works and what does not

How do we store your data?

Your data is securely stored in a database located in Europe (Frankfurt). We don't store passwords - you sign in with a one-time code sent to your email, or optionally with your Google account.

The documents and submissions are saved in a storage with private access only

When you request to view or download your documents, a secure temporary link is generated that expires after 15 minutes for security reasons. You can always request a new link.

Data retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: retained until you delete your account
• Documents (paid tiers): retained until you delete them
• Documents (your own storage): if you connect your own cloud storage (like AWS S3), documents are stored there and you control how long to keep them
• Connected apps: access tokens expire after 1 hour and refresh tokens after 30 days; a refresh token is replaced each time it is used, so a connection in use stays active. Expired tokens are deleted daily. The connection record is kept until an administrator removes you from the organization or you delete your account
• PDF investigation: if you consent to send a broken PDF for investigation, it is temporarily retained for debugging purposes only
• Security and abuse-prevention data: records we use to protect the service against abuse and fraud (such as IP addresses linked to rate-limit violations) are kept for as long as necessary to protect the service - deleting them on a fixed schedule would let repeat offenders come back

What are your data protection rights?

SimplePDF would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access - You have the right to request SimplePDF for copies of your personal data.
• The right to rectification - You have the right to request that SimplePDF correct any information you believe is inaccurate. You also have the right to request SimplePDF to complete information you believe is incomplete.
• The right to erasure — You have the right to request that SimplePDF erase your personal data, under certain conditions.
• The right to restrict processing - You have the right to request that SimplePDF restrict the processing of your personal data, under certain conditions.
• The right to object to processing - You have the right to object to SimplePDF's processing of your personal data, under certain conditions.
• The right to data portability - You have the right to request that SimplePDF transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: support@simplepdf.com

Data breach notification

If there's ever a data breach that could affect you, we will notify the relevant authorities within 72 hours and contact you directly if the risk is significant.

How do we use cookies?

SimplePDF uses cookies to keep you signed in to your account.

Privacy policies of other websites

The SimplePDF website may contain links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Changes to our privacy policy

SimplePDF keeps its privacy policy under regular review and places any updates on this web page. This privacy policy was last updated on 13 October 2026.

Who we are

This service is operated by:

How to contact us

If you have any questions about SimplePDF's privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Email us at: support@simplepdf.com