Privacy policy

In short

• Most tools run in your browser. Those files never reach us.
• We store files only in your cloud library, which needs an account.
• The AI assistant sends a document's text, not the file, to our AI provider.
• Paystack handles payments. We never see your card number.
• Analytics cookies stay off unless you accept them.
• We don't sell your personal information.

Who we are

PDF Wizard ("we", "us") is the responsible party for your personal information under POPIA and the controller under GDPR.

What we collect and why

Your account

Your email address, your password (stored hashed by our sign-in provider; we can't read it), your name if you give it, your plan and when you signed up. We use these to create your account, sign you in and send account emails such as the sign-up confirmation and password resets. An account needs an email address and a password; without them we can't create one. You don't need an account to use the tools.

Your cloud library

When you're signed in, PDFs you upload to your dashboard or open in the editor are saved to your library, with their name, size and page count, so you can open them again on any device. Each library is private to its account.

Payments

Paystack collects your card or bank details on its own checkout page. We keep your Paystack customer and subscription codes, your plan, its status and renewal or end date, and payment references. Paystack keeps the full payment record. We use these to give you what you paid for, handle renewals, cancellations and refunds, and keep the records South African tax law requires.

Team seats

If you own a Team plan: the email addresses you add, so those people get your plan when they sign in.

The AI assistant

When you use Chat with PDF, your browser extracts the document's text and sends it, with the file name and your questions, to our server, which passes them to Ollama, our AI provider, to write the answer. We don't store the text, your questions or the answers. Don't use the assistant on documents you aren't allowed to share with a third party.

Video and Slides links

When you download a video or import Google Slides, the link you paste goes to our server. For YouTube, our download server fetches the video and deletes the file automatically soon after you download it. For X (Twitter), our server looks the post up through X's public embed service and, if that fails, the public FxTwitter or vxTwitter services. For Google Slides, our server downloads the deck from Google. We don't store the links, apart from short-lived technical logs. Video previews load their thumbnail straight from YouTube or X.

Daily limits

To apply daily limits (for example AI answers and downloads), we count uses per account or, for visitors without an account, per salted one-way hash of the IP address. The counters never hold a raw IP address. Old counters are cleared automatically, usually within 40 days.

Prices in your currency

We use the country your IP address points to, supplied by our host, to show estimated prices in your currency. We don't store it.

Analytics, only if you accept

If you accept analytics cookies, Google Analytics records how the site is used: pages visited, approximate location, device and browser, and events such as a finished tool, a download, a sign-up, or a purchase (plan, amount and payment reference). We never send it your files, document text, name or email address.

Messages to us

If you contact us, we keep your message and our reply so we can help you.

Technical logs

Like any website, our hosting providers record basic request data, such as IP address, browser and time, in short-lived logs used for security and fixing errors.

Files you open in the browser

The PDF and PowerPoint tools (merge, compress, convert, OCR, sign and the rest) run on your device. Files you open in them are not uploaded to us. The editor does the same when you're signed out, keeping your work in your browser's storage so it survives a reload (clearing your browser data removes it). When you're signed in, it saves to your cloud library.

Legal grounds

We only use personal information when the law allows it (POPIA section 11, GDPR article 6):

• To provide the service you asked for (contract): your account, library, plan, AI answers and downloads.
• To meet legal duties: keeping payment records for tax.
• Legitimate interests: keeping the service secure, preventing abuse through daily limits, fixing errors and showing local prices. You can object to these.
• Your consent: analytics cookies. You can withdraw it at any time.

Who we share it with

These service providers ("operators" under POPIA, "processors" under GDPR) handle personal information for us, only to provide their service:

• Vercel: hosts the website and runs our server code.
• Supabase: accounts, sign-in, our database and cloud library storage.
• Paystack: payments, subscriptions and refunds.
• Ollama: AI assistant answers (document text and questions only).
• Google: Google Analytics, only if you accept analytics cookies.
• Our video download host: a cloud provider that runs our YouTube download server (video links only).
• Our email provider: sends account emails such as sign-up confirmations.

We also share information when the law requires it, or to protect our rights or someone's safety. We don't sell personal information.

Transfers outside South Africa

Several of these providers are based in, or store data in, other countries, including the United States. When personal information leaves South Africa, we rely on the provider's data protection terms, which bind it to protect the information to a standard similar to POPIA (section 72), or on your consent where that applies. Ask us if you want details about a provider.

How long we keep it

• Account details: while your account is open. We delete them within 30 days of your account being closed, except what the law makes us keep.
• Library files: until you delete them or your account is closed.
• Payment records: five years after the payment (in Paystack and our accounts), as South African tax law requires.
• Team seat emails: until the owner removes them or the account is closed.
• Daily limit counters: usually up to 40 days.
• Messages to us: as long as we need them to help you, and no more than two years.
• Analytics: no more than 14 months in Google Analytics.

Security

Everything travels over HTTPS. Database rules let each account reach only its own records and files, library files are private, secret keys stay on the server, and card numbers never reach our systems. No system is perfectly secure, though. If a breach affects your personal information, we'll tell you and the Information Regulator as soon as reasonably possible, as POPIA requires.

Your rights

You can ask us to:

• confirm whether we hold personal information about you, and give you a copy;
• correct or update it;
• delete it, or close your account;
• stop or limit using it, or object to how we use it;
• withdraw consent you gave, such as for analytics;
• give you your data in a format you can take elsewhere (GDPR).

Contact us and say what you want. We may ask you to confirm who you are. It's free, and we'll reply within 30 days. You can delete library files yourself at any time from your dashboard.

Cookies and browser storage

Always on (needed for the site to work)

• sb-…-auth-token cookies (Supabase) keep you signed in. They last up to 400 days and are removed when you sign out.
• pdfw-consent (browser storage) remembers your cookie choice.
• pw-usage (browser storage) counts today's tasks, so we don't show you the same tip twice.
• pdf-wizard (browser database) holds files you're editing without an account and files passed between tools. It stays on your device.

We don't use analytics or advertising cookies.

Children

PDF Wizard isn't meant for anyone under 18 without a parent's or guardian's permission. We don't knowingly collect children's personal information. If you think a child has given us some, contact us and we'll delete it.

Emails

We email you only about your account and payments, such as sign-up confirmations and password resets. Paystack sends payment receipts and subscription notices. We won't send you marketing emails unless you opt in.

Changes to this policy

When we change this policy, we update the date at the top. For important changes, we'll tell account holders by email or on the site before they apply.

Contact and complaints

Questions and requests:

If you're unhappy with how we handled your information, please tell us first. You can also complain to South Africa's Information Regulator at inforegulator.org.za or POPIAComplaints@inforegulator.org.za. In the EU or UK, you can complain to your local data protection authority.