Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how PDF Time [legal entity name is a placeholder - confirm the actual legal person, e.g. "[Your Name], doing business as PDF Time" or a registered company] ("PDFTime", "we", "us") collects, uses, and protects information when you use PDFTime (the "Service") at pdftime.io, a tool for uploading, reordering, and merging PDF files.

1. Information we collect

1.1 Files you upload

When you use the Service, the PDF files you upload, the merged file we produce, and related details (file name, size, and page count) are stored on our servers only for as long as described in Section 3, so we can perform the merge and let you download the result.

• Files are stored under randomly generated identifiers, never under the name you uploaded them with. Your original file name is kept separately only so it can be displayed back to you in the file list.
• We do not open, read, scan for content, or analyze what is inside your files beyond what is technically required to validate that a file is a readable PDF and to merge the pages you select, in the order you choose.
• We do not sell, rent, or use the contents of your files for advertising, profiling, or to train any machine learning model.

1.2 Account information

If you create an account, we collect the email address you register with and a securely hashed version of your password (we never store your password in plain text). We do not require or collect your name, address, or payment details to create a free account.

If you subscribe to a paid plan, payment is processed by Stripe. We do not receive or store your full card number; see Section 5.

1.3 Usage and technical information

• IP address: to apply fair-use limits for people who aren't signed in and to protect the Service from abuse, we process your IP address, but we do not store it in readable form. It is converted into a one-way cryptographic hash before being saved, so we cannot recover your IP address from what we store. Your IP address may still appear briefly in standard infrastructure-level connection logs (for example, our reverse proxy), consistent with how virtually all web servers operate; these logs are not used to build a profile of you and are retained only as long as needed for security and troubleshooting.
• Cookies and local storage: we use a small number of strictly necessary cookies (to keep you signed in and to protect forms from forgery) and store your light/dark theme preference in your browser's local storage. See our Cookie Policy for the full list. We do not use advertising or cross-site tracking cookies.
• Log data: like most online services, our servers automatically record standard technical information for security and debugging (timestamps, error details, request paths). We do not log the contents of your files.

2. How we use information

We use the information above to:

• Provide the merge service you request, including storing your files temporarily and generating your download link;
• Create and secure your account, including signing you in and verifying your email address;
• Apply the upload, rate, and retention limits that correspond to your plan;
• Detect, prevent, and respond to fraud, abuse, and security incidents;
• Communicate with you about your account, such as email verification or password reset messages, and, if you're on a paid plan, billing notices;
• Maintain and improve the reliability of the Service.

We do not use your personal information for advertising, and we do not sell personal information.

3. How long we keep your files

How long an uploaded or merged file is kept depends on whether, and how, you're using the Service. These are our current defaults; exact figures are configurable and may change — see the in-product notice shown at upload time for the figure that applies to you.

A background process checks for and permanently deletes expired files on a regular schedule. Deleting an account (Section 7) deletes all files owned by that account immediately, without waiting for their normal expiry.

4. Legal basis for processing

[If users are in the EEA/UK, confirm and state the applicable Article 6 GDPR basis here — likely: performance of a contract (to provide the Service you request), legitimate interests (fraud/abuse prevention, service security), and consent (for optional cookies, if any are ever added). Lawyer to confirm and finalize this section based on where the company and its users are located.]

5. How we share information

We do not sell your personal information. We share information only with service providers who help us run the Service, under agreements that restrict them to using it only to provide their service to us:

• Hosting: our servers are provided by Vultr (The Constant Company, LLC), in their Atlanta, Georgia, USA data center.
• Email delivery: account and security emails (verification, password reset) are sent via SendGrid.
• Payment processing: if you subscribe to a paid plan, payment will be handled by Stripe (not yet integrated as of this policy's effective date), who receive your payment details directly; we do not.

Our pages don't load fonts, scripts, or any other resources from third-party servers — everything the page needs, including typefaces, is served directly from our own servers, so no information about your visit is sent to a font provider or similar third party.

We may also disclose information if required to do so by law, or to protect the rights, property, or safety of PDFTime, our users, or others.

6. International data transfers

[State where the company is legally established, where servers are located, and where users are expected to be, then describe the transfer mechanism if these differ (e.g. Standard Contractual Clauses). Lawyer to confirm once company jurisdiction and hosting region are finalized.]

7. Your rights and choices

• Access and download: while a file is within its retention period, you can download it using your unique download link.
• Deletion: you can delete your account at any time from your account page. This immediately and permanently deletes your account and every file you own — this cannot be undone. If you're not signed in, your files are deleted automatically at the end of the 1-hour retention period with no action needed.
• Correction: you can update your account email from your account settings.
• [Depending on applicable law, add: right to restrict or object to processing, right to data portability, right to lodge a complaint with a supervisory authority, and how to exercise these rights (e.g. contact the email in Section 10).]

8. Data security

We apply technical and organizational measures designed to protect your information, including encrypting traffic to and from our servers in transit, storing uploaded files under non-guessable identifiers rather than their original names, hashing account passwords, and hashing IP addresses used for abuse prevention rather than storing them directly. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under 16. If you believe a child has provided us with personal information, please contact us using the details in Section 10 and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify account holders by email.

11. Contact us

Questions about this Privacy Policy or your information can be sent to support@pdftime.io.