Privacy Policy

1. Introduction

ImgToPDFConvert ("we," "our," or "us") operates the website imgtopdfconvert.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, how long we keep it, and what rights you have over it. By using the Service you agree to the practices described here. If you do not agree, please stop using the Service and contact us to request deletion of any data we hold.

2. Information We Collect

We collect only the information needed to operate the Service:

2.1 Account Information

When you create an account we collect your name, email address, and a password (stored as an irreversible bcrypt hash). If you sign in with Google OAuth, we receive your name, email address, and profile picture from Google — we do not receive or store your Google password.

2.2 Files You Upload

Files you submit for conversion are held in server memory for the duration of the conversion request. They are never written to disk, never backed up, and never retained after the HTTP response is returned. We do not view, analyse, index, or share the content of your files.

2.3 Conversion Metadata

For signed-in users we record metadata about each conversion — conversion type, file size, timestamp, and status — so you can review your history on the dashboard. This metadata never includes the actual file content.

2.4 Payment Information

Premium subscriptions are processed by Stripe, Razorpay, or PayPal depending on your region. We never receive, transmit, or store your full credit-card or bank-account number. We store only the provider's customer ID, subscription ID, plan type, and billing-period dates so we can verify your subscription status.

2.5 Usage & Analytics Data

We use privacy-focused analytics to understand how the Service is used. The providers we use are:

• Vercel Analytics — anonymous, aggregate page-view and performance metrics.
• Google Analytics 4 (GA4) — page views, session duration, and traffic sources. Google may set cookies; see our Cookie Policy for details.
• Microsoft Clarity — session replays and heatmaps (personal data is masked).
• PostHog — product-usage events for feature improvement.

Each provider is loaded only when its environment variable is configured. We do not sell analytics data to third parties.

2.6 Cookies

We use cookies for authentication (keeping you signed in) and for third-party analytics and advertising where applicable. For a full breakdown of cookie types and how to manage them, see our Cookie Policy.

3. How We Use Your Information

• To provide, maintain, and improve the file-conversion services.
• To create and manage your account and subscription.
• To enforce usage limits (daily conversion count, file-size caps) and prevent abuse.
• To process payments and issue invoices via our payment providers.
• To send transactional communications — subscription confirmations, password resets, email verifications, and service-critical alerts.
• To analyse aggregate usage patterns so we can add new tools and improve existing ones.
• To display advertising via Google AdSense on free-tier pages (Premium subscribers see no ads).
• To respond to support requests and legal obligations.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or a jurisdiction with similar data-protection laws, we process your data under the following legal bases:

• Contract performance — processing needed to provide you with the conversion service and manage your account.
• Legitimate interest — analytics, fraud prevention, and service improvement, balanced against your privacy rights.
• Consent — advertising cookies and personalised ads (you can withdraw consent at any time via your browser settings).
• Legal obligation — complying with applicable laws, regulations, or court orders.

5. Data Retention

• Uploaded files: Deleted from memory immediately after conversion. Never persisted to disk.
• Conversion metadata: Retained for the lifetime of your account so it appears in your dashboard history.
• Account data: Retained as long as your account is active. You may request deletion at any time.
• Payment records: Retained as required by applicable tax and financial regulations (typically 7 years) even after account deletion.
• Analytics data: Retained in aggregate, anonymised form according to each provider's retention policy.

6. Third-Party Services

We share data with the following categories of third-party service providers, each under contractual obligations to protect your data:

• Hosting: Vercel (application hosting, CDN, edge functions).
• Database: Supabase (PostgreSQL database hosting for account and subscription data).
• Payments: Stripe (global), Razorpay (India), PayPal (fallback) — each handles card data directly under PCI DSS compliance.
• Authentication: Google (OAuth sign-in).
• Analytics: Vercel Analytics, Google Analytics 4, Microsoft Clarity, PostHog.
• Advertising: Google AdSense (displayed to free-tier users only).
• Email: Resend (transactional emails — verification, password reset, subscription notifications).

We encourage you to review each provider's privacy policy. We do not sell your personal data to any third party.

7. Advertising

We display ads via Google AdSense on pages served to free-tier users. Google may use cookies and similar technologies to serve ads based on your prior visits to our site and other websites. You can opt out of personalised advertising by visiting Google's Ads Settings. Premium subscribers do not see any advertisements.

8. Data Security

We implement industry-standard security measures to protect your information:

• All traffic is encrypted via HTTPS/TLS.
• Passwords are stored as irreversible bcrypt hashes — we cannot read them.
• Payment card data is handled entirely by PCI-DSS-compliant processors (Stripe, Razorpay, PayPal).
• Authentication sessions use signed, HTTP-only, secure cookies with short expiry.
• Server infrastructure is managed by Vercel with automatic patching, DDoS mitigation, and network isolation.

No method of electronic transmission or storage is 100 % secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Data Transfers

Our servers and third-party providers may process data outside your country of residence, including in the United States. Where required, transfers are protected by Standard Contractual Clauses (SCCs) or the provider's participation in an approved certification framework.

10. Your Rights

Depending on your location, you may have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your account and associated personal data.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest or direct marketing.
• Withdraw consent — where processing is based on consent (e.g., advertising cookies), you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email contact@imgtopdfconvert.com. We will respond within 30 days (or sooner if required by law).

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights, including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the "sale" of personal information. We do not sell personal information as defined under the CCPA. To make a request, contact us at contact@imgtopdfconvert.com.

12. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Do Not Track

Some browsers send a "Do Not Track" (DNT) signal. There is currently no industry standard for how websites should respond to DNT. We do not currently alter our data-collection practices in response to DNT signals, but you can manage cookies and tracking through your browser settings or our Cookie Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. For material changes, we may also notify you by email or through an in-app notice. Continued use of the Service after the revised policy is posted constitutes your acceptance of the changes.

15. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

ImgToPDFConvert
Email: contact@imgtopdfconvert.com
Website: imgtopdfconvert.com