Privacy Policy
Your privacy is important to us. This Privacy Policy explains how PDF Genius
(operated by the PDF Genius team) collects, uses, and protects your personal information.
1. Information We Collect
Personal Information: We collect minimal personal information, including email addresses and an optional display name for account creation, user preferences, and customer support communications.
File Information: Some tools process locally; others upload files for processing. Converted files are available to download for 24 hours. A scheduled cleanup job periodically deletes stored results older than 24 hours.
Camera and Photos: File handling depends on the tool you choose. Some tools process locally; others upload files for processing.
Usage Data: We collect anonymous usage statistics, including conversion types, file sizes, processing times, and general usage patterns to improve our services.
Purchase Information: When you buy a subscription or credit pack through the app, we receive purchase history (the products you bought and their status) from the app store so we can activate your plan or credits. Payment card details are handled entirely by the app store (Google Play or Apple) and are never collected or stored by us.
Technical Information: We automatically collect IP addresses, browser types, device identifiers, and referral URLs for security, fraud prevention, analytics, and service optimization.
Account Information: For registered users, we store account credentials, preferences, subscription status, credit balance, and basic profile information.
Education Zone (website): When you generate a quiz or flashcards, selected document text is sent to the configured AI provider to create study material. PDF Genius processes uploaded education PDFs and extracted text in memory and does not store them. The AI provider has its own retention policies, including any abuse-monitoring logs; do not upload confidential material. Daily limits store only a keyed IP hash, date and count. Expired quota records are purged on subsequent generation requests.
Saved study decks: Flashcard decks and progress stay in your browser until you use “Clear saved deck” or clear site data. Education analytics record activity types and tool names, not your documents or study text.
2. How We Use Your Information
Service Provision: To provide PDF conversion and document processing services, including file format conversion, merging, splitting, and optimization.
Account Management: To create and manage user accounts, authenticate users, and provide personalized service experiences.
Communication: To send important service notifications, security alerts, and respond to customer support inquiries.
Service Improvement: To analyze usage patterns, identify technical issues, and enhance our platform's performance and features.
Security: To detect and prevent fraudulent activities, unauthorized access, and ensure platform security.
Legal Compliance: To comply with applicable laws, regulations, and legal processes when required.
3. File Processing and Storage
File Processing: Some tools process locally; others upload files to the server.
Storage and Cleanup: Converted files are available to download for 24 hours. A scheduled cleanup job periodically deletes stored results older than 24 hours. Optional image-editor uploads are held in server memory for 60 minutes, then removed.
Processing Purpose: Files are accessed only for the specific conversion or processing task requested and are not used for any other purpose.
Server Security: Our processing servers are secured with encryption, access controls, and regular security monitoring.
File Limitations: We may impose reasonable file size and processing time limits to ensure optimal service performance for all users.
4. Data Security Measures
Encryption in Transit: All data transmission between your device and our servers is encrypted using SSL/TLS protocols (HTTPS).
File Cleanup: Converted files are available to download for 24 hours. A scheduled cleanup job periodically deletes stored results older than 24 hours.
6. Third-Party Services
Payment Processing (Web): Subscriptions and credit packs purchased on our website are sold and billed by our authorised reseller and Merchant of Record, Paddle.com Market Limited ("Paddle") or Dodo Payments. As the seller of record, the Merchant of Record collects and processes your billing details (such as name, billing address, and payment card information) and handles taxes, invoicing, and refunds under its own privacy policy. We never receive or store your full payment card details; we only receive confirmation of your purchase and subscription status so we can activate your plan or credits.
Payment Processing (Mobile): In-app subscriptions and credit packs are sold and billed through the official app stores (Google Play Billing and Apple App Store), which process all payment details under their own privacy policies. We use RevenueCat as our purchase-management provider to verify purchases and activate your plan or credits; it acts as our data processor and receives only the purchase and device identifiers needed for that purpose.
Usage Statistics: The service records its own conversion and usage records (for example tool, status and file size) to show your history and enforce plan limits. The web app does not add third-party advertising or cross-app tracking SDKs of its own.
Support: If you email us, we receive the message and address you send from, and use them to reply.
Image AI Tools: Image tools that use AI (for example upscaling or background removal) send the selected image to the configured provider, such as Replicate or remove.bg, to produce the result. Those providers have their own data policies, which may differ from ours. Our 24-hour deletion of results applies to files we store and does not state or control how long those providers retain data.
Hosting: The service runs on third-party hosting infrastructure, so files and data you submit are processed there.
Data Sharing: We do not sell your personal data. Files are sent to third parties only where a tool needs them, as described above.
7. Data Retention
File Retention: Converted files are available to download for 24 hours. A scheduled cleanup job periodically deletes stored results older than 24 hours. Optional image-editor uploads are held in server memory for 60 minutes, then removed.
Account Information: Account data is retained while your account is active and for a reasonable period after account closure to comply with legal obligations.
Usage Analytics: Anonymous usage statistics may be retained for service improvement purposes, with personal identifiers removed.
Legal Requirements: We may retain certain data longer when required by law, legal processes, or legitimate business purposes.
Data Deletion: Upon account deletion, personal information is removed within 30 days, except where retention is legally required.
Backup Systems: Data in backup systems is subject to the same deletion schedules, though technical limitations may cause brief delays.
8. Your Privacy Rights
Access Rights: You can request access to the personal information we hold about you and receive details about how it's processed.
Correction Rights: You may request correction of inaccurate or incomplete personal information in your account settings or by contacting us.
Deletion Rights: You can request deletion of your personal information, subject to legal retention requirements and legitimate business needs.
Portability Rights: You may request your personal data in a portable format to transfer to another service provider.
Objection Rights: You can object to certain types of data processing, including direct marketing communications.
Withdrawal of Consent: Where processing is based on consent, you may withdraw consent at any time without affecting lawfulness of prior processing.
9. GDPR Compliance
Legal Basis: We process personal data based on legitimate interests for service provision, contractual necessity for account management, and consent for marketing communications.
Data Minimization: We collect only the minimum personal data necessary to provide our services effectively.
Purpose Limitation: Personal data is used only for the specific purposes for which it was collected or compatible purposes.
Data Protection Officer: We have designated data protection responsibilities to ensure GDPR compliance across all operations.
Impact Assessments: We conduct privacy impact assessments for high-risk processing activities to protect individual rights.
Breach Notification: We have procedures to detect, report, and investigate personal data breaches within required timeframes.
10. Children's Privacy
Age Requirements: Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.
Parental Consent: If we discover we have collected information from a child under 16 without parental consent, we will delete such information immediately.
Educational Use: Educational institutions may use our services for students over 16 with appropriate permissions and supervision.
Reporting: Parents or guardians who believe we have collected information from a child under 16 should contact us immediately.
Account Restrictions: Users must confirm they are at least 16 years old during account creation.
11. International Transfers
Data Location: Your data may be processed and stored in countries outside the UK/EU where our service providers operate.
Transfer Safeguards: All international transfers are protected by appropriate safeguards, including adequacy decisions, standard contractual clauses, or other approved mechanisms.
Security Standards: International service providers must meet equivalent data protection and security standards as required in the UK/EU.
Legal Protections: Transfer agreements include strong data protection clauses and rights for data subjects.
Minimized Transfers: We minimize international transfers and ensure they occur only when necessary for service provision.
12. Data Breach Notification
Detection Systems: We maintain monitoring systems to detect potential security incidents and data breaches promptly.
Response Procedures: We have established incident response procedures to contain, assess, and resolve security breaches effectively.
Regulatory Notification: We will notify relevant authorities within 72 hours of becoming aware of a breach that poses risks to individual rights and freedoms.
User Notification: Affected users will be notified without undue delay if a breach is likely to result in high risk to their rights and freedoms.
Documentation: All security incidents are documented with details of the breach, impact assessment, and remediation actions taken.
Prevention Measures: We continuously improve security measures based on incident learnings and emerging threats.
13. Contact for Privacy Concerns
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Company: PDF Genius
Service: PDF Genius
Phone: +447429919748
Location: London, United Kingdom
Privacy Inquiries: Please contact us through our website contact form
Response Time: We aim to respond to privacy inquiries within 30 days of receipt.
Regulatory Contact: You also have the right to contact the Information Commissioner's Office (ICO) in the UK regarding privacy concerns.
14. Changes to Privacy Policy
Policy Updates: We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service features.
Notification Methods: Significant changes will be communicated through email notifications to registered users and prominent notices on our website.
Advance Notice: Material changes will be announced at least 30 days before taking effect to allow you to review and understand the changes.
Continued Use: Your continued use of our services after policy changes take effect constitutes acceptance of the updated Privacy Policy.
Objection Rights: If you disagree with policy changes, you may close your account before the changes take effect.
Version Control: We maintain version history of policy changes with effective dates for transparency.
15. Effective Date
Current Version: This Privacy Policy is effective as of June 25, 2026, and applies to all information collected on or after this date.
Previous Versions: This policy supersedes all previous versions of our privacy statements and policies.
Retroactive Application: Changes to this policy apply only to information collected after the effective date, unless otherwise specified.
Regular Reviews: We review and update this policy regularly to ensure it remains current with legal requirements and best practices.
Contact for Clarification: If you have questions about when specific provisions became effective, please contact us for clarification.
Document Version: 1.0
Last Updated: June 25, 2026
Effective Date: June 25, 2026