Privacy Policy
Your files never leave your browser.
pdfmundo processes all PDF files locally using WebAssembly (WASM). No file data is ever transmitted to our servers or any third party. This is not just a policy — it is a technical fact of how the software works.
1. Who We Are
pdfmundo ("we", "us", "our") is a browser-based PDF processing tool available at pdfmundo.com. The service is operated by ADVAITA OÜ, a private limited company (osaühing) registered in Estonia under registry code 17568302.
ADVAITA OÜ is the data controller for personal data processed through the service. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
Registered office: Sepapaja tn 6, 15551 Tallinn, Estonia
Contact: [email protected]
2. What Data We Collect
| Data Type | Collected? | Details |
|---|---|---|
| PDF file content | NEVER | All file processing happens locally in your browser via WASM. Files are not transmitted anywhere. |
| File names | NEVER | File names are displayed in the UI. If you drop a file on the homepage, it is held briefly on your device so the tool you pick can open it (see What's stored on your device). File names are never logged on our servers or sent to us. |
| Conversion history | NEVER | We do not record which files you processed or when. |
| Payment data | Via Lemon Squeezy only | Lemon Squeezy is the seller of your purchase and a separate controller of the payment data you give it. We receive a plan status confirmation only — never card numbers or billing details. |
| IP address | Not stored by us | Cloudflare, our host, processes request metadata (IP, User-Agent, URL, timestamp) to deliver pages and protect the service. We do not log or store IP addresses ourselves. |
| Email address | Only if you write to us | If you contact support, we use your email address solely to respond. When you buy a plan, you give your email address to Lemon Squeezy, not to this site; we see it in Lemon Squeezy's records only when we handle a support or refund request for you. |
3. How We Use Your Data
The minimal data we collect is used solely to:
- Operate the conversion service and enforce fair-use limits
- Process and manage your subscription via Lemon Squeezy
- Respond to support enquiries
- Comply with legal obligations
4. What We Do Not Do
- We do not sell your data to anyone
- We do not share your data with third parties except as described in this policy
- We do not run advertising networks or sell ad placements
- We do not use analytics tools of any kind
- We do not build user profiles or track behaviour across websites
- We do not store your PDF files, even temporarily on a server
Everything we store on your device is strictly necessary for a function you asked for, which is exempt from the consent requirement under Article 5(3) of Directive 2002/58/EC. Each item is listed on What's stored on your device.
5. Third-Party Services
- Lemon Squeezy, LLC — a separate controller, not our processor. They are the seller of record for your purchase: they take the payment, hold your card details — we never receive them — and issue your invoice. For that payment data they decide their own purposes and means, so their privacy policy governs it, not this one.
Separately, when you activate a licence key on this site — and, for Credits, each time you spend a credit — our server sends that key to Lemon Squeezy to be checked. Lemon Squeezy's reply includes details of the purchase, including the email address it is registered to; our server uses only the plan, its expiry and any remaining credits, discards the rest, and stores nothing. The check does tell Lemon Squeezy when your key was used. Your IP address is not passed to them: the request comes from our server, not from your browser. - Cloudflare Pages — hosting infrastructure and CDN. Cloudflare processes request metadata (IP, User-Agent, URL, timestamp) for security and routing. Subject to Cloudflare's Privacy Policy.
6. Legal Basis for Processing (GDPR)
- Contract — processing necessary to provide the service you subscribed to
- Legitimate interests — security, abuse prevention, and CDN routing
- Consent — if you provide your email for support
- Legal obligation — where required by applicable law
7. Your Rights (GDPR / EU Users)
- Access — request a copy of data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — request deletion of your data ("right to be forgotten")
- Restriction — request we limit how we process your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where we rely on your consent, you may withdraw it at any time; this does not affect processing carried out before you withdrew
- Complaint — you may lodge a complaint with a supervisory authority (Article 77 GDPR). Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. You may also complain to the authority where you live or work.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
8. Data Retention
- Licence state: held only in your browser (see What's stored on your device); we keep no account record on our servers
- Support emails: retained for 12 months then deleted
- Payment records: retained as required by Lemon Squeezy and applicable tax law
- Cloudflare logs: per Cloudflare's own retention policy; we do not have direct access on the Free plan
9. International Data Transfers
Because all file processing happens locally in your browser, no file content is ever sent to us or to anyone else. For the limited personal data we do handle: request metadata (such as IP address and server logs) is processed by our infrastructure provider Cloudflare as our processor, and any transfer outside the EEA is made under the European Commission's Standard Contractual Clauses (Article 46 GDPR). Payments are handled by Lemon Squeezy, which acts as the merchant of record and seller for your purchase and as an independent controller of the payment data you provide to it; that data is governed by Lemon Squeezy's own privacy policy. ADVAITA OÜ is established in Estonia and acts as an EU-based controller for the data described in this policy.
10. Children's Privacy
pdfmundo is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy occasionally. Material changes will be noted with an updated date at the top of this page. Continued use of pdfmundo after changes constitutes acceptance of the updated policy.
12. Contact
[email protected] · Response within 30 days