Privacy Policy

1. Introduction

Welcome to PodPDF ("we", "us", "our", or "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our PDF generation platform at https://app.podpdf.com, including our web application and API services.

We operate globally using cloud infrastructure. PodPDF is built on Amazon Web Services (AWS) and serves customers worldwide. We comply with international data protection standards including GDPR and CCPA.

By using PodPDF, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Service.

This Privacy Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

2.1 Personal Information You Provide

Account Registration:

When you create an account, we collect:

• Email address (required for authentication and communication)
• Password (encrypted and stored securely via AWS Cognito)
• Display name (optional)

If you sign up or sign in with Google instead, see section 2.2 for what we receive.

Contact Form:

When you send us a message from our contact page, we store your name, email address, the topics you picked and your message, with your IP address and browser details so we can spot abuse. We use them only to reply to you and to deal with your request.

2.2 Sign in with Google

You can create a PodPDF account or sign in with your Google account. When you choose "Continue with Google", Google shares the following with us, and only after you approve it on Google's consent screen:

• Name on your Google account
• Email address on your Google account
• Google account identifier (a unique ID Google assigns to you)
• Email verification status (whether Google has verified the address)

How we use it:

• To create your PodPDF account and sign you in
• To link your Google sign-in to an existing PodPDF account that uses the same verified email address, so you keep your credits, templates and job history

We do not request or receive access to any other Google data, such as Gmail, Google Drive, Google Contacts or Calendar. We never see your Google password. Google sign-in is processed through AWS Cognito, which handles authentication for all PodPDF accounts. We do not use information received from Google for advertising and do not sell or share it with third parties.

Disconnecting Google:

• You can remove PodPDF's access at any time from your Google account at myaccount.google.com/permissions
• To delete your PodPDF account and the information we hold, use Settings > Danger Zone > Delete Account in the dashboard (see section 8.3), or email support@podpdf.com

2.3 Automatically Collected Information

When you use the Service, we automatically collect usage data, technical information, and cookies as detailed in the full Privacy Policy. For each PDF job this includes:

• What was used: the feature (for example HTML, URL, template, bulk, merge or split), which option names were set, page count, input and output size, and processing time
• How it was sent: whether the request came from the web app or the API, and the type of client derived from its User-Agent header (for example a browser, curl, Python or n8n). We do not store the full User-Agent.
• Where it came from: the website domain in the request's Origin or Referer header, and for URL-to-PDF jobs the domain of the page converted (not the full address)

2.3.1 Optional Profile Questions

After you sign in, we may ask optional questions about your industry, what you make PDFs for, your role, your company size and how you found PodPDF, and we record your time zone. You can skip them. We also note whether your email address uses a company domain or a personal mailbox provider, how you signed up (email or Google), and the billing country from your payment. We use this to understand who uses PodPDF and to improve the features they rely on. It is never sold or used for advertising.

2.4 Content You Submit

Important: Your input content (HTML, Markdown, or Images) is processed in memory and not stored persistently on our servers. It is deleted immediately after PDF generation.

3. How We Use Your Information

We use the information we collect for:

• Service Provision: Authentication, PDF generation, API access, job tracking
• Billing and Payment: Calculate charges, process payments, generate invoices
• Communication: Send service notifications, support responses, security alerts
• Service Improvement: Analytics, error tracking, feature development. This includes understanding which features are used, through the web app or the API, by what kinds of organizations (from the optional profile questions and whether an email address is a company or personal mailbox), and why people delete their accounts. We look at this in aggregate; we do not sell it or use it for advertising
• Security and Fraud Prevention: Detect unauthorized access, prevent abuse
• Legal Compliance: Comply with applicable laws and regulations

4. Data Storage and Infrastructure

We use Amazon Web Services (AWS) infrastructure for all data storage and processing. Your data is primarily stored in AWS data centers with industry-standard security.

4.3 PDF Storage and Deletion

Generated PDFs are kept for 30 days, then permanently deleted

• Generated PDFs and bulk output archives are automatically deleted 30 days after they are created
• Files you upload for bulk conversion are deleted within 24 hours of upload
• Download links are signed and expire after 1 hour; you can request a new link while the file is still retained
• No recovery: deleted files cannot be restored

5. Data Sharing and Disclosure

We never sell, rent, or trade your personal information to third parties for marketing purposes.

We may share information with:

• Service Providers (only as necessary):
  • Amazon Web Services: hosting, storage, sign-in (Cognito)
  • Google: sign in with Google, and Google Analytics on podpdf.com and in the dashboard if you allow analytics cookies (see section 6)
  • Paddle: payment processing, including your billing country
  • Vercel: hosting the website and dashboard
  • Sentry: error reports from our servers
  • Cloudflare Turnstile: checks that a message sent from our contact form comes from a person, not a bot
• Legal Requirements: When required by law or valid legal processes
• With Your Consent: When you explicitly authorize sharing

6. Cookies and Tracking Technologies

We use essential storage for session management and authentication. We do not use tracking cookies for advertising purposes.

Analytics cookies (app.podpdf.com):

• The PodPDF dashboard can use Google Analytics 4 to see which pages and features are used. It sets the cookies _ga and _ga_*, which last up to 2 years. IP addresses are anonymized, and Google signals and advertising features are turned off.
• If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics does not load until you choose Accept in the cookie notice. Choosing Decline keeps it off.
• You can change your choice at any time under Settings > Account information > Cookie preferences in the dashboard. Declining removes the Google Analytics cookies from your browser.

This website (podpdf.com):

• podpdf.com uses Google Analytics 4 to count page views and see which pages are read. It sets the cookies _ga and _ga_*, which last up to 2 years. IP addresses are anonymized, and Google signals and advertising features are turned off.
• If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics does not load until you choose Accept in the cookie notice. Choosing Decline keeps it off and removes its cookies.
• You can change your choice at any time with Cookie preferences at the bottom of any page.

7. Data Security

We implement industry-standard security measures including HTTPS/TLS encryption, AWS security infrastructure, and secure password hashing. However, no method of transmission over the Internet is 100% secure.

8. Your Privacy Rights

8.1 Rights Under GDPR (European Users)

If you are in the European Economic Area, you have rights to:

• Access your personal information
• Rectify inaccurate information
• Request erasure ("right to be forgotten")
• Data portability
• Object to processing
• Withdraw consent

8.2 Rights Under CCPA (California Users)

California residents have rights to know, delete, and opt-out of sale of personal information (we do not sell personal information).

8.3 Deleting Your Account

You can delete your account yourself under Settings > Danger Zone > Delete Account. You are signed out immediately and can no longer sign in. You may tell us why you are leaving; this is optional. Deletion normally finishes within a few minutes:

• Deleted: your sign-in, account record, email address and name, onboarding answers, API keys, webhooks and their delivery history, saved templates and uploaded template images, and stored PDFs and output files
• Anonymized and kept: records of past PDF jobs (feature used, page count, sizes, timing) and payment records we must keep for accounting and tax. These are relinked to a random identifier and have file names, storage keys, webhook addresses and error messages removed, so they no longer identify you
• Anonymous deletion record: to understand why people leave we keep a summary with no email, name, domain or account ID: the month the account was created, plan, industry and use case (if you answered), billing country, usage totals, unused credits and the reason you gave
• Any active subscription is cancelled and its remaining allowance is forfeited. Remaining credits are forfeited and not refunded

8.4 Exercising Your Rights

To exercise any of these rights, email us at support@podpdf.com. We will respond within 30 days.

9. International Data Transfers

We operate globally using cloud infrastructure and welcome customers from around the world. Your data is processed using AWS global infrastructure with appropriate safeguards for international data transfers.

10. Children's Privacy

PodPDF is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13.

11. Data Retention

• Generated PDFs: Stored for 30 days, then automatically deleted
• Input Content: Not stored persistently, deleted immediately after processing. Bulk upload archives are stored only until conversion finishes and are deleted within 24 hours
• Job Metadata: Retained indefinitely. When you delete your account it is anonymized as described in section 8.3
• Account Information and Profile Answers: Retained while your account is active and deleted when you delete your account
• Payment Records: Retained as required for accounting and tax, and anonymized when you delete your account
• Anonymous Deletion Records: Retained indefinitely; they contain no information that identifies you
• Google Analytics Data: Kept by Google according to the retention setting of our Google Analytics property

12. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. We will notify you of material changes via email at least 14 days before they take effect.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy:

Email: support@podpdf.com
Website: https://app.podpdf.com

Company Information:

PodPDF is operated by XAD LABS (PVT) LTD, registered in Sri Lanka.

14. Compliance and Certifications

We comply with:

• GDPR: General Data Protection Regulation for EEA users
• CCPA: California Consumer Privacy Act for California residents
• AWS Security Standards: ISO 27001, SOC 2, PCI DSS Level 1