Privacy — what we do with your files

Where your files are processed

PDFactory runs on a server rented from Hostinger, in its data centre in Frankfurt, Germany. Upload, conversion, analysis and export all happen on that machine. No copy is sent anywhere else.

Germany applies the GDPR and completes it with its own federal act, the BDSG (Bundesdatenschutzgesetz), on the points the European regulation leaves to member states. The country also has a legal and cultural tradition unusually attentive to privacy, and supervisory authorities — the Datenschutzbehörden, one per state plus the federal one — reckoned among the most active in Europe at enforcing the text, employers and hosting providers included. Hosting the service there is a deliberate choice.

What we receive

Only what you upload and what you type in:

the file you upload — PDF, PNG, JPEG or TIFF, 50 MB at most;
the page and the resolution you pick for the conversion;
for the geomatics module, the control points you place, the detection settings and the corrections you make to the objects;
for the legal module, the words you search for in a case file and the areas you tick for redaction. Neither is kept: they live for the length of the request.

No account is created. We ask for no name, no email address and no password. A working folder is identified by a number drawn at random, and nothing in our databases ties that number to a person.

How long we keep it

Two hours after your last action, not after the upload. Every move on a folder — placing a control point, running a detection, downloading an export — pushes its expiry back by that much. A working session is therefore never cut short, however long it runs; but a tab closed by accident stops existing two hours later, without your having to think about it.

Past that point the folder is immediately unfindable: the server answers as though it had never existed, without waiting for anything. A sweep then comes through within a quarter of an hour at the latest to take back the disk space — original file, converted image, generated exports — and delete the matching row in the database. There is no archive and no backup of these folders: once gone, they are recoverable nowhere.

You do not have to wait for the deadline: the workshop carries a “Delete this folder now” button that triggers the same deletion at once.

The phone relay — the code you show on your computer in order to photograph a document with your phone — runs on its own, shorter clock: ten minutes, with no extension possible, so that a screen photographed or projected does not stay usable afterwards. The code carries no image: your phone uploads the document by the ordinary road, and the code only tells the page in front of you which one has just arrived. The document itself is a folder like any other and follows the two-hour rule above.

A legal case file follows the same two-hour rule. Its pages are never kept as images: they are drawn on demand from your PDF, for as long as it takes to show them, and character recognition works on an image that exists only in memory. What stays on disk is your file, the text read out of it, and whatever you asked it to produce — until the deadline.

What we do with it — and what we do not

Processing is entirely local to our server. Conversion uses PyMuPDF, detection OpenCV, character recognition Tesseract — backed by PaddleOCR on the pages where it says itself that it read badly — and georeferencing and exports GDAL. Those libraries run on our machine, from models downloaded once and for all when the server was built: nothing goes out while you work.

Redaction in the legal module removes what you tick, it does not cover it: the text is deleted from the file's content and the matching pixels of the scan are rewritten. A black rectangle laid on top would leave the name readable to a copy and paste; that is not what we produce.

No third-party artificial intelligence service is called. Your documents are not sent to an external programming interface, they train no model, and they are neither resold, nor shared, nor looked at for any purpose other than running the processing you started.

Technical logs

The application log records processing events — for example “4 control points, TPS method, RMSE 2.4 m”. It holds no IP address, no file name and no document content. The access log of the reverse proxy (Traefik) is switched off: HTTP requests are not recorded.

Advertising, and where there is none

This site carries advertising, from Google AdSense, on three kinds of page: the home page, the guides, and this one. That is the entire list, and it is the list a test in our source code enforces.

While a workshop is open, nothing you loaded leaves this server. The page holding your map, your case file or your batch of receipts loads no advertising script, contacts no advertising network, and sets no advertising cookie. Google is never told that your folder exists, never receives its address, and never sees a line of what is inside it. Your document arrives in Frankfurt, is processed on our machine, and comes back — and nothing about it travels anywhere else at any point.

The three module pages — geomatics, legal, accounting — carry no advertising either, for the same reason: they are where you hand a file over.

The reasoning is short. A workshop page is open on a document you were careful not to send anywhere, and its address carries the identifier of that folder. An advertising script on that page would be handed that address, and an advertisement would render beside a client's deed or a bank statement. Neither is acceptable, and no amount of revenue makes it acceptable.

What Google receives on the three pages that do carry it

What any web request carries: your IP address, your browser and operating system, the address of the page you are reading, and the page you came from. On those pages Google also reads and writes cookies. It receives nothing else from us — no account, because there is none, and no information whatsoever about files, folders or jobs.

The tag does not stop at one address. Measured from North America on the published pages, loading one of the three contacts pagead2.googlesyndication.com, googleads.g.doubleclick.net, ep1.adtrafficquality.google, ep2.adtrafficquality.google and www.google.com — five hosts, all of them Google's.

Where a consent message applies — the European Economic Area, the United Kingdom, Switzerland, and several American states — the banner itself arrives from a sixth, fundingchoicesmessages.google.com. Which of the six you see therefore depends on where you are reading from; what does not depend on anything is that all of them stop at those three pages, and that none of them is ever loaded by a page holding your document.

The banner

Advertising means cookies, so there is now something to accept — and it appears only on the pages that carry advertising. Refusing is a real choice, not a formality: the advertising then runs without personalisation, and nothing about the service changes. Your files were never part of the question.

Checking this instead of believing it

Open your browser's developer tools, go to the network panel, and load a workshop. Filter on google. You will find nothing. Do the same on this page and you will find the advertising script. That difference is the whole of the policy — and in our source code, an advertising tag appearing on a module page or a workshop fails the test suite, so it cannot arrive there by accident.

What your browser loads

No library, typeface or icon comes from a third-party delivery network, anywhere on this site. No Google Fonts, no CDN, no analytics tag: every asset is served from pdfactory.org. That has not changed, and it holds on every page including the three above.

On every page but those three, your browser contacts no domain other than this one, including for the background map of step 1.

That background is a single vector file (OpenStreetMap data, Protomaps format) held on Cloudflare R2 storage, because it is far too large for this server's disk. But you do not talk to it: our server cuts each tile out of it itself and serves it to you. Cloudflare therefore sees our machine, never your IP address nor the area you are looking at. The map's typefaces are served straight from here.

Nor do we use the OpenStreetMap Foundation's tile servers: funded by donations for the community, their usage policy rules out commercial traffic.

Cookies

The application itself sets none and writes nothing into your browser's local storage: no session, no preference, not even the language you are reading in — that travels in the address instead.

The advertising on the home page, the guides and this page does set cookies, and that is what the banner is for. The workshop sets neither kind. The pages where your documents actually live hold no cookie at all, and there is nothing there to accept.

Your rights

The GDPR gives you rights of access, rectification, erasure, restriction and objection. In practice, since we hold no identifying data and no account exists, the right that has concrete bite here is erasure — and it is exercised without writing to us, from the workshop, in one click. As long as you hold the link to your folder, you control it; no one else can find it.

You keep the right to lodge a complaint with a supervisory authority, in Germany or in your country of residence.

Security

The site is reachable over HTTPS only, with a certificate renewed automatically. The internal services — database, queue, background tasks — publish no port to the internet: they speak only to one another, on a private network. Administrative access to the server is restricted by address filtering.

Contact

For any question or request about your data: contact@pdfactory.org. In practice, erasure does not need to go through us: the workshop's button does it at once, and without it everything disappears anyway two hours after your last action.

Changes

This page is dated. Any change to the service that would make it inaccurate — a backup added, a retention period changed, a third-party service brought in — will be written here at the same time as the change, not after.

What we receive, what we do with it, when we erase it.