Privacy Policy

1. Introduction

PDFox ("we", "our", "us") is a personal project providing a PDF document generation service. This privacy policy explains what personal data we collect when you use PDFox, why we collect it, and your rights over it.

By creating an account or using PDFox you agree to this policy. If you have any questions, please contact us at admin@pdf-fox.com.

2. What data we collect

Account data

When you sign up we collect your first name, last name, and email address. Your password is stored as a salted hash ”” we cannot read it. You may optionally provide a phone number.

Organisation data

When you create an organisation we store its name and an optional invoice email address. If you upgrade to a paid plan, Stripe stores your payment method ”” we hold only a Stripe customer ID and subscription reference; no card details pass through our servers.

Usage and log data

For security and abuse prevention we log your IP address and browser user-agent when you sign in, change your password, or perform other sensitive account actions. These entries form an audit trail stored in our database.

Generated documents

PDFs you generate are stored temporarily according to your plan's retention period (typically 30”“365 days) and then permanently deleted. The data payloads you send to generate documents are not retained after the job completes.

3. How we use your data

• Service operation ”” authenticating you, routing jobs, delivering generated PDFs.
• Billing ”” passing necessary identifiers to Stripe to process subscription payments.
• Transactional email ”” sending account verification, password reset, and payment confirmation emails.
• Security ”” detecting suspicious login activity using IP and user-agent data.
• Analytics (with consent only) ”” understanding aggregate site usage via Google Analytics 4. You can withdraw consent at any time via the cookie banner.
• Marketing (with consent only) ”” measuring campaign reach via Meta Pixel. Consent is optional and can be withdrawn.

We do not sell your data, share it with advertisers, or use it for automated decision-making that produces legal effects.

4. Cookies

We use the following cookies:

You can change or withdraw your optional cookie consent at any time by clicking the "Cookie preferences" link in the footer or by clearing your cookies.

5. Third-party services

• Stripe ”” processes subscription payments. Card data is sent directly to Stripe and never touches our servers. Stripe's privacy policy is available at stripe.com/gb/privacy.
• Cloud/object storage ”” generated PDFs and uploaded assets are stored in object storage. Data is encrypted at rest and in transit.
• SMTP / Nodemailer ”” transactional emails (verification, password reset, receipts) are sent via a configured SMTP provider.
• Google Analytics 4 ”” only loaded if you grant analytics consent. Google's privacy policy: policies.google.com/privacy.
• Meta Pixel ”” only loaded if you grant marketing consent. Meta's privacy policy: facebook.com/privacy/policy.

6. Data retention

• Session tokens ”” expire after 30 days of inactivity and are purged on logout.
• Generated PDFs ”” retained according to your plan's storage retention period, then permanently deleted.
• Audit log entries ”” retained for up to 12 months for security purposes.
• Account data ”” retained for as long as your account is active. When you delete your account, your personal data is removed from our systems within 30 days, except where we are required to retain it for legal or financial compliance reasons (e.g. billing records).

7. Your rights (GDPR / UK GDPR)

If you are located in the UK or European Economic Area, you have the following rights regarding your personal data:

• Access ”” request a copy of the personal data we hold about you.
• Rectification ”” ask us to correct inaccurate or incomplete data.
• Erasure ”” request deletion of your account and associated data. You can initiate this directly in the app at Account → Security → Delete account.
• Restriction ”” ask us to restrict processing of your data in certain circumstances.
• Portability ”” request your data in a structured, machine-readable format.
• Objection ”” object to processing based on legitimate interests, including direct marketing.

To exercise any of these rights, email admin@pdf-fox.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

8. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you by email or by displaying a notice in the application before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

9. Contact

For any privacy-related questions or requests, please contact:

PDFox
Email: admin@pdf-fox.com