Privacy Policy

This policy explains, in plain language, the small amount of data the site does touch, why, and the rights you have over it.

Who we are

PDF & Image Tools (pdfandimagetools.com) provides free, browser-based tools to compress, convert, edit, and remove backgrounds from PDFs and images. The site is built and run by Swathik, an independent solo developer based in India, who is the "controller" of the limited personal data described in this policy for the purposes of data protection law. You can reach us any time at hello@pdfandimagetools.com.

We are based in India, outside the EEA and UK. Because our processing of personal data from visitors in the EEA and UK is limited, consent-gated, low-risk, and involves no special-category data, we have not appointed a representative under Article 27 of the GDPR or UK GDPR. If you are in the EEA or UK, you can contact us directly at hello@pdfandimagetools.com, and you may also complain to your local data protection authority.

Your files never leave your device

This is the heart of how the site works, so it comes first.

Every tool on this site runs locally in your browser using JavaScript and WebAssembly. When you compress, convert, edit, merge, sign, or remove a background from a file, that work happens on your own device. Your files are never uploaded to our servers, never stored, never transmitted, and are never accessible to us or to any third party. When you close the tab, the files you were working on are gone from memory.

Because of this, we cannot see, read, recover, or hand over your files. As far as your files are concerned, there is nothing to see, nothing to leak, and nothing anyone could compel us to produce, because we never have them. (The small amount of technical data described below, such as transient server logs, exists like on any website and is subject to law like anything else.) This is true for every tool on the site, and it will remain true even if the site later shows advertising.

What we do not do

• We do not require an account, sign-up, login, name, or email to use the tools.
• We do not upload or store your files. Ever.
• We do not sell or share personal data for money or anything else of value.
• We do not build advertising or behavioural profiles about you.
• We do not track you across other websites.
• We do not run analytics unless you opt in.

The small amount of data we do process

Running a real website means a few things still happen. Here is the complete list.

1. Analytics, only with your consent

We use Google Analytics 4 (measurement ID G-6VH9WWRM68) to understand, in aggregate, which tools people use and where visitors come from, so we can improve the site.

• Analytics is off by default. We use Google Consent Mode v2 in its basic implementation: the Google Analytics script is not loaded at all until you consent.
• It loads only if you click Accept on the cookie banner. If you reject, or simply ignore the banner, the analytics script never loads, no analytics cookies are set, and nothing is sent to Google, not even anonymised or "cookieless" signals.
• If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out and analytics stays off.
• When enabled, it collects aggregate usage data: pages viewed, approximate location derived from your IP address (Google Analytics 4 does not log or store full IP addresses), device and browser type, and how you found the site.
• We do not use analytics data for advertising personalisation, and we do not link it to your identity (we couldn't: we have no accounts).

Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time via the "Cookie settings" link in the footer, and the site keeps working exactly the same. More detail is in our Cookie Policy.

2. Server logs

Like any website, our hosting provider, Vercel, processes basic technical information needed to deliver pages to you and keep the site secure: your IP address, browser type (user-agent), and the pages requested. These logs are transient, used for security and operational purposes only, and are retained for a short period. Your files are never part of these logs because they are never sent.

Legal basis: our legitimate interest in keeping the site secure and operational (GDPR Article 6(1)(f)).

3. Emails you send us

If you email hello@pdfandimagetools.com, we receive your email address and whatever you write. We use it only to reply, and we keep the correspondence only as long as needed to handle your query.

Legal basis: our legitimate interest in responding to you (GDPR Article 6(1)(f)).

4. Data stored on your own device

A small amount of data is saved locally in your browser to make the site work well: your theme preference (light or dark), your cookie-consent choice, your few most recent in-site searches (so the search box can show them again), and small functional flags such as whether a tool has finished loading its model once. This stays on your device, is not used to track you, is never sent to us, and you can clear it any time through your browser settings.

These on-device items are everything we store, and none of them are sent to us.

Third parties we work with

We use a small number of service providers ("processors"), each for a narrow purpose:

About Pexels. The Background Remover lets you browse free stock photos from Pexels to use as a new background. When you search, your search term (for example, "beach") is relayed through our own server to the Pexels API, so the request to Pexels comes from us, not directly from you. The stock photos you see are then loaded by your browser from Pexels' image servers, which means Pexels receives standard web-request information (such as your IP address) for those image downloads, just as when any website loads an image. Your own photos are never involved in any of this. They never leave your browser, and neither Pexels nor we ever see them. Pexels' own privacy policy is at pexels.com/privacy-policy.

We do not have, and do not want, any other data partners. If that ever changes, this policy will be updated first.

International data transfers

The site is available worldwide. Our providers (Vercel and, if you opt in, Google) may process the limited technical data described above on servers outside your country, including in the United States. Where data leaves the EEA or UK, these providers rely on recognised safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Your files are not affected by any of this: they never leave your device, so they are never transferred anywhere.

How long we keep data

• Your files: never held, so never retained. They exist only in your browser's memory while you work.
• Server logs: retained transiently by Vercel for security and operations (a short period).
• Analytics data (if you opted in): retained in Google Analytics for 2 months, then deleted.
• Emails: kept only as long as needed to handle your query, then deleted.
• Theme and consent preferences: stored on your own device until you clear them.

Your rights

Depending on where you live, you have legal rights over your personal data. We extend the same rights to everyone, regardless of location.

If you are in India (Digital Personal Data Protection Act, 2023), you have the right to access a summary of your personal data and how it has been processed, to correct or erase it, to grievance redressal, and to nominate another person to exercise your rights if you are unable to. Consent for analytics is requested through the cookie banner in clear, plain language, and you can withdraw it as easily as you gave it via "Cookie settings" in the footer. For any grievance under the DPDP Act, contact our grievance redressal contact at hello@pdfandimagetools.com; we will acknowledge and respond within the timelines prescribed under the Act and its Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If you are in the EEA or UK (GDPR / UK GDPR), you have the right to access, correct, or delete your personal data, restrict or object to processing, data portability, and the right to withdraw consent at any time (withdrawing consent does not affect processing that happened before). You also have the right to complain to your local data protection authority.

If you are in California or another US state with a privacy law (CCPA/CPRA and similar), you have the right to know what personal information we collect, to access it, to correct it, to delete it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those laws define it, so there is nothing to opt out of, but we honour the Global Privacy Control signal as a valid opt-out anyway. We will never discriminate against you for exercising any right.

If you are in Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), or anywhere else with a data protection law, the same applies: you can ask us what we hold about you, ask us to correct or delete it, and withdraw consent for analytics at any time. Because we extend identical rights to everyone, you do not need to work out which law applies to you before writing to us.

An honest practical note: because we hold almost no personal data (no accounts, no stored files, no profiles), most requests are trivially satisfied. If you ask us what we have on you, the answer in nearly every case is: nothing we can connect to you. Analytics data, where it exists, is aggregate and not tied to your identity. If you opted in to analytics and want that data gone, withdrawing consent via "Cookie settings" stops collection immediately, and the data already collected expires on the retention schedule above.

To exercise any right, email hello@pdfandimagetools.com. We will respond within the timeframe required by the applicable law (for example, one month under GDPR, 45 days under CCPA/CPRA, and the timelines prescribed under India's DPDP Act and Rules). We may need to ask a reasonable clarifying question to act on your request, but since we have no accounts, we will never demand identity documents to answer "what do you have on me?".

Global Privacy Control

If your browser or an extension sends the Global Privacy Control (GPC) signal, we honour it automatically: analytics stays disabled, with no banner interaction needed. GPC is treated as a valid opt-out of any sale or sharing of personal information under applicable US state laws (and, as stated above, we don't sell or share regardless).

Children

The site is a general-purpose utility and is not directed at children under 13 (or the higher age, up to 16, that applies in some regions). We do not knowingly collect personal information from children. Since the tools need no account and the files stay on the device, there is no mechanism by which we would collect it. If you believe a child has somehow provided us personal information (for example, by email), contact us and we will delete it.

Advertising (forward-looking)

To keep the tools free, the site may in future display advertising. If and when it does:

• Ads would be served by third-party advertising partners, who may use cookies or similar technologies to deliver and measure ads. Any such cookies will be covered by the consent banner and listed in the Cookie Policy before they appear.
• Your files will remain absolutely private. They are never shared with advertisers and never leave your device. Nothing about the local-processing model changes when ads are shown.
• We will not give advertisers your personal information.

This section exists so the policy is honest about the future, not because ads are running today. If ads launch, this page will be updated with the specific partners before they go live.

Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new effective date above. Material changes (such as introducing advertising or a new third party) will be reflected here before they take effect.

Contact

Questions, concerns, or requests? Email us at hello@pdfandimagetools.com. A real person reads it.