Privacy policy
Last updated October 10, 2026
This policy explains what personal data BestPDFEver collects when you use bestpdfever.com, our tools and our developer API, why we collect it, and the choices you have.
The short version
- Most tools run entirely in your browser. Your files are processed on your own device and are never sent to us.
- Some tools need our servers (Office conversions, OCR of large files, strong compression, PDF/A, password protection, HTML to PDF, PDF to Word, Excel and PowerPoint). Those files are uploaded over an encrypted connection, deleted as soon as the job has run, and the results are deleted automatically after 60 minutes.
- We don’t need an account for the free tools, we never look at your files, and we never sell them.
- The site is funded by ads. In the EEA, the UK and Switzerland, personalised ads are only shown if you agree; you can change your choice at any time.
Who is responsible
The data controller is BestPDFEver. Contact us about privacy at privacy@bestpdfever.com.
What we process and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Files you open in browser-based tools | Not received by us. Processing happens on your device. | n/a | n/a |
| Files and file names you upload to server-based tools; web addresses you give HTML to PDF | To run the tool you asked for and give you the result | Performance of a contract (Art. 6(1)(b)) | Uploads: deleted right after processing. Results and file names: deleted after 60 minutes. |
| IP address, browser type, request logs | Security, rate limiting, preventing abuse, keeping the service running | Legitimate interests (Art. 6(1)(f)) | Short-lived operational logs, normally deleted within 30 days. Logs never contain file names or contents. |
| Bot-check signals (Cloudflare Turnstile) | Stopping automated abuse of server-based tools | Legitimate interests | Processed by Cloudflare at the time of the check |
| Error reports (Sentry): error message, browser and OS, the page address without query parameters | Finding and fixing bugs | Legitimate interests | Up to 90 days. Never includes file contents. |
| Advertising identifiers and cookies (Google AdSense) | Showing ads that pay for the free tools, measuring them, and preventing ad fraud | Consent where required (EEA, UK, Switzerland); legitimate interests for non-personalised ads elsewhere | See the cookie policy |
| Developer accounts: email address, hashed API keys, API usage records, plan and subscription status | Providing the API, metering credits, billing, and account support | Performance of a contract | While your account is open, then up to 12 months; billing records as long as tax law requires |
| Payment details (Stripe) | Paying for API plans. Card details go straight to Stripe; we never see or store card numbers. | Performance of a contract; legal obligation for invoices | As required by tax and accounting law |
| Messages you send us | Answering you | Legitimate interests | As long as needed to resolve your request, then up to 24 months |
AI features
Transcription, subtitles, background removal, image upscaling, OCR and face detection use AI models that are downloaded to your browser and run on your device. Your audio, video and images are not sent to us or to any AI provider.
Information stored on your device
We store your language, theme, recently used tools and unsaved drafts (for example an invoice or résumé you are writing) in your browser so they are there when you come back. They never leave your device. Details are in the cookie policy.
Who we share data with
We use these service providers (processors), who may only use the data to provide their service to us:
- Vercel: hosting of the website
- Cloudflare: temporary file storage (R2), bot protection (Turnstile) and network delivery
- Our server and queue hosting providers: running server-based jobs (job records include file names until they expire)
- Supabase: developer account sign-in and database
- Stripe: payments and invoices for API plans
- Sentry: error monitoring
- Google: advertising (AdSense) and the consent message. Google acts as an independent controller for some ad processing; see how Google uses information from sites that use its services.
We don’t sell your personal data. We may disclose data if the law requires it, to protect our users or our service, or as part of a business transfer, in which case this policy will continue to apply.
International transfers
Some providers process data outside your country, including in the United States. Where data leaves the EEA, the UK or Switzerland, we rely on adequacy decisions (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses with the UK addendum.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time (this doesn’t affect processing before you withdrew). For advertising choices, use Privacy choices in the footer. For anything else, email privacy@bestpdfever.com. We’ll answer within one month. You can also complain to your data protection authority (in the UK, the Information Commissioner’s Office).
California residents: we don’t sell personal information for money. Personalised advertising may count as “sharing” under California law; you can opt out through Privacy choices or by enabling Global Privacy Control in your browser. You also have the right to know, delete and correct personal information, and we won’t treat you differently for using these rights.
Children
The tools are designed for a general audience and are not directed at children under 13. Developer accounts are for people aged 18 or over.
Security
All traffic is encrypted with HTTPS. Uploaded files are stored privately and can only be downloaded through short-lived signed links. API keys are stored only as salted hashes. No system is perfectly secure, so please don’t upload documents you aren’t allowed to share with a processing service.
Changes
If we change this policy, we’ll update the date at the top. If a change is significant, we’ll show a notice on the site or email developer account holders.