Privacy Policy

1. Introduction

This Privacy Policy describes how Workollab LLC ("we", "us", "our") collects, uses, and protects information when you use the PDFjet API and free web tools ("Service") at pdfjet.dev.

2. Information We Collect

Account Information

When you create an account, we collect your email address and optional profile information (name, company). This is stored in our authentication system and used to identify your account.

Usage Data

We track API usage per key, including: number of pages processed, operation type (extract, convert, merge, split, encrypt), filenames, and timestamps. This data powers your dashboard analytics and enforces plan limits.

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers or full payment details. We retain your Stripe customer ID to manage your subscription.

Server Logs

We collect standard server logs including IP addresses, request paths, user agents, and response codes for security monitoring and debugging purposes.

3. File Processing

We do not store your files. Files you upload (via the API or the free web tools) are:

Processed in memory or via temporary files on the server
Deleted immediately after the result is returned in the response
Never written to persistent storage, backed up, or shared with third parties
Never accessed, read, or analyzed by our team beyond what is technically required to perform the requested operation

Temporary files exist only for the duration of the API request (typically seconds).

Optional AI Processing (Premium)

Our optional Premium AI feature (the /extract/premium endpoint and Premium previews) sends the relevant page content of your document to a third-party AI provider solely to perform the requested reconstruction. This happens only when you explicitly use a Premium feature; standard extraction and conversion are processed entirely on our own infrastructure and are never sent to third-party AI services. We do not retain this content after processing.

4. How We Use Information

We use collected information to:

Provide and maintain the Service
Enforce usage limits and plan restrictions
Process payments and manage subscriptions
Send transactional emails (welcome email, API key delivery)
Monitor for abuse, security threats, and Service health
Improve the Service based on aggregate usage patterns

5. Data Sharing & Third-Party Processors

We do not sell your personal information. We share data only with the following service providers, each acting as a data processor on our behalf:

Stripe (San Francisco, CA) — payment processing. Stripe receives your payment details directly; we never see or store your full card number. Stripe Privacy Policy
Logto (self-hosted) — authentication and identity management. Stores your email, profile fields, and login credentials on our infrastructure.
Brevo (Paris, France) — transactional email delivery (sign-in codes, account notifications). Receives your email address only. Brevo Privacy Policy
Cloudflare (San Francisco, CA) — CDN, DDoS protection, and DNS. Processes IP addresses and request metadata in transit. Cloudflare Privacy Policy
Hetzner (Gunzenhausen, Germany) — server infrastructure hosting. All application data resides on Hetzner servers within the EU. Hetzner Privacy Policy
Law enforcement — only when required by valid legal process

6. Data Security

We implement reasonable security measures including:

All traffic encrypted via TLS (HTTPS)
API keys hashed in storage and transmitted only at creation
Rate limiting and IP-based abuse protection
Secrets managed via encrypted vault
Containers run as non-root users with minimal privileges

7. Data Retention

Account data: retained until you delete your account
Usage logs: retained for 90 days for analytics, then aggregated
Server logs: retained for 30 days
Uploaded files: not retained (deleted immediately after processing)

8. Your Rights

Regardless of your location, you have the right to:

Access your personal data via the dashboard and profile endpoints
Update or correct your profile information
Delete your account and all associated data by contacting support
Export your usage data (CSV export available in dashboard)
Revoke API keys at any time from the dashboard

For EEA/UK Residents (GDPR)

We process your data under the following legal bases:

Contract performance — to provide the Service you signed up for
Legitimate interest — for security monitoring, abuse prevention, and service improvement
Legal obligation — to comply with applicable laws

You additionally have the right to: data portability, restriction of processing, objection to processing based on legitimate interest, and lodging a complaint with your local data protection authority. Your data is hosted on Hetzner infrastructure in Germany (EU). To exercise any right, email [email protected]. We will respond within 30 days.

For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act, you have the right to:

Know what personal information we collect, use, and disclose
Delete your personal information
Opt out of the sale or sharing of personal information — we do not sell or share your data for advertising
Non-discrimination — we will not deny you service or charge different prices for exercising your rights

To submit a request, email [email protected]. We will verify your identity and respond within 45 days.

9. Cookies

The Service uses only essential session cookies for authentication. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

10. Children's Privacy

The Service is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the dashboard. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact

For privacy-related questions or requests, contact us at [email protected].