1. Your files
Every conversion and editing tool runs in your browser using WebAssembly and JavaScript, and the files you open in them aren't sent to our servers. The code the tools need, such as the OCR engine and its language data, is downloaded from our own site, never with your file. See How it works for how to check this in your browser's Network tab.
There are two exceptions. First, Reference Format's PDF import looks up a DOI it finds in your PDF using CrossRef's public API. Only the DOI is sent, never the PDF or its text, and CrossRef sees your IP address, as any site you connect to does. Second, Save for later in Fill & Sign, available only to signed-in accounts and only when you press it, uploads the original PDF, plus what you've placed on it (text, form entries and any signature images), to our Supabase storage so you can reopen it later. It stays there until you delete it from Fill & Sign's saved list or your account is deleted. Only your account can open it through the site.
2. Account data
Accounts are invite-only, and sign-ups aren't open. You sign in with a one-time link we email you, or with your Google or Microsoft account; we never set or store a password. If you have an account, we store your email address; your name and profile picture link if you sign in with Google or Microsoft (they send these to us) or add a display name; a two-factor authentication secret, if you turn it on; and any drafts you choose to Save for later (section 1). If you sign in with Google or Microsoft, that company also knows you used it to sign in here, under its own privacy policy. Supabase logs sign-in events, including your IP address, to keep accounts secure.
Saved signatures, recent tools and your theme and processing preferences are stored in your browser on this device, not on our servers. The Cookie Policy lists each one.
3. The waiting list
Sign-ups aren't open yet. If you join the waiting list, we store your email address, when you joined, which page you joined from, and which version of the notice under the form you saw. We don't store your name, your IP address or anything about your device with your entry. To stop abuse, the form keeps a scrambled, unreadable form of your IP address in memory for up to 10 minutes and never saves it.
We use your email address for one thing: to tell you when sign-ups open. We won't send you newsletters or other marketing, and we don't sell it or share it for anyone else's use. We rely on your consent, which you give by submitting the form, and you can withdraw it at any time.
The list is kept in our database at Supabase, which stores it for us as our processor, and the sign-ups-open email will be sent through Resend (see section 5). We delete your entry within 30 days of emailing you that sign-ups are open, and in any case no later than 12 months after you joined. To be removed sooner, email us at info@converthubcom.com and we'll delete it within 30 days. We keep your email asking to be removed as a record that we did it.
Separately, we keep a daily count of sign-ups from each page; it's numbers only, with no email addresses, so we keep it after your entry is deleted.
4. Payment information
We don't take payments yet. If we introduce paid plans, a payment processor will handle your card details, and before we take any payment we'll update this section to name it and say what we receive.
5. Who processes your data, and where
These providers host our site, store your data, send our emails, or host and filter our mailbox. Each works under data processing terms that limit what it may do with the data:
- Vercel (Vercel Inc., USA) hosts the website. Like any web host, it receives every request your browser makes to our site, including your IP address, browser details and the page address, and keeps request logs for a limited time for security and troubleshooting. It also counts our page views (section 6). Vercel may process this data in the United States and other countries where it operates, under its data processing agreement, which includes the EU Standard Contractual Clauses.
- Supabase (Supabase Pte. Ltd, Singapore) runs our sign-in and database. It holds account data, anything you choose to save to your account, and the waiting list. Our Supabase project is hosted in Tokyo, Japan. The EU and the UK both recognise Japan as giving personal data an adequate level of protection. Supabase's data processing agreement also includes the EU Standard Contractual Clauses and the UK Addendum, which cover Supabase, a Singapore company, handling the data, including any access from outside Japan.
- Resend (Plus Five Five, Inc., USA) sends our emails: sign-in links today and, later, the one-time “sign-ups are open” email. Emails are sent from Resend's EU region in Ireland, but Resend stores email data, such as the recipient address, the message and delivery logs, in the United States. Resend is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement also includes the EU Standard Contractual Clauses and the UK Addendum.
- Microsoft hosts our mailbox, info@converthubcom.com, as part of Microsoft 365, which we get through GoDaddy (GoDaddy.com, LLC, USA). If you email us, including to ask to be removed from the waiting list, your message and email address are stored by Microsoft, which may keep them in the United States or another country where it has data centres. Microsoft is certified under the EU-U.S. Data Privacy Framework, and its data processing terms include the EU Standard Contractual Clauses and, for the UK, the UK's international data transfer addendum. We keep emails for as long as we need them to answer you and to keep a record of what we did.
- Proofpoint (Proofpoint, Inc., USA) filters email sent to us for spam and malware, as part of the service GoDaddy provides, so your email passes through Proofpoint's systems in the United States before it reaches our mailbox.
6. Analytics
We count page views with Vercel Web Analytics, a service of our host, Vercel. It runs on every visit; there's no setting to turn it off. For each page you view, it records the time, the page address, the page you came from, your approximate location (country, region and city, worked out from your connection), and your browser, operating system and device type. It doesn't use cookies and doesn't store anything on your device. To tell visits apart, Vercel works out a code from your request that is valid for one day and then resets, so you can't be followed from one day to the next or across other websites. We see only totals, never individual visitors, and we never record file names, file contents or anything you type into a tool. We don't sell analytics data or share it for advertising. You can block it with a content or tracker blocker in your browser; the site works the same without it.
8. The browser extension
There's no ConvertHubcom browser extension yet. Before we release one, this section will say exactly what it can access and what it sends.
9. Data retention and deletion
We keep account data for as long as your account exists. You can't yet export your data or delete your account from your account settings, so to get a copy of your data or have your account deleted, email info@converthubcom.com and we'll do it within 30 days. Deleting your account removes your profile and your Save for later drafts. Files you only used in the tools were never sent to us, so there's nothing of them for us to delete. Saved signatures and settings stay on your device until you clear this site's data in your browser.
10. Children's privacy
ConvertHubcom is not directed at children under 13, and we do not knowingly collect account data from them.
11. Changes to this policy
If this policy changes materially, we'll update the date at the top of this page and, if you have an account, email you before the change applies.
12. Who runs ConvertHubcom
ConvertHubcom is run by one private individual as a non-commercial project (it isn't a registered company, nothing is for sale, and accounts are invite-only). That individual is the controller of the personal data described on this page, and “we” and “us” on this page mean them. Contact: info@converthubcom.com.
13. Contact
Questions about this policy, or to access, correct or delete your data or withdraw your consent: info@converthubcom.com.