Privacy Policy

Last updated: October 8, 2026

This policy explains what personal data pdfly (pdfly.host) collects, why, and what your rights are. The data controller is pdfly, Albania, Rruga e Kavajes, Kompleksi Delijorgji, Tirane.. Contact: contact@pdfly.host.

What we collect

Account details: the name or company and the email address you sign up with.
API key: stored only as a one-way hash, so even we can't read it.
Usage log: for each conversion, the time, whether a URL or HTML was sent, the URL itself (not the HTML), the PDF size, how long it took and whether it succeeded. You can see this log in your account.
Security data: the IP address used to request a sign-in link or to sign in, kept briefly to stop abuse (sign-in links are deleted after one day).
Billing status: if you buy a plan, we receive from Paddle your Paddle customer and subscription IDs and the subscription status and renewal date. We never see or store your card details.
Cookies: one strictly necessary cookie that keeps you signed in. We use no advertising or analytics cookies and no tracking scripts. The checkout is provided by Paddle, which sets its own cookies when you open it.

What we don't keep

The HTML you send and the PDFs we generate are processed in memory to answer your request and are not stored afterwards.

Why we use it (legal basis)

To provide the Service, enforce plan limits and show your usage: performance of our contract with you.
To keep the Service secure and prevent abuse: our legitimate interest.
To send you sign-in links and important account or service notices: performance of our contract. We don't send marketing emails without your consent.
To keep billing records where the law requires it: legal obligation.

Who we share it with

Paddle.com, our reseller and Merchant of Record, which processes payments, taxes and invoices under its own privacy policy.
Our server hosting provider, which stores the data on our behalf.
Authorities, only when legally required.

We don't sell your data or share it for advertising.

When you convert a URL, our rendering browser visits that page like a normal browser would, so the page's owner sees a request from our server.

How long we keep it

Account details, billing status and usage log: while your account exists. They are deleted when the account is deleted.
Database backups: up to 14 days.
Records we must keep for tax or accounting are kept for the period the law requires.

Your rights

You can ask us to access, correct, export or delete your data, or object to or restrict its use, by emailing contact@pdfly.host. We answer within 30 days. You may also complain to your data protection authority.

Security

All traffic uses HTTPS, API keys are stored hashed, the database is not reachable from the internet, and access to the server is restricted.

Changes

We'll post any changes here and notify account holders by email of significant ones.