Privacy Policy

Important Privacy Information

To use our Service, we ask you to create an account by providing your email. When you access our website, we automatically collect cookies from your device, language settings, time zone, device type, operating system, and information about your interactions with the website. We use this data to provide our Service, analyse how customers use the website, and serve and measure ads.

This Privacy Policy explains what personal data is collected when you use the website located at pdfvault.ai (the “Website”), and the services and products provided through it (together with the Website, the “Service”), and how such personal data is processed.

By using the Service, you confirm that (i) you have read, understand, and agree to this Privacy Policy, and (ii) you are at least 18 years of age, or are using the Service with the involvement and approval of a parent or legal guardian as described in our Terms and Conditions.

If you do not meet this requirement, or are unable to make this confirmation, you must not use the Service — contact us to request deletion of your data, stop using the Website, and cancel any active subscriptions or trials.

Any translation from the English version is provided for convenience only. In the event of any difference in meaning between the English-language version of this Privacy Policy and a translation, the English-language version prevails.

“GDPR” means the General Data Protection Regulation (EU) 2016/679. “EEA” includes all current EU and European Free Trade Association member states, and for the purposes of this Policy also includes the United Kingdom. “Process,” in respect of personal data, includes to collect, store, and disclose to others.

Personal Data Controller

FLUTTWINGS INVESTMENTS LIMITED, a company registered under the laws of the Republic of Cyprus, having its registered office at Dimostheni Severi 12, 6th floor, Flat/Office 601, 1080, Nicosia, Cyprus, is the controller of your personal data.

Categories of Personal Data We Collect

We collect data you give us voluntarily (for example, your email address) and data we collect automatically (for example, cookies and technical information about your device).

2.1 Data we receive directly from you

• Identifiers: your name and email address when you create an account, make a purchase, or contact us.
• Account Data: your login information (email and password hash) and user ID.
• Purchase Data: billing data you provide to our payment processor, Adyen. We do not collect or store full card numbers, though we may receive limited data such as a secure payment token, transaction amount, date, and time.
• Content: files and documents you upload to deliver the feature you request. Content is not retained beyond the processing session unless you explicitly save it to your account.
• Signing and validation metadata:when you use signing or validation features, technical metadata such as your IP address and a timestamp may be recorded in the document’s audit record (see Section 3.1).
• Feedback/Communications: your email and other information provided through customer support and other communications.

2.2 Data we collect automatically

• Log data: IP address, browser type, pages visited, timestamps, referring URLs.
• Device information: operating system, screen resolution, language settings.
• Usage data: features used, file types processed (not file contents), session duration.
• Advertising identifiers, where applicable to your device, in connection with the advertising described in Section 3.6 below.
• Cookies and similar tracking technologies (see our Cookie Policy).

For What Purposes We Process Your Personal Data

3.1 To provide our Service

This includes enabling you to use the Service’s functions, storing content you choose to save to your account, and preventing or addressing technical issues. Where you use signing or validation features, technical metadata — including your IP address and a timestamp — may be recorded in the document’s audit record to support the authenticity and verification of the signed or validated document; this audit record forms part of the document and will be visible to anyone you share the document with.

3.2 To provide customer support

We process your data to respond to support requests, using Zendesk as our ticketing system, and Clerk to manage account authentication.

3.3 To communicate with you regarding your use of the Service

We may email you about the performance of the Service, security, or payment transactions. We use Customer.io to manage transactional and lifecycle email communications.

3.4 To research and analyse use of the Service

We use Google Analytics to understand how customers use the Service, and Sentry to monitor and diagnose technical errors. This helps us maintain, improve, and develop the Service.

3.5 To send marketing communications

Where you have consented, we process your data to send marketing communications about our products, such as special offers or new features. We use Customer.io to deliver these communications. You may unsubscribe at any time via the link in the footer of marketing emails.

3.6 To personalise our ads

We advertise PDFVault through Google Ads to reach potential customers. In connection with this, Google advertising cookies and pixels on the Website collect technical information, including advertising and click identifiers, to measure the performance of our campaigns (conversion tracking) and, where enabled, to build audiences for remarketing. Details of the specific cookies used are set out in our Cookie Policy.

How to opt out or influence personalized advertising. Google allows its users to opt out of Google’s personalized ads and to prevent their data from being used by Google Analytics via Google’s Ads Settings. You may also opt out of interest-based advertising generally through the Digital Advertising Alliance (https://optout.aboutads.info/) and the Network Advertising Initiative (https://optout.networkadvertising.org/).

3.7 To process your payments

We use Adyen to process payments. We do not store or collect full payment card details ourselves; this information is provided directly to Adyen.

3.8 To enforce our Terms and to prevent and combat fraud

We use personal data to enforce our agreements and to detect, prevent, and combat fraud, which may involve sharing information with law enforcement in connection with a dispute.

3.9 To comply with legal obligations

We may process, use, or share your data where the law requires it, including in response to legal requests from law enforcement or regulatory authorities.

Legal Bases for Processing (Applies Only to EEA and UK Users)

We process your personal data under the following legal bases:

4.1 Performance of a contract

To provide the Service, provide customer support, communicate with you about your use of the Service, and process your payments.

4.2 Legitimate interests

To communicate with you about your use of the Service, to research and improve the Service, to enforce our Terms and prevent fraud, and in connection with a merger, acquisition, or legal claim. Where we rely on legitimate interests, you may object to this processing at any time (see Section 6).

4.3 Consent

For marketing communications and personalized advertising, including cookies and similar tracking technologies. You may withdraw consent at any time via our cookie preferences or by contacting us.

4.4 Legal obligation

To comply with legal obligations, including responding to lawful requests from government or law enforcement authorities.

With Whom We Share Your Personal Data

5.1 Service providers

We share personal data with third parties that provide services on our behalf, based on our instructions, including:

• Authentication: Clerk, Google (Google Auth), Cloudflare (edge delivery via Clerk).
• Payment processing: Adyen.
• Hosting and infrastructure: Amazon Web Services (AWS), including CloudFront (content delivery) and Route 53 (DNS).
• Customer support: Zendesk.
• Error monitoring: Sentry.
• Translation/localization: Weglot.
• Reviews: Trustpilot.
• Email and lifecycle marketing: Customer.io.
• Analytics: Google Analytics.
• Advertising: Google Ads.
• File conversion: CloudConvert.

5.2 Law enforcement and public authorities

We may disclose personal data to enforce our Terms, protect our rights or the rights of others, and to respond to lawful requests from courts, law enforcement, or regulatory authorities.

5.3 Merger or acquisition

If we are involved in a merger, acquisition, divestiture, or asset sale, customer information is typically one of the transferred assets, with notice to you.

5.4 Affiliates

We may share your personal information with companies that are part of our corporate group, who will handle it consistently with this Privacy Policy.

How You Can Exercise Your Privacy Rights

You have the right to: access, review, or correct your personal data; request erasure of your personal data, subject to legal retention requirements; and object to or restrict our use of your personal data.

6.1 Additional rights for EEA and UK-based users

You have the right to lodge a complaint with your local data protection supervisory authority, and the right to receive your personal data in a machine-readable format (data portability).

To exercise any of these rights, contact us at dpo@pdfvault.ai. We will respond within the timeframe required by applicable law (one month under the GDPR / UK GDPR; up to 45 days under certain US state laws).

Age Limitation

The Service is intended for use by individuals aged 18 and older. If you are under 18, you may only use the Service with the involvement and approval of a parent or legal guardian, as described in our Terms and Conditions. We do not knowingly collect personal information directly from a minor without appropriate parental or guardian involvement. If you believe we have collected personal information from a minor without appropriate parental or guardian involvement, contact us immediately at dpo@pdfvault.ai and we will take appropriate action, which may include deleting that information.

International Data Transfers

We may transfer personal data to countries other than the one in which it was originally collected, in order to provide the Service. Where we transfer personal data originating from the EEA or UK to countries without an adequate level of data protection, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable.

Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material changes will be announced by email or prominent notice on the Service before they take effect. The “Updated date” above shows when this Policy was last revised.

US State Privacy Notice

This section applies to residents of US states with consumer privacy laws (including California, Colorado, Connecticut, Texas, Virginia, and others). In the preceding 12 months, we have collected the categories of personal information described in Section 2 (identifiers, commercial information, and internet activity information) for the purposes described in Section 3, and shared them with the categories of recipients described in Section 5.

You may have the right to: know and access the personal information we hold about you; delete it; correct it; receive it in a portable format; opt out of “sales,” “sharing,” and targeted advertising; limit use of sensitive personal information; and not be discriminated against for exercising these rights. We honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing where required. To exercise any right, or to appeal a decision, email dpo@pdfvault.ai. Authorized agents may submit requests with proof of authorization.

Privacy laws in some US states define “sale” broadly enough to include sharing via cookies or similar tracking technologies for certain advertising activities, including the Google Ads integration described in Section 3.6. We do not sell personal information for monetary compensation; however, this cookie-based advertising activity may qualify as a “sale” or “share” under such laws even without payment, and the opt-out rights above apply to it.

Data Retention

• Account data: retained while your account is active.
• Uploaded files: not retained beyond the processing session unless saved to your account.
• Payment records: retained as required by financial and tax regulations.
• Log data: retained for up to 90 days.

We will store personal data for as long as reasonably necessary to fulfil the purposes in this Policy, including complying with legal obligations and enforcing our agreements. You may request deletion of your account and associated data at any time (see Section 6).

How “Do Not Track” Requests Are Handled

Some browsers offer a “Do Not Track” (DNT) signal. There is currently no accepted industry standard for how websites should respond to DNT signals, and we do not currently respond to them. We do, however, honor Global Privacy Control (GPC) signals as described in Section 10 above.

Security

We implement industry-standard security measures, including TLS encryption in transit, encryption at rest, hashed passwords, access controls, and regular security reviews. No system is completely secure; we cannot guarantee absolute security. If a personal data breach occurs, we will notify affected users and regulators where required by law.

Contact

FLUTTWINGS INVESTMENTS LIMITED
Dimostheni Severi 12, 6th floor, Flat/Office 601, 1080, Nicosia, Cyprus.
Email: dpo@pdfvault.ai