Privacy Policy

Last updated April 15, 2026

1. Who we are

PDFend (“we”, “our”, “us”) operates the PDF generation API and dashboard at pdfend.com. This policy explains what data we collect, why we collect it, and what rights you have over it.

2. Data we collect

  • Account data. Email, name, and any information from Google OAuth if you sign in with Google.
  • API usage data. API key prefixes (never the full key), timestamps, status codes, document size, page counts, and generation durations.
  • Generated documents. The HTML you send us is rendered in an isolated Chromium process and the resulting PDF is stored in S3-compatible object storage. We retain completed PDFs for 30 days by default.
  • Billing data. If you subscribe to a paid plan, Stripe processes payment details on our behalf. We store Stripe customer and subscription identifiers, never card numbers.
  • Operational logs. IP address, user agent, and a request ID for every API call. These help us debug issues and protect against abuse.

3. How we use it

  • To provide the service and render your PDFs.
  • To enforce rate limits, plan quotas, and security controls.
  • To bill you for paid plans.
  • To send you transactional email (sign-in codes, receipts).
  • To investigate bugs and abuse with the minimum data needed.

4. Data sharing

We do not sell your data. We share it only with the sub-processors needed to run the service:

  • Stripe — payment processing.
  • Resend — transactional email delivery.
  • Cloudflare / AWS — object storage for generated PDFs and CDN delivery.
  • Hetzner / Fly.io — compute for the API and rendering workers.

5. Security

All traffic uses TLS. Passwords, if you used password sign-in, are hashed with Argon2. API keys are stored as SHA-256 hashes. PDF storage buckets are private and served through signed URLs. Our renderer filters outbound requests to private IP ranges to prevent SSRF.

6. Retention

Generated PDFs are kept for 30 days and then deleted. Account and billing records are kept for as long as you have an account plus up to 6 years for tax compliance. API keys are retained (as hashes) until you revoke them.

7. Your rights

If you are in the EU, UK, or a region with a similar framework, you have the right to access, correct, export, or delete your personal data. Email privacy@pdfend.com and we'll respond within 30 days.

8. Contact

Questions about privacy? Email privacy@pdfend.com.