Privacy Policy
Last updated: 2026-11-02
PDFVelvet is operated by Md. Sumun Mia, an individual based in Dhaka, Bangladesh ("PDFVelvet", "we"), at pdfvelvet.com. This policy explains what personal data we process and why. Contact: m.sumon@outlook.com.
1. Files you process
- What: the PDF and other files you upload to a tool, and the results we create from them.
- Why: only to perform the tool you asked for (contract / your request).
- How long: deleted automatically 60 minutes after they were last used. Tool files are not included in backups.
- Access: files are bound to your browser session (guests) or your account. Nobody else can open them. We do not look at your files except where strictly required to investigate abuse or to comply with a legal obligation.
- Passwords you type for protect/unlock: used only while the tool runs, erased right after.
- Where: stored on servers operated by Hostinger in Mumbai, India. Files are not separately encrypted at rest by the application.
2. Documents saved to an account
Files you choose to save to Documents stay until you delete them, within your plan's storage limit. Deleting your account deletes them from our servers. Documents are included in nightly backups, which are kept for 14 days. Share links you create are visible to anyone who has the link until you revoke them; the shared page shows your name.
3. Account data
Name, email address, hashed password (bcrypt), optional avatar, plan and billing status, team memberships, sign-in method (password, Google, or your organisation's SSO). Kept while your account exists. Deletion is self-service in your profile.
4. AI features
AI tools (chat, summarize, translate, quiz, assistant) need an account. When you use one, the document and your messages are sent to Anthropic, PBC (commercial terms) to generate the answer. Under Anthropic's commercial terms, API data is not used to train their models and is retained by Anthropic for a limited period (currently up to 30 days) for abuse prevention. We do not store AI conversations.
5. E-signature
When you send a document for signature we process signer names and email addresses, the signing events (time, IP address, user agent) and the signed document, to deliver and evidence the signature. Signature requests and their documents are kept until you delete them or delete your account, so that you and the signers can retrieve the signed document.
6. Ratings
After a tool finishes you can rate it from 1 to 5 stars. We store only the tool and the score — no account, browser ID or IP address — and show averages on our website.
7. Cookies and similar
| Cookie | Purpose | Lifetime |
|---|---|---|
egid | Keeps your files private to your browser when you're not signed in; daily guest limit | 365 days |
pdfvelvet_session | Keeps you signed in / your session working | 120 minutes |
XSRF-TOKEN | Protects forms against cross-site request forgery | 2 hours |
_ga, _ga_* | Google Analytics on our public website (visit statistics) | up to 2 years |
The first three are strictly necessary. Our public website (not the app) uses Google Analytics 4 to measure visits; we use no advertising or cross-site tracking cookies. Local storage keeps UI preferences only (language, theme, sidebar, recent files).
8. Logs and security
Our servers keep request logs (time, path with share/sign/reset tokens removed, status, IP address) for up to 1 month to run and protect the service. Guest tasks store the IP address for up to 60 minutes to enforce the free daily limit.
9. Processors
| Processor | Purpose | Location |
|---|---|---|
| Hostinger | Servers and storage | India (Mumbai) |
| Anthropic, PBC | AI features (only when used) | USA |
| Paddle.com Market Ltd | Payments — Paddle is the merchant of record for paid plans | United Kingdom |
| Namecheap, Inc. (Private Email) | Account and signing emails | USA |
| Google LLC | "Sign in with Google" (only if you use it); Google Analytics on the website | USA |
Our servers are in India and some processors are in the USA and UK. Where EU/UK data protection law applies to you, international transfers rely on the contractual safeguards these processors provide, such as EU Standard Contractual Clauses.
10. Your rights
Depending on where you live (for example under the GDPR), you can ask us for access to, rectification, erasure, restriction or portability of your personal data, or object to our processing of it. Email m.sumon@outlook.com and we will respond within 30 days. EU/UK users can also complain to their data protection supervisory authority.
11. Children
PDFVelvet is not directed at children under 13.
12. Changes
We will post changes here and update the date above.