Privacy Policy

Who is responsible

The data controller is PDFCOSMICO.COM. For any privacy question or to exercise your rights, write to [email protected].

Hybrid processing of your files

In-browser tools

Tools labeled “In your browser” (Merge, Split, Organize, Edit, Sign, Protect and many more) process the file on your own device with JavaScript and WebAssembly. The document is never uploaded to the internet: we don't receive it, we don't see it and no record of it is kept. The extraction tools (PDF to Text, Markdown, HTML and LaTeX) and the AI tools, labeled “Browser or server”, work this way too if you don't have the PRO plan.

Server tools

• Files travel encrypted over HTTPS (TLS 1.3 on current browsers) to our server, which is only reachable through an encrypted tunnel: it has no ports open to the internet.
• They are processed exclusively on a volatile RAM disk (tmpfs): nothing is written to persistent disks, and a restart wipes everything.
• As soon as processing finishes, the original upload (in/) and the temporary files (work/) are destroyed on the spot.
• The result file (out/) expires after 60 minutes (job_ttl_s = 3600) and an automatic sweep that runs every 5 minutes removes it. You can delete it instantly with the “Delete from server now” button.
• If a file fails the security checks (antivirus, decompression bomb…), the whole job is purged immediately. If processing fails for any other reason, or you upload a file and never process it, it is still removed after 60 minutes.

Live editor (PRO plan)

The Word, Excel and PowerPoint document editor runs on OnlyOffice on our own server. Before opening, every document goes through the same checks (antivirus and macro disarming). Each time you save, the server copy is updated and expires 60 minutes after the last save. If persistent saving is enabled, an encrypted-at-rest copy of each saved version is also kept in private storage (Cloudflare R2) linked to your account, so you don't lose your work; you can ask for it to be deleted at any time by writing to [email protected].

Advanced OCR (PRO plan)

Only if you're a PRO plan user processing a scanned document with OCR PDF, converts it with PDF to Word, Excel or PowerPoint, extracts its content with PDF to Text, Markdown, HTML or LaTeX, or processes it with the AI tools (“Chat with PDF”, “Semantic PDF search”, “Summarize PDF” and “Translate PDF” in Advanced AI mode) do we use Google Cloud Vision Advanced OCR. Our server detects which pages have no selectable text, renders them as images (about 200 DPI) and sends only those images to the Cloud Vision API through an internal proxy: the Google key never leaves our server. Pages that already have text are not sent. Under Google Cloud's terms, the API processes the images to return the text and does not use them to train its models. If you choose the Standard engine, or you're not PRO, OCR runs with Tesseract on our own server and nothing is sent to third parties.

AI tools

With the server (PRO plan), “Chat with PDF” and “Semantic PDF search” split the text into passages that are indexed in our vector database (Qdrant, hosted on our own server). Those passages expire automatically after 24 hours, or instantly if you delete the session. To write each “Chat with PDF” answer we send the DeepSeek API only your question, the relevant passages retrieved from Qdrant and the last 6 messages of the conversation; never the whole document. DeepSeek acts as a data processor and its servers may be located outside your country of residence over encrypted connections. If DeepSeek isn't configured or doesn't respond, the answer is built only from verbatim quotes of the document. In local mode, search and citations are computed in your browser and nothing is sent. “Summarize PDF” and “Translate PDF” work differently: when a PRO plan user chooses Advanced AI mode, the document is processed on our server (with Advanced OCR for scans) and the text extracted from the document is sent to DeepSeek in segments so it can be summarized or translated in full. In Standard AI mode, or without the PRO plan, everything is processed locally in your browser (translation uses the browser's own built-in translator) and nothing is sent to DeepSeek.

Zero AI training guarantee

• We never read your documents: no human reviews their content.
• We never sell, rent or hand them over to third parties.
• We never use them to train artificial intelligence models, nor hand them to anyone for that purpose.

Accounts and payments

You can use the tools without an account. If you sign in, you do so with OAuth 2.0 and PKCE through Casdoor, our self-hosted identity provider (and, if you choose, with your Google account). We only keep what's needed to manage your account: identifier, name, email address and plan.

PRO plan payments are processed by Lemon Squeezy (Lemon Squeezy, LLC), acting as PDFCOSMICO.COM's *Merchant of Record*: it handles charging, invoicing and taxes in each country. PDFCOSMICO.COM never stores or has access to your credit or debit card numbers or their CVV codes: you enter them directly in Lemon Squeezy's checkout. We only share with Lemon Squeezy your user identifier (user_id) and email address to link the subscription to your account, and we receive the payment confirmation from Lemon Squeezy (webhook) to activate the PRO plan. Lemon Squeezy also handles the billing details you give it, under its own privacy policy.

Account data is backed up to private storage with 7-day retention. Your documents are never part of those backups.

No advertising cookies

We don't use advertising or tracking cookies, or third-party analytics. We only keep technical data in your browser's local storage (localStorage), and it never leaves it:

• Your appearance preferences (light or dark theme and paper tone).
• The tools you used recently and the last options of each one, so you don't have to repeat them.
• The scanner's auto-capture preference.
• If you sign in, your session credentials, which are only sent to our API to identify you (sessionStorage is also used briefly while signing in).

The language lives in the address itself (/es or /en), so it doesn't need to be stored. To stop bots, the server may ask for a Cloudflare Turnstile check, which analyzes technical browser signals without building advertising profiles. We also use your IP address temporarily, in 10-minute windows, to limit abuse.

Your files vs. technical security logs

It's worth separating two things we handle very differently:

• Your files: the content of your documents only lives in the server's RAM and is destroyed within 60 minutes at most (sooner if you press “Delete from server now”), except for the live editor versions described above.
• Technical access and perimeter security logs: Cloudflare and our server record data such as the IP address, timestamp, requested path and HTTP status code to defend against DDoS attacks, prevent fraud and audit security. These logs never contain the text or bytes of your documents and are kept temporarily, for between 14 and 30 days.

Providers that help us

• Cloudflare: site delivery, the encrypted tunnel to the server, Turnstile and, when enabled, encrypted R2 storage for versions saved in the live editor. It handles technical data such as your IP.
• Lemon Squeezy (Lemon Squeezy, LLC): PRO plan *Merchant of Record*: charging, invoicing and taxes. It only receives your user identifier and email from us.
• DeepSeek: PRO plan only. In “Chat with PDF” it receives only the question, the relevant passages retrieved from Qdrant and the last chat messages; in “Summarize PDF” and “Translate PDF” with Advanced AI mode, the text extracted from the document, in segments, to summarize or translate it in full. In Standard AI mode it receives nothing.
• Google Cloud (Cloud Vision API): only when a PRO plan user processes scanned documents with Advanced OCR; it receives only the images of the pages that need optical recognition and, under Google Cloud's terms, does not train models on data from its commercial API.
• Google: only if you choose to sign in with your Google account.

Your rights

You can exercise your ARCO rights —Access, Rectification, Cancellation or erasure and Objection— as well as data portability by writing to [email protected]. We handle them under Peru's Personal Data Protection Law (Law No. 29733) and its regulations, Chilean law (Law 19,628 and its update, Law 21,719) and, where applicable, the EU General Data Protection Regulation (GDPR).

Permanent account deletion: on request, we delete your account and its associated data from our identity provider (Casdoor) and our database (PostgreSQL) within 5 business days at most, and confirm by email once it's done.

Changes to this policy

If we change anything significant, we'll publish it on this page with a new date. See also our Terms and Conditions and how our Security works.