Privacy Policy

Last updated: June 2026

ConvertFlow is built privacy-first. This policy explains what we collect, why, and your rights under the GDPR and CCPA.

Our privacy-first model

The majority of our tools run entirely in your browser. For these tools, your files and text never leave your device and are never transmitted to our servers.

Some tools (e.g. certain PDF operations) require server-side processing. For those, files are uploaded over an encrypted (TLS) connection, processed in an isolated worker, and automatically deleted.

Data we collect

Account data (optional): if you create an account, we store your email, name and a securely hashed password.

Uploaded files (transient): only for server-side tools, kept until automatic deletion — within 1 hour for guests and 24 hours for registered users.

Usage and security logs: anonymized tool usage, request metadata and audit logs to operate the service securely.

Consent records: your cookie choices, with timestamp, IP, country and browser, as required for compliance.

Automatic file deletion

Processed files are deleted automatically: guests within 1 hour, registered users within 24 hours. You can delete files sooner from your dashboard.

Your rights

You can access, export, correct or delete your data at any time. Email us to exercise GDPR/CCPA rights including erasure and data portability.

We never sell your personal data.

Contact

For privacy questions or requests, contact our team via the contact page.