Privacy Policy — PDF Suite Web Tools (pdfsuite.zalize.com)
Effective date: August 1, 2026 Operator / Data Controller: Zalize ("we", "us") · Contact: [email protected]
PDF Suite Web Tools provides browser-based PDF utilities (bank statement to Excel, invoice splitting, OCR, merge/split, compression, and conversions). This policy explains what we process and what we do not.
1. The short version
- Your files are processed inside your browser. The bytes of your PDFs, bank statements, invoices, and images are not uploaded to our servers. Parsing, OCR, conversion, compression, splitting, and merging run locally on your device using in-browser libraries (WebAssembly/JavaScript).
- We keep no copies of your documents — we never receive them in the first place.
- We use a minimal quota system (one strictly-necessary first-party cookie, no tracking or advertising cookies) to enforce free daily limits.
2. Data we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
Anonymous device identifier (random ID issued by our server in a strictly-necessary first-party cookie, ps_device, signed and HttpOnly; used only for the quota API) | Enforce free daily usage limits | Legitimate interest (Art. 6(1)(f)) — preventing abuse of the free tier | Cookie lifetime up to 12 months or until you clear site data; server-side counters expire automatically within 48 hours |
| IP address (as part of the quota counter key, and in standard Cloudflare infrastructure logs) | Quota enforcement; security and DDoS protection | Legitimate interest (Art. 6(1)(f)) | Quota counters expire within 48 hours; infrastructure logs per Cloudflare's standard retention |
| Tool name and usage count (e.g., "merge: 2/5 today") | Quota enforcement | Legitimate interest | 48 hours |
| Purchase information (email, order/license identifiers) — only if you subscribe | Provide and manage your subscription | Contract (Art. 6(1)(b)) | For the life of your subscription plus statutory record-keeping periods |
We do not process the content of your files on our servers, and our quota system stores no file names, file contents, or document metadata. Our request logs do not contain file content (files are never transmitted).
3. What we do NOT do
- We do not upload, store, scan, or read your documents.
- We do not sell or share personal information (no "sale" or "sharing" as defined by the CCPA/CPRA).
- We do not run third-party advertising or cross-site tracking.
- We do not require an account for the free tier.
4. In-browser downloads (OCR models)
The Chinese OCR and scanned-document tools use the Tesseract OCR engine running in your browser. On first use, your browser downloads the OCR engine and language model files (~20 MB). This is a download to your device; your files are never sent in return. The OCR engine and language model files are currently served from a third-party CDN (jsDelivr), so that CDN sees your IP address for the download — as with any script or font CDN. Your documents are never part of this exchange.
5. Payments
Subscriptions are sold by Lemon Squeezy as Merchant of Record. Lemon Squeezy processes your payment details under its own privacy policy; we never see your card details.
6. Hosting
The site runs on Cloudflare Pages/Workers. Cloudflare processes IP addresses and request metadata as our processor/infrastructure provider for delivery and security purposes.
7. International transfers
Our infrastructure providers (Cloudflare, Lemon Squeezy) may process the limited data above in the United States and other countries, under appropriate safeguards (e.g., Standard Contractual Clauses provided in their data processing agreements).
8. Your rights
EEA/UK (GDPR): you have the right of access, rectification, erasure, restriction, objection, and portability regarding personal data we hold, and to lodge a complaint with a supervisory authority. In practice we hold almost nothing about free-tier users: quota counters are anonymous and auto-delete within 48 hours; you can also clear your device identifier at any time by clearing site data for this site.
California (CCPA/CPRA): you have the right to know, delete, and correct, and to opt out of sale/sharing (we do not sell or share). We do not use or disclose sensitive personal information beyond what is necessary to provide the service.
To exercise any right, contact [email protected]. We respond within the statutory deadlines (30 days GDPR / 45 days CCPA).
9. Data security
Files never leave your device, which eliminates the largest risk category. The limited quota data is stored in Cloudflare KV with automatic expiry, transmitted over HTTPS only.
10. Children
The service is not directed at children under 13 (or under 16 in the EEA) and we do not knowingly collect their data.
11. Changes
Material changes will be posted on this page with an updated effective date.