Skip to content
OP

Privacy Policy

Last updated: October 14, 2026

1. The short version

OptimaPDF tools run in your browser: the files you work on are not sent to our server or anywhere else. Only what two features need reaches the server — text for the AI features and a page address for URL to PDF. We collect visit statistics (Google Analytics) only with your consent. There are no user accounts.

2. Data controller

The controller of personal data is Leszek Hofman, Dąbrówka Nowa, Poland. Contact: kontakt@optimapdf.com. No Data Protection Officer has been appointed — write to the address above about anything concerning your data.

3. What data we process

3.1 Your files

All file tools — including merge, split, compress, OCR, edit, sign, redact, password protection and every file conversion (PDF ↔ Word, Excel, PowerPoint, OpenOffice, images, HTML, EPUB, TXT, SVG) — run entirely in your browser (JavaScript and WebAssembly). The file is not sent to our server. Only the application files, fonts and OCR language data are downloaded from it.

3.2 AI features (AI Chat, AI Summary, AI Translate)

When you use an AI feature, the text extracted from your file (and, in the chat, your question) is sent through our server to OpenRouter, Inc. (USA), which passes it to the provider of the language model (currently OpenAI GPT-4o mini, served by OpenAI or Microsoft Azure). The tool tells you so before anything is sent.

  • Every request requires a provider that, according to OpenRouter, does not store data beyond the request and does not train models on it. If no such provider is available, the request fails — it is not sent to another one.
  • The request is sent by our server with the site's shared API key: OpenRouter does not receive your IP address or browser details, and you do not need a key of your own.
  • We do not store the text sent or the answer.
  • The limit is 15 requests a day per IP address. The counter (your IP address and the number of requests) is kept in an Upstash database for 24 hours from the first request and then deleted automatically.

3.3 URL to PDF

The page address you enter reaches our server, which downloads that page and makes a PDF of it. We store neither the address, nor the page, nor the PDF. The limit is 30 conversions per 10 minutes per IP address — the counter is kept in an Upstash database for 10 minutes.

3.4 Technical data

Our hosting provider (Vercel Inc.) processes technical data when serving requests — IP address, page address, time and browser type — to run and protect the site. Our server logs only rejected API requests (for example an exceeded limit or a request from another site), with the IP address shortened to its first three parts (e.g. 203.0.113.0).

3.5 Stored in your browser

Some settings are stored on your device. They are not sent to us or to third parties:

  • localStorage: theme (light/dark), chosen language, your choice about analytics, tool settings and the list of recently used tools.
  • The "x-detected-locale" cookie (up to 12 months) with the chosen language, so the site opens in your language. It is necessary for the language versions to work and needs no consent.
  • The application cache (service worker): site files and downloaded OCR language data, so the tools work faster and offline.
  • After connecting Google Drive: an access token in sessionStorage, removed when you close the tab or when it expires.

3.6 Google Drive, Dropbox and OneDrive

If you choose to open a file from the cloud or save to it, the file travels directly between your browser and the provider you chose (Google, Dropbox, Microsoft) — not through our server. You sign in in that provider's window, and its terms and privacy policy apply to that operation. Google Drive gives us access only to files opened or created by OptimaPDF; Dropbox only to saving files; OneDrive and SharePoint to all your files and sites, because this Microsoft integration has no narrower permission, but only your browser uses it and the token never reaches our server.

4. Legal basis

  • Art. 6(1)(b) GDPR — providing the service you request: the AI features and URL to PDF.
  • Art. 6(1)(f) GDPR — the controller's legitimate interest: running and securing the site, request limits, abuse prevention, technical logs.
  • Art. 6(1)(a) GDPR — your consent: visit statistics in Google Analytics. You can withdraw it at any time (section 10).

5. Recipients

Data is processed on our behalf by, or received by:

  • Vercel Inc. (USA) — hosting of the site and the application server.
  • Upstash, Inc. (USA) — the database of request-limit counters (IP address and number of requests). The database is located in the Washington, D.C. area (USA, region iad1).
  • OpenRouter, Inc. (USA) and the model provider OpenRouter passes the request to — only when you use the AI features.
  • Google LLC (USA) — Google Analytics, only with your consent.
  • Public authorities — only where the law requires it.

6. Transfers outside the EEA

The application server runs in a Vercel data centre in the USA, and all recipients in section 5 are based in the USA. The data described in sections 3.2–3.4 and Google Analytics data are therefore transferred to the USA. Vercel Inc. and Google LLC are certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); Vercel also uses the Standard Contractual Clauses. For Upstash and OpenRouter the transfer takes place under their data processing terms. Your files are not transferred anywhere (section 3.1).

7. How long we keep data

  • Your files: they never reach us. In the browser they are gone when you close or reload the page.
  • Text sent to the AI and page addresses for conversion: we do not store them.
  • AI limit counter (IP address): 24 hours from the first request. URL to PDF counter: 10 minutes.
  • Server logs at the hosting provider: 1 hour on the current Vercel plan.
  • Google Analytics data: according to the data retention setting in Google Analytics, at most 14 months.
  • Settings in your browser: until you delete them; the language cookie up to 12 months.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object (Art. 21), and to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. You may also lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). There are no accounts, so technical data usually cannot be linked to a particular person (Art. 11 GDPR) — write to us and we will see what we can do.

9. Security

  • Encrypted HTTPS connection with HSTS.
  • A Content Security Policy and headers that prevent the site from being embedded in other sites and block access to the camera, microphone and location.
  • Origin checks on API requests (CSRF protection), request limits and a request size limit (100 MB).
  • URL to PDF does not fetch internal network addresses or the server's cloud services (SSRF protection).
  • Details: the "Security" page.

10. Google Analytics and consent

With your consent we use Google Analytics 4 (Google LLC) to count visits and see which tools are used. Google then stores cookies with an identifier in your browser (_ga, _ga_*) and receives data about the visit: pages viewed, approximate location, device and browser type, and where you came from.

  • Without consent the Google Analytics script is not loaded at all — the site does not contact Google.
  • You can change or withdraw your consent at any time with the "Cookie settings" button at the bottom of every page. Withdrawing turns Google Analytics off at once and deletes its cookies.
  • We do not use Google Analytics for advertising or profiling. The files you work on never reach Google.

11. Changes

We may change this policy when the way the site works changes; the date of the last change is at the top of the page. Questions: kontakt@optimapdf.com.

← Back to homepage