GDPR Information

1. Who we are as data controller

The controller of your personal data is Leszek Hofman, Dąbrówka Nowa, Poland (optimapdf.com). As a digital service provider, we process data only to the extent necessary to provide online PDF tools. For all data protection matters, you can contact us at: kontakt@optimapdf.com.

2. What personal data we process and for what purpose

OptimaPDF is designed to minimize data collection. We process only:

• IP address — to ensure security and prevent abuse (legitimate interest, Art. 6(1)(f) GDPR). IP addresses are stored in server logs for a maximum of 7 days.
• Files uploaded by the user — most tools process files entirely in the browser (WebAssembly/JavaScript). These files are not sent to the server and never leave your device. Exceptions are tools requiring external libraries (compression, OCR, format conversions), where the file is temporarily processed in the server's RAM and immediately deleted after the operation — typically within seconds.
• Theme and language preferences — stored exclusively in your browser's localStorage. They are not sent to the server or shared with third parties.

3. Legal basis for processing

We process your data based on:

• Art. 6(1)(b) GDPR (necessity for contract performance) — providing PDF tools upon your request.
• Art. 6(1)(f) GDPR (legitimate interest) — ensuring service security, preventing abuse, and technical analysis of website operation.
• Art. 6(1)(a) GDPR (consent) — for AI features that require sending content to an external API (OpenRouter). Using AI requires explicit consent by accepting the terms.

4. How long we retain data

We apply the following retention periods:

• IP addresses in server logs: up to 7 days.
• Files sent to client-side tools: not stored — they are removed from memory when you close the browser tab or refresh the page.
• Files sent to server-side tools (compression, OCR, conversions): deleted immediately after processing (typically within seconds).
• localStorage data: stored until manually deleted by the user or until browser cache is cleared.

5. Who we share data with

We do not sell, rent, or share your personal data with third parties. To a limited extent, data may be processed by:

• OpenRouter.ai — when using AI features (AI Chat, AI Summary, AI Translate). We send only text extracted from the PDF, without user-identifying data. OpenRouter complies with GDPR and has appropriate safeguards.
• Hosting provider — our website is hosted by an external provider who may store anonymous server logs (IP address, browser type) for a maximum of 7 days. The provider holds ISO 27001 certification and meets GDPR requirements.

6. Your rights under GDPR

Under Articles 15–22 GDPR you have:

• Right of access (Art. 15) — you may ask whether we process your data and obtain access to it.
• Right to rectification (Art. 16) — you may request correction of inaccurate data.
• Right to erasure (Art. 17) — right to be forgotten.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21).
• Right to withdraw consent at any time — without affecting the lawfulness of processing before its withdrawal.

7. How to exercise your rights

To exercise any of the above rights, send an email to: kontakt@optimapdf.com. We will respond within 30 days. We do not charge fees for fulfilling requests unless they are manifestly unfounded or excessive (Art. 12(5) GDPR).

8. Right to lodge a complaint

If you believe that our processing of your data violates GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

9. Data transfers to third countries

When using AI features, text may be processed by OpenRouter servers located in the US. OpenRouter participates in the Data Privacy Framework (DPF) program, ensuring an adequate level of data protection in accordance with European Commission Decision 2023/1795.

10. Cookies and localStorage

We do not use advertising, tracking, or third-party analytical cookies. We only use browser localStorage to remember your preferences (theme, language). This data is stored locally on your device and can be deleted at any time by clearing your browser's local storage.

11. Changes to this GDPR notice

We reserve the right to make changes to this GDPR information. Any changes will be communicated by updating the date at the top of this page. We encourage you to periodically review this content.