GDPR Compliance
Last updated: October 30, 2026
PDFtoWorld is built for the European market and designed around the GDPR's principles of data minimisation, purpose limitation and storage limitation.
Highlights
- Files deleted after 24 hours, automatically, both in storage (bucket lifecycle) and in our database (scheduled job).
- Most tools run in your browser. Your document only reaches our servers when you export it or use conversion or document tools.
- EU hosting for the database (Paris) and files (EU jurisdiction).
- No training on your documents by us or our processors.
- Self-service rights: export or delete your data from the dashboard.
- Consent-first analytics, Google Consent Mode v2 defaults to denied.
- Security: encryption in transit and at rest, row-level security, malware scanning, rate limiting, audit logs.
Records
We maintain a record of processing activities (art. 30), conduct DPIAs where required and notify personal data breaches within 72 hours (art. 33).
Business customers
A Data Processing Agreement under art. 28 is available on the DPA page and applies automatically to business subscriptions.