Privacy Policy

1. Introduction

Welcome to PDFik.net (“PDFik”, “we”, “us”, or “our”). PDFik.net is operated as a Jednoosobowa Działalność Gospodarcza (JDG — sole proprietorship) registered in Poland under Polish commercial law. We provide a PDF generation API and related SaaS services accessible at pdfik.net.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data when you use our website, dashboard, and API services. It also describes your rights under the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), Polish data protection law (UODO), and, where applicable, the California Consumer Privacy Act (CCPA) as amended by the CPRA.

Data Controller: PDFik.net (JDG registered in Poland). For all data-protection matters, we act as the data controller within the meaning of Art. 4(7) GDPR.

Data Protection Officer / Privacy Contact: We have designated [email protected] as the primary point of contact for all GDPR-related inquiries, data subject requests, and complaints.

This policy applies to (a) the pdfik.net website and marketing pages; (b) the PDFik web dashboard; and (c) the PDFik PDF Generation API, including all associated endpoints, webhooks, and SDKs. By creating an account or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data We Collect

We collect the following categories of personal data. For each category we specify the legal basis under GDPR Art. 6.

a) Account Data

• Email address (provided through Google Firebase Authentication)
• Google account display name and profile photo URL (if provided by Google)
• Firebase UID (unique identifier assigned by Firebase)
• Account creation date and last login timestamp
• Plan tier (Free, Starter, Pro, or Business)

Legal Basis: Contractual necessity — Art. 6(1)(b) GDPR. Processing is necessary to perform the contract with you (provision of the PDFik service).

b) Payment Method Data (Card Binding)

PDFik requires all accounts — including accounts on the Free plan — to bind a valid payment method via Stripe’s SetupIntent flow. This enables us to prevent automated abuse and to charge for overages or plan upgrades without friction. The following data is collected as part of this process:

• Card last four digits and card brand (e.g., “Visa ****4242”) — stored by PDFik for display purposes in your dashboard
• Stripe Payment Method ID (a reference token such as pm_xxx) — stored by PDFik to reference your card in Stripe
• Account status flag (active / inactive) — derived from the presence or absence of a valid payment method; determines whether your API key is enabled

Important: PDFik.net does not store full card numbers, CVV/CVC codes, expiry dates, or any other sensitive card data. All cardholder data is processed and stored exclusively by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. PDFik receives only non-sensitive metadata (last four digits, brand) via Stripe’s API after the SetupIntent is confirmed.

Legal Basis: Contractual necessity — Art. 6(1)(b) GDPR. A valid payment method is a prerequisite for activating your account and using the API; processing this data is necessary to perform the contract and to prevent fraudulent or automated abuse of the service.

c) Billing & Subscription Data

• Current plan type and billing interval (monthly/annual)
• Invoice history: amounts, currency, issue dates, due dates, and payment status
• Stripe Customer ID (reference token, e.g., cus_xxx)
• Stripe Subscription ID (if on a paid plan)
• Billing address (if provided for invoice purposes)
• VAT/Tax ID (if provided by business customers)

Legal Basis: Legal obligation — Art. 6(1)(c) GDPR. Tax and accounting records are required to be retained under Polish accounting law (Ustawa o rachunkowości of 29 September 1994) and VAT regulations applicable to us as a Polish business entity.

d) API Usage Metrics

• Job IDs, request timestamps, HTTP status codes, and API endpoints called
• PDF render duration, output file size, and page count per job
• Monthly PDF generation count (used for plan quota enforcement)
• API key usage: last-used timestamp and associated request count
• Webhook endpoint URLs and delivery status (success/failure, retry count)

Legal Basis: Legitimate interests — Art. 6(1)(f) GDPR. We process usage metrics to ensure accurate billing, enforce plan quotas, improve service performance, and detect fraudulent or abusive usage patterns. Our legitimate interests are not overridden by your rights given the limited personal impact of aggregate usage metrics.

e) Technical & Security Data

• IP addresses — used for the API key IP-whitelist feature and security monitoring
• User-agent strings from API requests and dashboard sessions
• Audit logs: API key creation and revocation events, subscription change events, account deletion requests, and administrative actions
• Failed authentication attempts and rate-limit breach events

Legal Basis: Legitimate interests — Art. 6(1)(f) GDPR. Security monitoring, abuse prevention, and auditability are necessary for operating a trustworthy API platform.

f) Communication Data

• Email notification preferences (quota warnings, billing alerts)
• Opt-in status for product update and newsletter emails
• Support ticket content and history (when you contact us)

Legal Basis: Consent — Art. 6(1)(a) GDPR — for optional marketing and product update emails. Contractual necessity / Legitimate interests — Art. 6(1)(b) and 6(1)(f) — for transactional emails (invoices, quota warnings, security alerts) that are essential to delivering the service.

g) Generated PDF Content (Ephemeral — Max 24 Hours)

• URLs and HTML markup submitted to the API for rendering — processed ephemerally in memory and not logged to persistent storage beyond the job record
• Generated PDF files — temporarily stored in encrypted Amazon S3 (AWS us-east-1) to allow you to retrieve the output; each file is available for download for 24 hours; physically deleted within 48 hours by an S3 lifecycle policy

Legal Basis: Contractual necessity — Art. 6(1)(b) GDPR. Temporary storage is required to make generated PDFs retrievable via the API response and download URLs.

Important: PDFik does not read, analyse, index, or use the content of your PDFs for any purpose other than fulfilling your render request. We do not perform behavioral profiling based on PDF content.

3. Automated Processing & Profiling

We use certain automated processes to operate the PDFik platform. We are transparent about these below.

Account Status Determination (GDPR Art. 22)

Your account is automatically assigned a status of active or inactive based solely on whether a valid payment method (Stripe Payment Method) is linked to your account. An inactive account has its API key access blocked automatically; no manual intervention is required. This constitutes automated decision-making within the meaning of GDPR Art. 22 because it produces a legal or similarly significant effect on your ability to use the service.

Your right to human review: You have the right to request human review of any automated account-status decision. To do so, please contact [email protected] with the subject line “Human Review Request — Account Status”. We will review your case manually and respond within 5 business days.

Quota & Billing Calculations

Your monthly PDF generation count is tracked automatically and compared against your plan’s quota. Overage charges (where applicable) and plan-limit notifications are triggered automatically based on these counts. These calculations determine your invoice amounts.

No Behavioural Profiling

We do not build behavioural profiles of individual users for advertising or marketing purposes. We do not use your PDF content, rendering history, or usage patterns to make inferences about you beyond what is necessary to operate the service and enforce plan limits.

4. Data Storage & Security

We take security seriously and implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

• Infrastructure: All PDFik services run on Amazon Web Services (AWS) in the us-east-1 (Northern Virginia, USA) region. Data transfer to the USA is governed by Standard Contractual Clauses (see Section 5).
• Encryption at rest: All databases (including user records, billing data, API usage logs, and audit logs) and Amazon S3 buckets (containing generated PDFs) are encrypted using AES-256.
• Encryption in transit: All client-to-server and service-to-service communications are protected with TLS 1.3 or higher. HTTP connections are redirected to HTTPS.
• Webhook secrets: Webhook signing secrets are stored encrypted in the database using AES-256-GCM and are never logged in plaintext.
• Access control: We apply the principle of least privilege via AWS IAM policies. Access to production systems is restricted to authorised personnel only and requires multi-factor authentication (MFA).
• Access reviews: Internal access rights to production data are reviewed periodically. Access is revoked upon change of role or employment.
• Penetration testing: We conduct periodic security assessments and address findings according to severity. Critical and high findings are remediated within 30 days of discovery.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. If you discover a potential security vulnerability, please disclose it responsibly to [email protected].

5. International Data Transfers

PDFik.net is a Polish entity operating under EU law. However, we use cloud infrastructure and third-party processors based in the United States. Transfers of personal data to the USA are governed by the following mechanisms:

• Amazon Web Services (AWS us-east-1): We have executed AWS’s Standard Contractual Clauses (SCCs) for data processing, incorporating the EU Commission’s model clauses per Decision 2021/914. AWS also maintains Binding Corporate Rules and participates in the EU-US Data Privacy Framework.
• Stripe, Inc.: Payment data is processed by Stripe, which provides SCCs as part of its Data Processing Agreement (DPA). Stripe is PCI-DSS Level 1 certified. Stripe also participates in the EU-US Data Privacy Framework.
• Google Firebase (Google LLC): Firebase Authentication is provided by Google LLC (USA). We have entered into Google Cloud’s Data Processing Addendum (DPA), which incorporates SCCs. Google participates in the EU-US Data Privacy Framework.
• Cloudflare, Inc.: Web traffic filtering, DNS resolution, Web Application Firewall (WAF), DDoS protection, and CDN routing are provided by Cloudflare, Inc. (USA / Global Edge). We have executed Cloudflare’s Data Processing Addendum (DPA), which incorporates Standard Contractual Clauses (SCCs). Cloudflare also participates in the EU-US Data Privacy Framework.

In all cases, the transfer mechanisms ensure that your personal data receives a level of protection essentially equivalent to that guaranteed within the European Economic Area (EEA). You may request a copy of the applicable Standard Contractual Clauses by emailing [email protected].

6. Third-Party Data Processors

We engage the following sub-processors to operate PDFik. We maintain written Data Processing Agreements (DPAs) with each of them in accordance with GDPR Art. 28. We will notify you at least 30 days in advance of any material changes to our sub-processor list (e.g., additions or replacements) via email or in-app notification.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes. We only share personal data with processors where necessary to deliver the service.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The table below sets out our retention schedules:

Upon expiry of the applicable retention period, personal data is either securely and permanently deleted or irreversibly anonymised so that it can no longer be associated with any individual. Where deletion is not immediately possible (e.g., data in encrypted backups), we restrict processing and ensure deletion occurs at the earliest feasible point.

8. Your Rights (GDPR — Chapter III)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights with respect to your personal data. We will respond to all verifiable requests within 30 calendar days of receipt. For complex or numerous requests, we may extend this period by a further 60 days, in which case we will notify you within the initial 30-day period explaining the reason for the extension.

a) Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data along with supplementary information (purposes, categories, recipients, retention periods). You can export all data associated with your account at any time via Dashboard → Account → Export Data, which produces a machine-readable JSON file. For more comprehensive access requests, contact [email protected].

b) Right to Rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected. You may update your email address directly through Firebase Authentication settings in your Google account. For other data corrections (e.g., billing address, VAT ID), please contact [email protected].

c) Right to Erasure / ‘Right to Be Forgotten’ (Art. 17 GDPR)

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent was the legal basis). You can request account deletion at any time via Dashboard → Account → Delete Account. The request marks the account for deletion and is processed manually within 30 days, after which we permanently delete your account data and generated PDFs. Please note that certain data — notably billing and invoice records — must be retained for the legally prescribed periods under Polish accounting law (5 years) and cannot be immediately erased.

d) Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data, or where processing is unlawful but you prefer restriction over deletion. To request restriction, contact [email protected] with the subject “Data Subject Request — Restriction”.

e) Right to Data Portability (Art. 20 GDPR)

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. A JSON export of all your account data, usage history, and billing records is available directly in Dashboard → Account → Export Data.

f) Right to Object (Art. 21 GDPR)

You have the right to object at any time to processing of your personal data where the legal basis is our legitimate interests (Art. 6(1)(f)). Upon receipt of an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of legal claims. Contact [email protected] with the subject “Data Subject Request — Objection”.

g) Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR)

As described in Section 3, account status is determined by automated processing. You have the right to (i) obtain human intervention; (ii) express your point of view; and (iii) contest the automated decision. To exercise this right, email [email protected] with the subject “Human Review Request — Account Status”.

h) Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the competent supervisory authority. In Poland, this is:

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.

9. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Polish supervisory authority (UODO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33.
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to your rights and freedoms, in accordance with GDPR Art. 34. Notification will be sent to the email address associated with your account.
• Document all breaches internally, including those that do not require notification, in our breach register.

To report a suspected security vulnerability or incident, contact [email protected]. We take all reports seriously and will respond promptly.

10. Children’s Privacy

PDFik.net is a developer-focused API platform intended exclusively for use by individuals aged 18 and above (or the applicable age of majority in your jurisdiction) and by business entities. Our services are not directed at, and we do not knowingly collect personal data from, persons under the age of 18.

If you are a parent or guardian and believe that a minor has created an account or provided personal data to us, please contact [email protected] immediately. We will take prompt steps to verify the claim and, if confirmed, delete the minor’s data from our systems.

11. California Privacy Rights (CCPA / CPRA)

If you are a resident of the State of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights in addition to those described elsewhere in this policy:

• Right to Know: You have the right to know what categories and specific pieces of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions (e.g., legal obligations, security).
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: PDFik.net does not sell personal information, nor do we share personal information for cross-context behavioural advertising. This right is therefore not applicable, but we provide this disclosure for transparency.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (as defined under CPRA) for purposes beyond those necessary to provide the service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. Exercising your rights will not result in denial of service or different pricing.

To submit a CCPA/CPRA request, please email [email protected] with “CCPA Request” in the subject line, specifying the right you wish to exercise. We will verify your identity before processing your request. You may authorise an agent to submit a request on your behalf.

12. Data Processing Agreement (DPA)

If you use PDFik to process personal data of your own customers or end-users (for example, generating PDFs that contain customer information), you may act as a data controller and PDFik acts as your data processor under GDPR Art. 28. In this case, you may require a formal Data Processing Agreement (DPA) between our organisations.

Enterprise and business customers who require a signed DPA may request one by emailing [email protected] with the subject line “DPA Request”. Please include your company name, registered address, and any specific requirements. We will provide a completed DPA within 5 business days of receipt of your request.

A template DPA summary is available at pdfik.net/legal/dpa. The DPA incorporates Standard Contractual Clauses where international data transfers are involved and specifies the subject matter, duration, nature, and purpose of processing, the type of personal data, and the categories of data subjects in accordance with GDPR Art. 28(3).

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons. We distinguish between two types of changes:

• Material changes — changes that significantly affect how we process your personal data (e.g., new data categories, new processors, changes to retention periods, changes to your rights). We will provide at least 14 days’ prior notice of material changes by email to the address associated with your account and/or by a prominent notice in the dashboard. The change will take effect on the date specified in the notice.
• Non-material changes — minor updates such as clarifications, corrections, or formatting improvements that do not affect the substance of how we process your data. These take effect immediately upon posting to this page.

The “Last updated” date at the top of this page reflects when the policy was last revised. Your continued use of PDFik services after the effective date of any updated policy constitutes your acceptance of the revised policy. If you do not agree with the changes, you should discontinue use of our services and delete your account before the effective date.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact us using the appropriate channel below:

• General privacy inquiries: [email protected]
• Data subject requests (access, rectification, erasure, portability, objection, restriction): [email protected] — please use the subject format “Data Subject Request — [Right]” (e.g., “Data Subject Request — Erasure”)
• Legal & DPA inquiries: [email protected]
• Security vulnerabilities & incidents: [email protected]
• General support: [email protected]
• Postal address: As registered in the Polish Central Registration and Information on Business registry (CEIDG). You may request our full registered address by emailing [email protected].

We are committed to resolving privacy concerns promptly and fairly. If you are not satisfied with our response to a data subject request, you retain the right to lodge a complaint with the UODO (see Section 8h above).

For reference, our other legal documents are available at:

• Terms of Service
• Data Processing Agreement (DPA)
• Cookie Policy
• Service Level Agreement (SLA)