Politique de confidentialité

When you open a PDF in GenPDF, it is read and edited in your browser. It is not sent to us to edit its text or to use the page tools. Adding or removing a password (Protect, Unlock) happens in your browser too: neither the document nor the password is sent to us.

These tools do send something to our server, because they cannot work in a browser:

• Reading scanned pages: when a page of a PDF you open has no text (a scan or a photo), an image of that page is sent to be read as soon as the PDF opens, so that its text can be searched and edited.
• AI, where the site has it switched on: the text of the pages you choose, when you translate, summarise or ask about a document and agree to send it; and, on the paid plans, a picture of the one page you choose, with the lines the scan reader found on it, when you choose "Read this page with AI" and agree to send it. Both go on to Anthropic (see "Service providers").
• Word, Excel and PowerPoint to PDF: the file to convert.
• Fonts: when a PDF lacks a font, the font's name and the letters to draw, never the document.
• Older browsers: if your browser cannot run the editing engine, edits are made on our server instead.

What we receive is processed in memory or in a private temporary folder, the result goes back to you, and it is deleted as soon as the work is done. Nobody looks at it, it is not kept, and it is never used to train software.

Signature requests are the one case where we keep a document because you ask others to sign it (the other, a PDF you choose to share with a problem report, is described under "Data we keep"). The PDF is encrypted in your browser before it is sent, with a key made there. You choose how the signers get their links, and the choice is off unless you make it. By default the key is put only in the links you give to the signers (after the # of the address, a part browsers do not send). We keep the encrypted copy of the PDF and of each signed version, and we cannot read them: our emails to signers never contain the key. If you tick "Let GenPDF email the links", your browser also sends us the key, once, when you make the request. We seal it with encryption under a secret that is kept on our server and not in the database, use it to write the invitation, "your turn" and reminder emails that carry each signer's own link, and once, when the document arrives, to check that the key opens it (that check decrypts the document in memory for a moment; nothing decrypted is kept), and delete it from our database the moment the request is signed, declined, withdrawn or expires; a daily clean-up deletes any that an error left. While we hold the key we could technically open the document, which is why this is your choice. Those emails, which carry the key, pass through our email provider and the signers' own email providers, so we send them without click tracking or link rewriting. Deleting removes the key from the database, not from every trace its engine keeps: our database runs with its binary log switched off, but its internal logs may keep the sealed value until they are reused, and a copy of our database made before the key was deleted (a backup is kept for 30 days) could still hold it in its sealed form, which opens only with the secret that is kept apart. The audit trail of the request records which way the links were sent and when the key was deleted. Each signer's browser opens the document with the key from their link, adds their signature there and sends the signed copy back encrypted. Signers do not need an account.

If you create an account:

• your email address, and your name if you give it;
• your password, kept only as a salted one-way hash (scrypt) that cannot be turned back into the password;
• if you sign in with Google, your Google account's identifier and the address Google confirms;
• whether your address is confirmed, your language, your plan and the state of your account;
• for each signed-in browser: a hash of its sign-in key, its browser name and version, a hash of its internet address, and when it was last used;
• when we email you a link (to confirm your address or choose a new password): the address, a hash of the link, when it was sent and a hash of the internet address that asked for it.

If you buy a plan: your Paddle customer number, what you bought, the amount, currency and country, the dates, the state of your subscription, and the notifications Paddle sends us about them.

For the free plan's daily limits: how many times the server's tools were used, and how many files of each kind were downloaded (an edited PDF, a signed PDF, a Word export or another tool's result), each day, counted for your account, or, without an account, for a random identifier in a cookie and for a keyed hash of your internet address. A download sends only its kind, a random identifier for it and, for Word, its number of pages: never the document, its name or its text.

How the site is used (no account needed): we count the steps taken on the site, such as which tool was used, how many files were opened and downloaded, whether the app was installed, and the answer you give to the question about where your PDF came from. Each count is a number for a day, with the kind of step, one label such as the tool's name, and the language of the page; the first page of a visit also adds where the visit came from, as a broad group only (search, social, mail, direct and so on: the site that referred you is sent to us for this, and only the group is kept in these counts). The first page of a visit and a few main steps (opening a file, a download, opening a checkout, a purchase) are also counted by country: our server works out the country from your internet address with a copy of a geolocation database kept on the server (IP Geolocation by DB-IP, under the Creative Commons Attribution 4.0 licence), so the address is not sent to anyone else, and keeps only the two-letter country code. They hold no document, no file name, no text, no internet address, no browser identity and no identifier of you, and they set nothing on your device, so they cannot be traced to you. They are kept for 730 days (24 months).

How long visits last (no account needed): for each visit we also keep one line, for 90 days: the minute it began, your country (worked out as above), the broad group the visit came from and the name of the site that referred you (for example google.com, never a full address), the first page, the language of the page, the kind of device (phone, tablet or computer), how many seconds the page was visible and how many pages you saw. To measure the last two, our server gives the page a random key when a visit begins. The page keeps the key in its memory only: nothing is stored on your device and no cookie is set. While the page is open it sends the key to our server every 30 seconds, and when you leave the page or switch to another tab, with the seconds the page has been visible and the page you are on. The server holds the key in its memory, uses it to show the administrator how many visits are on the site now, and forgets it when the visit ends (when you close the page, or 30 minutes after its last message). The line we keep holds no internet address, no browser identity, no cookie, no key and no identifier of you.

If you ask others to sign a document: the title and message you write, the signers' email addresses and the language of their emails, the encrypted copies of the document, and an audit trail of the request: when it was made, sent, opened, signed or declined, and by whom; for each step, a keyed hash of the internet address it came from (never the address), the name of the browser (for example "Chrome on Windows") and the SHA-256 fingerprints of each version of the document. The signers' addresses, the times and the fingerprints are also written on the audit page added to the signed PDF, which each signer receives. We also count how many requests you make each month, for your plan's allowance.

If you write to us: your message and our reply.

If you report a problem (paid plans): the sentence you write, the date, your account, and a few facts about the editor and the file: the GenPDF version, your browser, the number of pages, the file's size and kind (text or scanned), the names of its fonts, the software the file names as its maker and the last error the page met; never the document's words, title, author or file name. The PDF itself is sent only if you tick the box that asks to share it. Only GenPDF's administrator can open the report and the PDF. To find the cause, the administrator may have an AI assistant (Claude, by Anthropic) read the PDF and your sentence on a temporary GitHub machine, which is wiped when the job ends; see "Service providers".

If you report an AI answer (the AI panel, on any plan): the kind of answer (translation, summary, answer, or a page read with AI), the language of the page and the short note you may write. It carries no name, no account, no document and not the question. It carries the answer itself only if you tick "Include this answer in the report": then the first 1,000 characters of that answer, shown to you before you send, go with it, so that we can see what was wrong and improve how AI answers are filtered. It is kept as a support message, which only GenPDF's administrator reads, until it is closed and deleted (at most 365 days after it was written).

To protect the service against attacks, our server also counts recent requests per internet address, in memory only, for a few minutes.

Security counts: to see attacks and sign-in trouble, our server counts what it turns away or notices: failed and paused sign-ins, sign-ups, password resets, sign-outs of other browsers, refused requests (from another site, or to the administrator's pages), requests that hit a limit, reports your browser sends when it blocks something our security rules do not allow, notifications from our payment provider with a wrong signature, and searches for pages that belong to other software (such as a WordPress login). Each count is a number for a day with the kind of event, one label (such as which limit was hit, the name of the site that was blocked, or the kind of page searched for; never the address asked for) and the two-letter country worked out on our server from the internet address, as for the counts above. Our server also keeps the latest 200 of these events in its memory, with the time, until it restarts. They hold no internet address, no account, no email address, no browser identity and no identifier of you, and they set nothing on your device. They are kept for 180 days, then deleted.

Groups of errors: when something fails in your browser, or on our server, we keep it as a group of the same error, so that we can see what to fix. A group holds what failed (the error's name and its message), where (the part of the app, the first line of its trace and the path of the page, never what follows the path), the version of the app, how many times it happened and on which days, and when it first and last happened. If you quote the reference that a browser's error message shows, it is kept in the group (the last 20 of them), so that we can find it. A group holds no internet address, account, cookie, browser name, document or file name. A program removes web addresses, email addresses, file names, quoted words and words outside plain ASCII from the message, and that cannot be perfect: the message of a library could, rarely, hold a short plain word that you typed, and we cannot promise it never does. Only GenPDF's administrator sees the groups. The daily counts are kept 90 days and a group 180 days after it last happened.

In the Android app, copies of the PDFs you open: so that you can open them again from Home and Files, the app keeps a copy of each PDF you open, the ten most recent and at most 150 MB in all, with its name, its number of pages, a small picture of its first page and the time you opened it. The copies are kept in the browser storage that the Android app uses for genpdf.com, on your phone (a database called genpdf-app) and are never sent to us. They are not part of your account, so deleting your account does not remove them. You can remove one under Files (Remove from list) or all of them under Account, Recent files. They are in the browser storage that the app uses for genpdf.com, so uninstalling the app does not necessarily remove them: to be sure, clear them under Account, Recent files, or clear genpdf.com's data in Android's settings. Opening a PDF, using a tool on it and saving never depend on them.

In the Android app, nothing of a third party counts you: the app loads no Google Analytics, no Microsoft Clarity and no ads, and asks no cookie question. A visit is counted only with the anonymous counts described above, as coming from "app" (the Android app).

• To provide the service you ask for (performing our contract with you): your account, signing in, your plan and its limits, emails about your account, and the signature requests you make and the emails they send.
• To keep GenPDF safe and fair (our legitimate interest): stopping password guessing, abuse and fraud, and keeping the free plan's limits fair.
• To meet legal duties: keeping purchase records as accounting and tax law require.
• To know what to fix and whether the service works (our legitimate interest): the anonymous daily counts of steps described under "Data we keep". They cannot be traced to you and need no cookie.
• To count visits with Google Analytics, and to see clicks and scrolling on the public pages with Microsoft Clarity (your consent where the law asks for it; elsewhere our legitimate interest): where the law asks for consent, their cookies are set only if you accept them in the cookie notice; until you answer, Google receives only visits counted without cookies and Microsoft Clarity is off; elsewhere both start from your first visit. Wherever you are, Decline or Cookie settings stops them, and the Global Privacy Control signal counts as a Decline.
• To show advertising from Google AdSense on the public pages that have it (your consent where the law asks for it; elsewhere our legitimate interest in paying for the service): see "Advertising (Google AdSense)". Where the law asks for your consent, the advertising code is not loaded until you accept; Decline, Cookie settings and the Global Privacy Control signal stop it.

We do not use your documents, your account or anything you type for advertising, and we do not sell or rent data to anyone. GenPDF itself builds no advertising profiles. On the public pages that show Google AdSense ads, Google and its partners may use cookies to personalise the ads, as described under "Advertising (Google AdSense)".

GenPDF sets the cookies it needs to work without asking. The others are Google Analytics', Microsoft Clarity's and, on the public pages that show ads, Google AdSense's advertising cookies (see "Advertising (Google AdSense)"). Where the law asks for your consent, they are set only if you accept them; until you answer, Google Analytics sets none, and Microsoft Clarity and the ads are off. Elsewhere they are set from your first visit, and Cookie settings turns them off. The advertising cookies are Google's, not GenPDF's own. The anonymous counts of steps (see "Data we keep") need no cookie and nothing kept on your device. The Android app sets none of the others: it loads no Google Analytics, no Microsoft Clarity and no ads, so it has no cookie notice and no Cookie settings.

Google Analytics. We count visits to understand which pages are used, with Google Analytics 4, loaded from Google. Where the law asks for your consent (the European Economic Area, the United Kingdom, Switzerland and other countries with similar laws), the cookie notice asks first: until you answer, Google Analytics sets no cookie and receives each page as a visit it cannot link to any other, from which Google estimates the number of visits; if you press Accept, it sets the cookies below. Elsewhere, it sets the cookies below from your first visit, without a notice. Our server tells your browser which applies from the country of your internet address, looked up in a database on our own server; the address is not kept for this, and when the country cannot be told, we ask. Google Analytics receives the address of each page you open (without anything after a ? or #), the page's title, your approximate location (worked out from your internet address, which Google Analytics does not log or store), your device, browser and language, and how you reached the site. It receives no document, no text from a document and no file name, and we switch off its advertising features (Google signals and ad personalisation), so it is not used for advertising. It also receives the same steps as events (for example: a file opened, a download, the start of a checkout, a purchase's plan and amount, a signature request sent), with the same labels and never a document, text or file name.

If you press Decline, or use Cookie settings (at the foot of every page and in the editor's File menu) to say no or take your answer back, Google Analytics stops, the counting without cookies included, Microsoft Clarity stops, the ads on the page are hidden and no more are asked for, and the cookies above, Clarity's (_clck, _clsk) and Google's advertising cookies on this site (__gads, __gpi, __eoi) are deleted from your browser. If your browser sends the Global Privacy Control signal, we take it as a Decline and do not ask. The data Google Analytics has already received is kept in Google Analytics as we have configured it: 14 months, then deleted.

Microsoft Clarity. On the public pages only (never the editor, the signing pages or your account), Microsoft Clarity shows us where visitors click and scroll, so that we can see what confuses people. It follows the same rule as Google Analytics: where the law asks for your consent it is loaded only after you accept, and elsewhere from your first visit; Decline, Cookie settings and the Global Privacy Control signal stop it and delete its cookies. It sets _clck (recognises a returning visitor, up to a year) and _clsk (joins the pages of one visit, a day).

When you open a checkout, Paddle's checkout loads from Paddle and may set its own cookies, under Paddle's privacy policy.

Apart from Google Analytics, Microsoft Clarity and Google's ads (where you accept them, or where no consent is asked), and the checkout, our pages load nothing from other companies' servers: the fonts and scripts come from genpdf.com itself.

Some of GenPDF's public pages show advertising from Google AdSense, which helps pay for running the site. Google, not GenPDF, chooses and serves the ads. This section says where they appear, what Google and its partners may collect through them, when they load, and how to say no.

Where ads appear. Only on public information pages: today the home pages (in every language), and possibly the blog and the guides later. Never in the editor, and never on a document, a signing link, an account page or the dashboard. The ads are never given a document, its text or its file name, and nothing you type in GenPDF reaches them.

Cookies and advertising. Third-party vendors, including Google, use cookies to serve ads based on a visitor's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to visitors based on their visit to this site and/or other sites on the Internet. When an ad is loaded, your browser sends Google the address of the page, your internet address, details of your browser and device, and Google's cookies, so that Google can choose, show and count the ad and guard against fraud. Google decides for itself how it uses this information, under its own privacy policy; unlike Google Analytics, Google does not act as our processor for advertising. GenPDF does not receive this information: we see only the totals Google reports to us (impressions, clicks and earnings), not who you are.

Google and its partners may also set cookies on their own domains (such as google.com or doubleclick.net) when an ad loads. We can neither read nor delete those; Google's How Google uses cookies describes them.

When the ads load. The rule is the one for Google Analytics and Microsoft Clarity. Where the law asks for your consent (the European Economic Area, the United Kingdom, Switzerland and other countries with similar laws), the advertising code is not loaded at all until you press Accept in the cookie notice, and it is never loaded if you press Decline or have not answered. Elsewhere it loads from your first visit to a page that shows ads, without a notice, and Decline or Cookie settings stops it. A browser that sends the Global Privacy Control signal counts as a Decline: no advertising code is loaded. If you take your answer back with Cookie settings, the ads on the page are hidden, no more are asked for, and the advertising cookies above are deleted from your browser. In the European Economic Area, the United Kingdom and Switzerland, Google may also ask for your choices about advertising in a message of its own.

Your choices.

• You can opt out of personalised advertising in Google's My Ad Center / Ads Settings: https://myadcenter.google.com.
• You can opt out of some third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices, and, in Europe, at https://www.youronlinechoices.eu.
• You can say no here, at any time, with Cookie settings (at the foot of every page and in the editor's File menu), or by sending the Global Privacy Control signal.
• You can block or delete cookies in your browser's settings.

To learn how Google uses information from sites that use its services, read How Google uses information from sites or apps that use our services (https://policies.google.com/technologies/partner-sites). Google's own privacy policy is at https://policies.google.com/privacy.

What GenPDF does and does not do. GenPDF does not sell your data, does not give Google your documents or your account details, and builds no advertising profile of you itself. Google may build and use one to personalise ads, under the rules and choices above.

We use a small number of services, each only for what it does for us, and under its own data-protection obligations:

Some of these services are in other countries than yours. Where the law requires it, data sent to them is protected by recognised safeguards, such as the European Commission's standard contractual clauses. This includes Google, which may handle Google Analytics and advertising data outside the European Union.

• Documents sent to a server tool: not kept; deleted when the work is done.
• Signature requests: the encrypted copy is deleted at once when a request is withdrawn, declined or expires, and 30 days after everyone has signed; the request's details, the signers' addresses and the audit trail are deleted 30 days after it ended. A request that was never sent is deleted within a day. The monthly counts are kept for about 13 months. Deleting your account deletes your requests. A key that we hold to email a request's links is deleted the moment the request ends, and again by the daily clean-up if anything is left.
• A PDF shared with a problem report: 30 days at most, and deleted at once when the problem is closed as fixed or not to be fixed.
• Problem reports: a report is deleted 365 days after its last change, whether it is closed or not. Deleting your account deletes your reports and any PDF shared with them.
• Your account: until you delete it. Deleted on your account page, it is erased at once; when you ask us, within 30 days. Purchase records are kept.
• Signed-in browsers: deleted 7 days after the session ends.
• Emailed links: the record is deleted after 30 days; the link itself stops working much sooner.
• Daily usage counts: deleted after 90 days.
• Daily counts of steps (the anonymous counts of how the site is used): 730 days (24 months), then deleted.
• The line kept for each visit (when it began, country, site it came from, first page, language, kind of device, how long it lasted and how many pages): deleted after 90 days. The key that measures it is never kept: it is forgotten when the visit ends.
• Security counts (the anonymous counts of attacks and sign-in trouble): 180 days, then deleted; the latest 200 events in memory are gone when the server restarts.
• Payment notifications from our payment provider: the customer's details and the payment method in them are removed the day after we have applied them; the rest is deleted after 90 days.
• Purchase records: as long as accounting and tax law require, usually up to 10 years.
• Server logs (errors, never your documents): at most 30 days.
• Groups of errors (what failed, on which page, in which version of the app, and how often; never your documents or file names, and what looks like something you typed is removed as well as a program can, which is not perfect): the daily counts 90 days, a group 180 days after it last happened.
• Recent files in the Android app: on your phone only, until you remove them (one by one under Files, or all under Account, Recent files) or clear genpdf.com's data in Android's settings (uninstalling the app does not necessarily remove them); the ten most recent files and 150 MB at most, the oldest going first.
• Advertising (Google AdSense): its cookies on this site up to 13 months unless you say no sooner with Cookie settings, which deletes them. What Google keeps about ads it keeps under its own policies; GenPDF keeps only the totals Google reports (impressions, clicks and earnings), which identify nobody.
• Google Analytics: its cookies up to 2 years unless you say no sooner with Cookie settings, which deletes them; the data it collects is kept as configured in Google Analytics, 14 months, then deleted. Your answer (Accept or Decline) is kept in your browser for 12 months.

On your account page you can download a copy of everything we hold about your account, as a file, and delete your account yourself: it is erased at once, apart from the record of payments that the law requires us to keep. You can also ask us to show you the data we hold about you, to correct it, to delete it, or to stop using it for a purpose you object to. Write to support@genpdf.com from the address of your account; we answer within 30 days.

You can stop Google Analytics, Microsoft Clarity and Google's ads at any time with Cookie settings (where it asked for your consent, you take your consent back); this does not affect what was counted before. You can also turn off personalised ads in Google's My Ad Center.

You can also complain to the data-protection authority of the country where you live, for example your national authority in the European Union, or the ICO in the United Kingdom.

This is how to delete your GenPDF account and the data tied to it, whether you use GenPDF in the Android app, in a browser, or no longer have the app installed.

• In the app or on genpdf.com: sign in, open your account's Privacy & data page, choose Delete account… and confirm with your email address (and your password, if you have one). The account is erased at once.
• Without signing in, or without the app: send us the deletion request from the address of your account (the form already says what to do), or write to support@genpdf.com from that address with the subject "Delete my GenPDF account". We answer by email to check that the request is yours, and delete the account within 30 days.

What is deleted: your name, your email address, every way of signing in (password and Google), your signed-in browsers, your teams' memberships, your plan records, your problem reports (and any PDF shared with them), your signature requests and your messages to support. What stays: the copies of PDFs that the Android app keeps on your phone (they are not part of your account: remove them under Account, Recent files, or clear genpdf.com's data in Android's settings), and the record of payments, kept without your name or email and with Paddle's reference numbers, for as long as accounting and tax law require; the anonymous counts of how the site is used, which were never linked to you; and nothing of your documents, which we never stored.

If you pay for a plan: a running subscription would keep charging an account that no longer exists, so it has to be cancelled first. In the browser, cancel it from your account page; in the app, or if you cannot, write to us and we will cancel it. The account can be deleted once nothing more will be charged.

Connections to GenPDF are encrypted. Passwords and sign-in keys are stored only as hashes, internet addresses only as keyed hashes, and access to our servers is restricted. Repeated wrong passwords pause sign-in to an account. No system is perfectly secure: if a breach affecting your data happens, we will tell you and the authorities as the law requires.

GenPDF is not meant for children under 16, and we do not knowingly keep data about them. If you think a child has created an account, write to us and we will delete it.

When we change how we handle data, we update this page and its date. If a change matters to you, we tell account holders by email before it applies.