Introduction

At PDFCrate ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains what information we collect when you use our website at pdfcrate.com, how we use it, who we share it with, and what rights you have regarding your personal data.

By using PDFCrate, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please discontinue use of our services.

1. Who We Are

PDFCrate is an online platform providing free PDF processing tools and AI-powered PDF features available at pdfcrate.com. We operate both free tools that require no account and subscription-based AI tools that require registration.

For any privacy-related questions, contact us at: privacy@pdfcrate.com

2. Information We Collect

We collect two types of information: information you provide to us directly, and information collected automatically when you use our services.

2.1 Information You Provide

Account registration: When you create an account, we collect your full name and email address. We store your password in an irreversibly hashed format — we cannot see or recover your actual password.

Payment information: When you subscribe to a paid plan, payment is processed entirely by Stripe, Inc. We do not store your credit card number, CVV, or full payment card details on our servers at any point. We do store your Stripe Customer ID, subscription status, and billing history to manage your account.

Contact form submissions: If you contact us through our contact form, we collect your name, email address, and the content of your message so we can respond to you.

Files you upload: When you use our PDF tools, you upload files to our servers for processing. These files may contain personal data belonging to you or to third parties. We treat all uploaded files as strictly confidential and process them solely to perform the specific operation you requested.

Bank statements and financial documents: When you use the AI Bank Statement to Excel Converter, you may upload documents containing sensitive financial information including transaction history, account numbers, balances, and personal identification details. We apply the same automatic deletion policy to these documents as to all other uploaded files — bank statements are deleted from our servers within one hour of upload or processing completion. We store only the last four digits of any account number if it appears in the AI-extracted output you download. We do not retain, analyse, or store the financial data extracted from your documents beyond serving the result file to you.

See Section 4 for our complete file deletion policy.

2.2 Information Collected Automatically

Server log data: Our servers automatically record standard web server log information including your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of each request. This data is used for security monitoring, diagnosing technical issues, and preventing abuse. Log data is retained for a maximum of 14 days unless a security incident requires longer retention for investigation purposes.

Session cookies: We use essential session cookies to keep you logged in during your visit. These cookies are temporary and are deleted when you close your browser. We do not use persistent tracking cookies for advertising purposes on our own platform.

Analytics data: We use Google Analytics 4 to understand how visitors use our website — which tools are popular, how long people spend on each page, and where visitors come from geographically. Google Analytics collects anonymized usage data. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

Advertising and conversion tracking: We may use Facebook Pixel and similar tools to measure the effectiveness of our marketing campaigns. These tools help us understand which advertising led people to sign up for PDFCrate. You can opt out of interest-based advertising through your browser settings or through the Digital Advertising Alliance opt-out tool at optout.aboutads.info.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide our services: Your name, email, and subscription status are used to manage your account, authenticate your login, enforce credit limits, and deliver the services you have paid for.

To process payments: We share necessary billing information with Stripe to process subscription payments and send you receipts and invoices. We do not process card payments ourselves.

To communicate with you: We use your email address to send account verification emails, password reset links, subscription receipts, service announcements, and responses to your support enquiries. We will not send you unsolicited marketing emails without your explicit consent.

To improve our services: Anonymized usage data helps us understand which tools are most useful, identify technical problems, and prioritize new features.

To prevent fraud and abuse: IP addresses and usage patterns are monitored to detect automated abuse, prevent unauthorized access, and protect the integrity of our platform.

To comply with legal obligations: We may retain or disclose information where required to do so by applicable law or in response to a valid legal request from a law enforcement authority.

4. File Handling and Deletion

This section is critically important and reflects a core commitment of our service.

Uploaded files: Files you upload to PDFCrate for processing are stored temporarily on our servers solely for the purpose of performing the requested operation. We do not read, analyze, inspect, or share the contents of your files for any purpose other than completing the processing task you initiated.

Automatic deletion: All uploaded files and processed output files are automatically and permanently deleted from our servers within one hour of upload or processing completion, whichever is later. This deletion is unconditional — we do not retain copies, create backups of your files, or store them in any secondary location.

SSL encryption: All file transfers to and from our servers are protected using SSL/TLS encryption. Files are not transmitted or stored in plaintext.

No file analysis: We do not use the contents of your documents to train AI models, extract personal information, index content, or for any purpose other than the specific tool operation you requested.

AI tool files: Files submitted to our AI-powered tools (PDF AI Summarizer, PDF AI Translator, AI Bank Statement to Excel) are transmitted to OpenAI's API for processing in addition to being temporarily held on our servers.

For the AI Bank Statement to Excel Converter specifically, each page of your bank statement is converted to a high-resolution image and sent to OpenAI's API for transaction extraction. The extracted data is then compiled into an Excel file and served to you for download. Neither the original PDF pages nor the extracted transaction data is retained on our servers after your download link has been generated. The Excel output file is automatically deleted from our servers after it is served, or within one hour if not downloaded.

OpenAI's handling of submitted data is governed by OpenAI's API data usage policies, available at openai.com/policies/privacy-policy. As of July 2026, OpenAI does not use API-submitted data to train its models by default. We recommend reviewing OpenAI's current policy before submitting highly sensitive financial documents.

5. Third-Party Services We Use

We work with the following third-party service providers. Each processes data only as necessary to provide their service to us:

Stripe, Inc. — payment processing. Stripe receives your payment card details directly and processes subscription payments on our behalf. Stripe is PCI DSS compliant. Privacy policy: stripe.com/privacy

Google LLC — analytics (Google Analytics 4) and optional advertising measurement. Google may process data in the United States. Privacy policy: policies.google.com/privacy

Meta Platforms, Inc. (Facebook) — optional conversion tracking via Facebook Pixel and Conversions API. Privacy policy: facebook.com/policy.php

OpenAI, L.L.C. — AI processing for PDF AI Summarizer, PDF AI Translator, and AI Bank Statement to Excel tools. Files submitted to these tools are transmitted to OpenAI's API. Privacy policy: openai.com/policies/privacy-policy

Note on financial data: When you use the AI Bank Statement to Excel Converter, page images of your bank statement are transmitted to OpenAI. These images may contain your name, partial account number, transaction descriptions, and balance figures. While OpenAI's API terms prohibit using this data for model training, users with highly sensitive financial documents (corporate accounts, high-net-worth statements, or documents subject to professional confidentiality obligations) should consider whether cloud AI processing is appropriate for their specific circumstances.

Email delivery provider — transactional emails (account verification, password resets, receipts) are sent via a third-party SMTP provider. This provider receives your email address and the content of transactional emails only.

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes, under any circumstances.

6. Cookies

PDFCrate uses cookies in the following ways:

Essential session cookies: Required for you to stay logged in during a browsing session. These expire when you close your browser and cannot be disabled without breaking core functionality.

Analytics cookies: Set by Google Analytics to collect anonymized usage statistics. You may disable these through your browser settings or via the Google Analytics opt-out tool without losing access to any PDFCrate features.

Advertising cookies: Set by Facebook Pixel if you arrive at PDFCrate through a Facebook advertisement. These help us measure campaign effectiveness. You can opt out through Facebook's ad settings at facebook.com/ads/preferences.

You can configure your browser to refuse all cookies, or to alert you when cookies are being sent. Disabling analytics and advertising cookies will not affect your ability to use PDFCrate's tools.

7. Data Retention

Account data: We retain your name, email address, and account information for as long as your account is active. If you delete your account, your personal data is permanently deleted within 30 days, except where we are required to retain it for legal or tax compliance purposes (such as transaction records, which may be retained for up to 7 years in accordance with applicable financial record-keeping laws).

Subscription and transaction records: Billing records are retained for the period required by applicable tax and accounting law in your jurisdiction.

Server logs: Standard server log files are retained for 14 days and then automatically deleted, except in the event of a security incident where extended retention may be necessary.

Contact form messages: Messages submitted through our contact form are retained until the matter is resolved and for a reasonable period thereafter for reference purposes.

8. International Data Transfers

PDFCrate's servers are currently located in [JURISDICTION — to be updated by the site owner with the actual server location]. If you are accessing PDFCrate from outside this jurisdiction, your data may be transferred to and processed in a country whose data protection laws differ from your own.

Where we transfer personal data to third-party providers in countries without equivalent data protection standards, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by relevant regulatory authorities. This includes data transmitted to OpenAI for AI tool processing, including bank statement page images submitted to the AI Bank Statement to Excel Converter.

9. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.

Right to rectification: You may ask us to correct inaccurate or incomplete personal data. You can update your name and email address directly through your Profile page.

Right to erasure: You may request deletion of your personal data. You can delete your own account at any time through your Profile page. This permanently removes your personal information from our systems within 30 days, subject to legal retention obligations.

Right to restrict processing: You may ask us to temporarily halt processing of your data in certain circumstances, such as while a dispute about accuracy is being resolved.

Right to data portability: You may request your personal data in a structured, machine-readable format so you can transfer it to another service.

Right to object: You may object to processing of your personal data where we rely on legitimate interests as our legal basis.

Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Right to complain: If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with a data protection supervisory authority in your jurisdiction.

To exercise any of these rights, contact us at privacy@pdfcrate.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

10. Children's Privacy

PDFCrate is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us at privacy@pdfcrate.com and we will promptly delete that information.

11. Security

We implement technical and organisational measures to protect your personal data against accidental loss, unauthorized access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmission
• Bcrypt hashing of all passwords with a work factor of 12
• Automatic deletion of uploaded files within one hour
• Rate limiting on authentication endpoints to prevent brute-force attacks
• Restricted access controls — only authorized personnel can access production systems
• Regular review of our security practices

No method of internet transmission or electronic storage is completely secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal obligations. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes affecting how we use your personal data, we will notify registered users by email.

Your continued use of PDFCrate after changes are posted constitutes your acceptance of the updated policy.

12A. Financial Data — Additional Privacy Notice

The AI Bank Statement to Excel Converter processes financial documents that may contain sensitive personal and account information. In addition to our general privacy practices, the following specific commitments apply to financial documents:

What we extract: The tool extracts transaction dates, descriptions, debit amounts, credit amounts, and running balances. It also extracts the account holder name, the last four digits of the account number (if visible), the bank name, and the statement period dates. This data is compiled into your Excel file and delivered to you.

What we do not store: We do not retain any extracted financial data in our database, data lakes, logs, or any other persistent storage. Financial data extracted from your statement exists only transiently during the generation of your Excel file and is not accessible to any PDFCrate employee or system after delivery.

What we do not do: We do not analyse your financial data for commercial purposes, share it with advertisers, use it to build financial profiles, or sell it to any third party. The extracted data is used for one purpose only: generating the Excel file you requested.

Your responsibility: You are responsible for securing the Excel file we deliver to you. Once the file is downloaded to your device, its security is your responsibility. We recommend using password protection on Excel files containing sensitive financial data.

Regulatory note: PDFCrate is a general-purpose document processing tool and is not regulated as a financial services provider, accountant, or data processor under financial services regulation. If you operate under regulatory obligations regarding the handling of financial data (such as APRA, ASIC, or equivalent regulation in your jurisdiction), ensure that using a third-party cloud AI tool is compliant with your specific obligations before uploading regulated financial documents.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices:

Email: privacy@pdfcrate.com
Website: pdfcrate.com/contact