GDPR Compliance

For the limited personal data we collect through the Site (such as analytics data and cookie identifiers), Aire Solutions acts as the data controller. This means we determine the purposes and means of processing such data.

For AI-powered tools that transmit text content to third-party language model APIs, those API providers act as data processors under our instructions. Their handling of the data is governed by their own terms and privacy policies.

The scope of data processing at PDF Studio is extremely limited compared to most online services. We process the following categories of data:

• File Data (Mostly Not Collected): For most tools, your PDF files and their contents are processed entirely in your browser and are not transmitted to our servers. The exceptions are OCR PDF, HTML to PDF, and PDF to PDF/A, which send the file to our server to be processed, and the AI-powered tools described below. We do not use your file content for our own purposes.
• AI Tool Transmissions (Service Requested by You): When you use an AI-powered tool (AI Summarizer, Translate PDF, Compare PDF, Chat with PDF, AI Proofreader, AI PDF Reader, AI Humanizer, AI Detector), the text extracted from your document, or the text you paste, is sent through our server to a third-party AI provider to generate the result. We do not store the text after the response is returned. You choose whether to use these tools, and the details are set out in our Privacy Policy and on each tool’s page.
• Analytics Data (Consent-Based in the EEA, UK and Switzerland): Anonymized page views, session durations, tool usage counts, and general geographic data (country/city level). IP addresses are anonymized before storage. For visitors in the EEA, UK and Switzerland, analytics is processed only after you give consent in the consent message.
• Essential Technical Data: Browser type, device type, screen resolution, and theme preference. This data is necessary for the Site to function and is collected on the basis of legitimate interest (Article 6(1)(f) GDPR).

We rely on the following lawful bases under Article 6(1) of the GDPR:

As a data subject under the GDPR, you have the following rights. We are committed to facilitating the exercise of these rights without undue delay and free of charge.

• Right of Access (Article 15): You have the right to obtain confirmation as to whether personal data concerning you is being processed, and if so, access to that data along with information about the processing purposes, categories of data, recipients, and retention periods.
• Right to Rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
• Right to Erasure (Article 17): Also known as the “right to be forgotten,” you may request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
• Right to Restriction of Processing (Article 18): You may request that we limit the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object (Article 21): You have the right to object to the processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent via the cookie settings or by contacting us.
• Rights Related to Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects. PDF Studio does not make automated decisions of this nature about individuals.

To exercise any of these rights, please contact us at privacy@pdfstudio.website. We will respond to all legitimate requests within 30 days. In some cases, we may need to verify your identity before fulfilling your request.

Your PDF files are processed locally in your browser and are never transferred to any server, domestic or international. This is a fundamental architectural advantage of our approach.

The limited analytics and advertising data we collect (with consent) may be processed by third-party services headquartered outside the European Economic Area (EEA). When such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): Where applicable, we rely on the European Commission’s approved standard contractual clauses for the transfer of personal data to third countries.
• Adequacy Decisions: Transfers to countries recognized by the European Commission as providing an adequate level of data protection.
• Data anonymization: Analytics data is anonymized (including IP addresses) before any potential transfer, which removes it from the scope of GDPR.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Analytics data: Retained for up to 26 months (Google Analytics default), after which it is automatically deleted. You can request earlier deletion.
• Cookie consent preferences: Stored in your browser. Retained until you clear browser data or withdraw consent.
• Essential technical data: Retained only for the duration of your session or until you change your preferences (e.g., theme setting retained for 1 year).
• AI tool data: Not retained. Text content sent to AI APIs is processed ephemerally and is not stored after the response is returned to your browser.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption in transit: All connections to the Site are secured with HTTPS/TLS encryption.
• Client-side processing: For most tools, file data never leaves your device, reducing the risk of server-side data breaches affecting your documents.
• Minimal data collection: We collect only the data strictly necessary for the stated purposes, in line with the principle of data minimization (Article 5(1)(c) GDPR).
• Content Security Policy: We employ security headers to protect against common web vulnerabilities such as cross-site scripting (XSS) and clickjacking.
• Regular reviews: We periodically review our data practices and security measures to ensure ongoing compliance with GDPR and industry best practices.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, providing information about the nature of the breach, the data concerned, the likely consequences, and the measures we have taken or propose to take to address the breach.

Given that we do not store file content or sensitive personal data on our servers, the scope and impact of any potential breach would be extremely limited to anonymized analytics data.

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

We encourage you to contact us first at privacy@pdfstudio.website so we can attempt to resolve your concern directly.

For any GDPR-related inquiries, data subject requests, or concerns about our data practices, please contact us: