Privacy policy
Draft: this text has not yet been reviewed by a lawyer and may change before LeafLock PDF launches.
This privacy policy explains what personal data LeafLock PDF processes when you use leaflockpdf.com, why, and what rights you have. The short version: the PDF tools work on your device, so your files never reach us. We process only a small amount of other data, described below.
Who we are
LeafLock PDF is operated by [TO CONFIRM: legal entity name], [TO CONFIRM: registered address] (“LeafLock PDF”, “we”, “us”). We are responsible for the personal data described in this policy.
You can contact us about privacy at hello@leaflockpdf.com.
Your files
Files you open in a LeafLock PDF tool are processed entirely in your web browser, on your device. This includes the file itself, its name, its contents and the results the tool creates, as well as any camera images used by Scan to PDF and any passwords you type into a tool.
None of this is sent to us or to anyone else. We do not receive, store, view, analyze or log your files or anything about them. The site’s Content-Security-Policy instructs your browser to block connections to any server other than our own, and the site has no code that sends files to our server. How your files stay private explains how you can check this yourself.
Because we never receive your files, we cannot recover, delete or provide copies of them. They remain under your control on your device.
Data we process
Server access logs
When your browser requests a page or file from leaflockpdf.com, our hosting provider, Cloudflare, receives the request and may keep technical logs. These typically contain your IP address, the date and time, the address of the page or file requested, your browser’s user-agent string and the response status.
These logs never contain your documents, because documents are not sent in any request.
- Purpose: delivering the website, keeping it secure and protecting it from abuse, and diagnosing technical problems.
- Legal basis (GDPR): our legitimate interest in running a secure and reliable website (Article 6(1)(f)).
- Retention: [TO CONFIRM: log retention period set by the hosting provider].
Emails you send us
If you email us, we receive your email address, your name if you include it, the content of your message and anything you attach. We use this only to reply to you and to keep a record of the conversation.
Please don’t send us your documents. We never need them to help you.
- Purpose: answering your question and providing support.
- Legal basis (GDPR): our legitimate interest in responding to people who contact us (Article 6(1)(f)), or taking steps at your request before entering into a contract (Article 6(1)(b)) if you ask about buying a plan.
- Retention: as long as needed to deal with your request, and then for up to [TO CONFIRM: email retention period] in case of follow-up questions.
- Email service: Resend.
Payments (once paid plans launch)
Paid plans are not yet available. When they launch, purchases will be handled by Dodo Payments (for customers in India) or Paddle (for customers everywhere else), each acting as the merchant of record for the purchases it handles. This means the payment provider is the seller in the transaction, processes your payment details, and handles sales tax and VAT. The payment provider processes your payment data as an independent controller under its own privacy policy, which it will show you at checkout.
We will receive from the payment provider the information we need to provide and support your plan, such as your name, email address, country, the plan you bought, and the status of your subscription or purchase. We will not receive your full card or bank details.
- Purpose: providing the plan you bought, managing your subscription, handling refunds, and meeting our accounting and tax obligations.
- Legal basis (GDPR): performing our contract with you (Article 6(1)(b)) and complying with legal obligations (Article 6(1)(c)).
- Retention: for as long as your plan is active, and afterward for as long as tax and accounting laws require [TO CONFIRM: retention period under applicable tax law].
Error reports
When a tool fails because of a bug, your browser sends a short error report to our own server at leaflockpdf.com, so we can find and fix the problem. No outside error-tracking service is involved.
- What a report contains: the type of error and its message, the parts of our own code involved, which tool and page you were using, and your browser’s name and main version number (for example “Chrome 141”).
- What it never contains: your files, their contents, page text or anything you typed. File names, quoted text and links to local files are removed from the message in your browser before the report is sent.
- What we don’t record: we don’t store your IP address or any cookie with the report.
- Limits: at most five reports are sent per page visit, and only for bugs, not for problems such as a password-protected or damaged file.
- Purpose and legal basis (GDPR): keeping the tools working, which is our legitimate interest (Article 6(1)(f)).
- Retention: [TO CONFIRM: how long error reports are kept, for example 90 days].
Data stored on your device
The site doesn’t set cookies. It stores the following in your browser, on your device only:
- Theme choice: if you choose a light or dark theme, it’s saved in your browser’s localStorage so the site remembers it. Nothing is stored if you leave it on the system setting.
- OCR language model: after you first use OCR PDF, your browser stores the English text-recognition model so it doesn’t need to download it again. This file is the same for everyone and contains no personal data.
We cannot read this data; it never leaves your device. See the Cookie policy for details and how to remove it.
What we don’t do
- We don’t use advertising cookies, tracking cookies or tracking pixels.
- We don’t load analytics, advertising or social media scripts.
- We don’t sell or rent personal data, or share it for advertising.
- We don’t build profiles of visitors.
- We don’t make decisions about you based solely on automated processing.
Who we share data with
We share personal data only with the service providers that help us run LeafLock PDF, and only as far as needed:
- Hosting: Cloudflare, for server access logs.
- Email: Resend, for emails you send us.
- Payments: Dodo Payments (India) and Paddle (everywhere else), once paid plans launch.
- Error reports: stored with our hosting provider, Cloudflare, as part of our own systems.
We may also disclose personal data if required by law, or to protect our rights, our users or the public.
International transfers
Our service providers may process data in countries other than your own, including outside the European Economic Area and India. Where the GDPR applies, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses for such transfers. [TO CONFIRM: transfer mechanisms used by each provider]
Children
LeafLock PDF is not directed at children, and we don’t knowingly collect personal data from children. Because the tools need no account and process files on your device, using them doesn’t require giving us any personal data. If you believe a child has sent us personal data, for example by email, contact us and we’ll delete it. [TO CONFIRM: minimum age, and approach to verifiable parental consent under the DPDP Act 2023]
Your rights
Under the GDPR (European Economic Area, United Kingdom and Switzerland)
If the GDPR or a similar law applies to you, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your data in a portable format, where processing is based on a contract or consent;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with your local data protection authority.
Under India’s Digital Personal Data Protection Act, 2023
If the DPDP Act applies to you, you have the right to:
- obtain a summary of the personal data we process about you and the processing activities;
- have your personal data corrected, completed, updated or erased;
- have a grievance about our handling of your data addressed;
- nominate another person to exercise your rights in the event of your death or incapacity.
If we do not resolve your grievance, you may complain to the Data Protection Board of India.
[TO CONFIRM: grievance officer name and contact, if required]
How to exercise your rights
Email us at hello@leaflockpdf.com. We’ll reply within one month, or sooner where the law requires. We may need to confirm your identity before acting on a request. Remember that we hold no copies of your files, so requests about files you processed with our tools can’t apply to us.
Security
We protect the data we do hold with reasonable technical and organizational measures, including encrypted connections (HTTPS) for the whole site and limited access to our email and provider accounts. The most important safeguard is that we never receive your files in the first place.
Changes to this policy
We’ll update this policy when the way we process personal data changes, for example before launching paid plans. The date at the top of the page shows when it was last updated. If a change is significant, we’ll make it clear on the site.
Contact
For any question about this policy or your personal data, email hello@leaflockpdf.com or write to [TO CONFIRM: legal entity name and postal address].