Privacy Policy

1. Data controller and contact

In this policy, “vupdf”, “we”, “us” and “our” refer to the data controller operating the Service. For any question or request about your personal data, please use the contact channel listed on our Contact page.

• Email: support@vupdf.com

2. What we process and why

You do not need an account to use vupdf, and we do not ask for your name, email address or payment details. To provide the Service we process only the following data:

• Files you upload. Files you upload to a tool, and the information they contain, are processed on our server solely to perform the operation you request and deliver the result to you. We do not inspect your files, use them for any other purpose, use them to train AI models or share them with third parties.
• PDF passwords. A password you enter to open a protected file or to protect a new one is used only for that request; it is not stored and is never written to logs.
• Technical data and server logs. To keep the Service secure, prevent abuse and fix errors, our server keeps standard access logs (IP address, date and time, requested URL, response status, browser type and referring page). These logs never contain the content of your files or your passwords. To limit excessive use, your IP address is also linked to a request counter that is held only in memory and reset every 15 minutes.
• Preferences stored on your device. Settings such as your language, theme, cookie choice and thumbnail size are kept in your browser's local storage and are not sent to our server (see the cookie table below).
• Contact form and correspondence. If you use the contact form, your name, email address, subject (if given) and message are sent by our server via SMTP as an email to the site operator; they are not stored in any database. If you email us directly, the same information is processed solely to answer your request. To prevent spam, the form is limited to 5 submissions per hour per IP address.
• Usage statistics (only with your consent). If you consent to analytics cookies, Google Analytics 4 collects pseudonymous usage data such as pages visited, device and browser type and approximate location (country or city level). We use this data only in aggregate to improve the Service.
• Advertising data. To keep the Service free, Google AdSense ads are shown on content pages. Google processes data such as your IP address and browser information to serve ads, cap how often they are shown, measure their performance and prevent fraud. Unless you consent to advertising cookies, only cookieless, non-personalised (limited) ads are shown; if you consent, Google may also use cookie identifiers to show personalised ads. Your files are never used for ad targeting.

3. Legal bases

We process your personal data on the following legal bases:

• Performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): processing your files and passwords is necessary to provide the service you request. If you do not upload a file, the operation cannot be performed.
• Legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): server logs, rate limiting, storing essential preferences and answering messages sent via the contact form rely on our legitimate interest in running the Service securely and reliably and in being able to reply to you. Where your request concerns your use of the Service, answering it is also part of performing our contract with you.
• Consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)): analytics and advertising cookies and personalised ads rely solely on the consent you give in the cookie banner (in the European Economic Area, the UK and Switzerland, in Google's consent message). The cookieless, non-personalised ads shown when you do not consent rely on our legitimate interest in offering the Service free of charge (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).

You can withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal, via the “Cookie settings” link at the bottom of every page or the button in the cookies section below.

4. Retention

• Files: Uploaded files and generated results are deleted from the server as soon as the result has been delivered to you. Temporary files left behind by an operation interrupted by an outage are removed by an automatic clean-up job that runs every 30 minutes and deletes anything older than one hour. No copy of your files remains on our server.
• Server logs: Kept only for the short period needed for security and troubleshooting, then deleted. Request counters reset automatically after 15 minutes.
• Preferences on your device: Remain on your device until you clear your browser data; session data is deleted when you close the tab.
• Correspondence: Contact form messages are not stored in a database; the resulting email is kept in the site operator's mailbox only for as long as needed to answer your request and is then deleted.
• Google cookies: Limited to the durations listed in the cookie table below; Google's own retention policies apply to data held on Google's servers.

5. Third-party services

The following features connect to third-party services or external resources, and only when you use them:

• Google Fonts: The typed signature option loads a font from Google Fonts when the signature panel opens. Your IP address and browser information are transmitted to Google in the process.
• Google Drive and Dropbox: If these options are enabled and you pick a file from them, the provider's script is loaded. Sign-in takes place in the provider's own window and we never see your login details; only the files you select are transferred to your browser and processed like any other file. The providers' own privacy policies apply.
• HTML to PDF: When you enter a web address, our server connects to it to convert the page to PDF. The target site sees our server's IP address, not yours; the page content is not kept after the conversion.
• Language suggestion: On your first visit, only the country is derived from your IP address, using an offline database on our own server, to suggest an interface language. No external service is used and your IP address is not stored for this purpose.
• OCR: These tools process your files with software and models running on our own servers; your files are not sent to any external AI service.
• Google Analytics and Google AdSense: Google Analytics is loaded only if you consent to analytics cookies. The Google AdSense script is loaded on pages so that ads can be shown, but advertising cookies and personalised ads depend on your consent (see the cookies section).
• Hosting: The Service runs on the servers of infrastructure (hosting) providers, who process data only on our behalf and under our instructions.

6. International transfers

Google Analytics, Google AdSense and Google Fonts are provided by Google LLC (USA) and Google Ireland Limited. When you use them, your data may be transferred to countries outside Turkey and the European Economic Area, in particular the United States. These transfers rely on the appropriate safeguards provided for in Article 9 of the KVKK and Chapter V of the GDPR (such as the European Commission's Standard Contractual Clauses and Google LLC's certification under the EU-US Data Privacy Framework) and, for analytics and advertising cookies, on your explicit consent.

7. Cookies and similar technologies

Cookies and browser storage (localStorage, sessionStorage) let websites keep small pieces of data on your device. vupdf itself uses no tracking cookies; our own entries are kept only in your browser's storage and are never sent to our server. We group cookies into three categories:

• Necessary (always on): Language, theme, your cookie choice and interface settings. They are required for the Service to work, do not track you and cannot be switched off.
• Analytics (optional): Google Analytics 4 is loaded only if you enable this category; GA4 anonymises IP addresses by default and does not store them. If the site operator has configured Plausible Analytics instead, that tool uses no cookies and stores no personal data, so no consent is required.
• Advertising (optional): The Google AdSense script is loaded on pages, but unless you enable this category no advertising cookies are set and no personalised ads are shown; only cookieless, limited ads are served. For visitors from the European Economic Area, the UK and Switzerland, advertising choices are collected through a Google-certified consent management platform (IAB TCF).

We pass your choices to Google services using Google Consent Mode v2 signals; every optional category is set to “denied” by default until you consent. Your choice is stored in your browser under the key vupdf_consent.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. You can opt out of personalised advertising in Google My Ad Center, and opt out of other vendors' personalisation cookies at aboutads.info or youronlinechoices.eu. How Google uses cookies in advertising is explained on Google's advertising technologies page, and how it uses data from partner sites on How Google uses information from sites or apps that use our services.

You can change your choices at any time via the “Cookie settings” link at the bottom of the page or the button below. Once you withdraw consent, the related scripts are no longer loaded; cookies already set can be deleted in your browser settings.

You can also block or delete cookies in your browser settings. If you delete the necessary entries, preferences such as language and theme will be reset.

8. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information about such processing; to learn its purpose and whether the data is used accordingly; to know the third parties in Turkey or abroad to whom it is transferred; to request its correction if incomplete or inaccurate; to request its deletion or destruction under Article 7 of the KVKK and the notification of these actions to the third parties concerned; to object to an outcome against you resulting exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests; the right to withdraw your consent at any time; and the right to lodge a complaint with the data protection supervisory authority in your country.

You can send your requests via the channel on our Contact page; we will respond free of charge within thirty days at the latest. Because we keep no accounts and do not link your files to your identity, in most cases we hold no record about you; to assess your request we may ask you for details such as the relevant date and IP address. You also have the right to lodge a complaint with the Turkish Personal Data Protection Authority.

9. Children's privacy

The Service is not directed at anyone under 16, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it without delay.

10. Security

Connections between your browser and the Service are encrypted with HTTPS. Each upload is processed in its own randomly named temporary folder that is deleted once the operation is finished; because we do not store files permanently, there is no file archive that could be compromised. We also apply rate limiting against abuse. Nevertheless, no transmission of data over the internet is completely free of risk.

11. Changes to this policy

We may update this policy as the Service or the applicable law changes. The current version, with its last-updated date, is always published on this page.