Last updated: 3 September 2026
This policy explains what happens to the files you upload to pdf2xls.com and to the other data we collect, who else sees it, where it goes, how long it is kept, and what rights you have.
We have written it to be checkable. If something here does not match what the Service actually does, that is a bug and we want to hear about it: legal@pdf2xls.com.
Data controller for the website and the Service:
Kazimirova Nina Vladimirovna, Sole Proprietor (individual entrepreneur), Republic of Armenia State registration No. 290.1410455 of 16 September 2024 TIN (ՀՎՀՀ): 28288721 3/3A Sebastia Street, apt. 48, Malatia-Sebastia, 0065 Yerevan, Armenia Email: legal@pdf2xls.com
We have not appointed a Data Protection Officer; we are not required to.
What we receive. The PDF file you upload, and its original filename.
Where it goes. The file is written to a temporary directory on our server, which is rented from Hetzner Online GmbH and physically located in Germany (EU).
How it is processed.
.xlsx, .docx or .pptx file, streams it to you, and deletes the generated file immediately afterwards. We do not retain converted output.How long the uploaded PDF is kept. The uploaded PDF is deleted from our server as soon as processing of your request finishes, normally within seconds. As a safety net, an automated job also removes any file older than 60 minutes from the upload directory.
Encryption. All traffic between your browser and our server, and between our server and our subprocessors, is encrypted in transit using TLS. We do not currently claim application-level encryption at rest for files held on the server during processing, and we make no certification claims (we hold no SOC 2, ISO 27001 or equivalent audit report). We would rather tell you that than imply otherwise.
| Data | Where it is stored | Why | Legal basis (GDPR) |
|---|---|---|---|
Your IP address (also taken from the X-Forwarded-For header) |
rate_limits and conversions tables in our database |
To enforce the free-tier limit of 3 conversions per day and to detect abuse | Art. 6(1)(b) — performance of the contract you asked for; Art. 6(1)(f) — our legitimate interest in preventing abuse of a free service |
| Original filename of the uploaded document | conversions table |
Operational record and troubleshooting | Art. 6(1)(f) — legitimate interest |
| File size, page count, whether tables were found, status, selected language, timestamp | conversions table |
Operational statistics and troubleshooting | Art. 6(1)(f) — legitimate interest |
A session identifier (PHPSESSID cookie) |
Your browser and our server | To keep your session working across pages | Art. 6(1)(b) — strictly necessary |
| Web-server access logs: IP address, request URL, timestamp, user agent, referrer | Log files on our server, rotated daily and kept for 14 days | Security, abuse detection, debugging | Art. 6(1)(f) — legitimate interest |
| Page-view record: a one-way hash of your IP address (not the address itself), page path, language, referrer, user agent, timestamp | visits table in our database |
Our own first-party traffic statistics, so that we do not need a third-party analytics tracker | Art. 6(1)(f) — legitimate interest |
| Billing and payment data (paid plans only) | Held by our merchant of record, not by us | To take payment and issue an invoice | Art. 6(1)(b) |
| Pro licence record (paid plans only): licence key, the email address used at checkout, order and subscription identifiers, subscription status and renewal dates, number of activated browsers | licenses table in our database; a signed cookie pdf2xls_pro in your browser holding the key and an activation identifier |
To recognise a paid subscriber without requiring an account or password, and to lift the daily limit | Art. 6(1)(b) — performance of the contract |
Note on the filename. Document filenames often contain names, company names, account numbers or dates. We store the filename. If that matters to you, rename the file before uploading it. Retention of this record is stated in section 7.
We do not require registration, and we do not collect your name, email address, phone number or postal address for use of the free tier.
Where step 2 in section 3 applies, page images are processed by OpenAI using its API (the /v1/responses endpoint, model gpt-5-mini).
If you are not comfortable with page images of a document reaching a US AI provider, do not upload that document. PDFs with a readable text layer are processed entirely on our own server in Germany; scans are not.
Strictly necessary. We set a PHPSESSID session cookie. It contains no personal data beyond a random session identifier, expires when you close your browser, and is required for the site to function.
Third-party resources. The site loads the Bootstrap CSS and JavaScript libraries from the public CDN cdn.jsdelivr.net. As with any resource loaded from a third-party server, your IP address and user agent are visible to that CDN. It sets no cookies for us and we receive no data back from it.
Analytics. We do not run Google Analytics, Yandex.Metrica, Meta Pixel, session-replay or any other third-party analytics or advertising tracker on the Service. We do not set advertising cookies, we do not build profiles, and we do not sell or share your data with advertising networks.
| Data | Retention |
|---|---|
| Uploaded PDF file | The uploaded PDF is deleted from our server as soon as processing of your request finishes, normally within seconds. As a safety net, an automated job also removes any file older than 60 minutes from the upload directory. |
Converted output file (.xlsx / .docx / .pptx) |
Generated on request, streamed to you, and deleted immediately. No copy is retained. |
| Conversion record (IP, filename, size, status, timestamp) | The IP address and the original filename are erased from the record 30 days after the conversion. The remaining non-identifying statistics (file size, page count, whether tables were found, status, language, timestamp) are kept for service statistics. |
| Rate-limit counters (IP + date + count) | 7 days, then deleted. |
| Web-server access and error logs | 14 days (daily rotation, 14 rotations retained) |
| Pro licence record | For the life of the subscription and 12 months after it ends, then deleted. The pdf2xls_pro cookie lives 12 months or until you deactivate |
| Page-view records (hashed IP, path, referrer, user agent) | 12 months, then deleted |
| Billing records for paid plans | Held by our merchant of record; retained by it and by us for as long as required by applicable tax and accounting law |
| Subprocessor | Role | Location | What it receives |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure | Germany (EU) | Everything stored or processed on the server |
| OpenAI, L.L.C. | AI table recognition | United States | Page images of scanned PDFs only (see section 5) |
| jsDelivr (CDN) | Delivery of front-end libraries | Global CDN | Your IP address and user agent when the page loads |
| Lemon Squeezy | Merchant of record for paid plans; issues and validates licence keys | United States | Billing data you enter at checkout; licence key activations from our server |
We do not sell personal data and we do not share it with advertising networks or data brokers. We may disclose data where we are legally required to do so by a binding order of a competent authority, or where necessary to establish, exercise or defend legal claims.
We are established in Armenia, which is not covered by a European Commission adequacy decision. Your data may therefore be transferred outside the European Economic Area and the United Kingdom in the following ways:
Where we transfer personal data out of the EEA or the UK, we rely on the Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum where applicable), together with the data processing terms of the subprocessor concerned. A copy of the relevant transfer mechanism is available on request.
If the GDPR or UK GDPR applies to you, you have the right to: access your data; have it rectified; have it erased; restrict or object to its processing (including objecting to processing based on legitimate interests); receive it in a portable format; and, where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these, email legal@pdf2xls.com. We will respond within one month. Because the free tier requires no account, we may need additional information — realistically, the IP address you used and the approximate time and filename of the conversion — to locate your records. If we cannot identify you, we may be unable to act on the request (Art. 11 GDPR).
You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work or place of the alleged infringement.
If you upload a document containing personal data about third parties — for example a client's bank statement, an employee payroll table or a customer invoice list — then you are the data controller in respect of that data and we act as your processor, processing it only on your instruction (namely, your instruction to convert the file).
In that case:
In the last 12 months we have collected the following categories of personal information: identifiers (IP address), internet or network activity (pages visited, user agent, referrer, conversion records) and, if you upload one, the contents of a document you choose to submit, which may itself contain other categories.
We collect it for the business purposes described in section 4, from you directly, and we disclose it only to the service providers listed in section 8.
We do not "sell" personal information and we do not "share" it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA. We do not knowingly collect the personal information of anyone under 16 for such purposes.
California residents have the right to know, to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information, and the right not to be discriminated against for exercising them. Submit a request to legal@pdf2xls.com. You may use an authorised agent.
We take reasonable technical and organisational measures appropriate to the size of the Service: TLS for all traffic, restricted administrative access to the server and database, credentials held outside the web root, and file-type and file-size validation on upload.
We do not claim, and you should not assume, that we hold any security certification, that data is encrypted at rest at application level, or that our measures are equivalent to those of an enterprise vendor. If your organisation requires a formal security assessment before using an external processor, ask us first at legal@pdf2xls.com and we will tell you honestly what we do and do not have.
If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the competent supervisory authority and, where required, affected individuals, in line with Art. 33–34 GDPR.
The Service is intended for business and professional use and is not directed at children. We do not knowingly collect personal data from children under 16.
We may update this policy. The current version is always the one published at this URL and the "Last updated" date shows when it last changed. Material changes affecting paid customers will be notified in advance where reasonably practicable.
Questions, data subject requests, DPA requests, or a report that this policy does not match reality: legal@pdf2xls.com