Privacy Policy & Data Security

1. Document Confidentiality & Zero AI Model Training

Your documents are strictly confidential. AdaPDF operates on a deterministic, rule-based ISO 14289-1 (PDF/UA-1) structure engine.

• No External Model Training: Your uploaded documents, text streams, metadata, and images are never transmitted to third-party generative AI companies, external LLM providers, or public training datasets.
• Deterministic Local Processing: Document inspection and remediation run locally inside this dedicated server environment.
• Confidential Government & Legal Records: Municipal ordinances, court filings, medical forms, and personnel records remain isolated within your organization's security perimeter.

2. Automatic Document Retention & Disk Purge Policy

To prevent data accumulation and safeguard customer privacy, the platform enforces an automatic file retention policy:

• 60-Minute Cryptographic Scrubber: An automated background daemon runs every 5 minutes and permanently deletes uploaded source files, remediated PDFs, and rendered raster preview images that are older than 60 minutes.
• Anti-Abuse Storage Watermarks: Automated storage quotas and high-watermark monitors prevent disk exhaustion and denial-of-service abuse by enforcing strict volume thresholds.
• Immediate Deletion on Demand: Customers may request immediate manual removal of any document ID from the system.

3. Authentication & Password Security

User passwords are protected using industry-standard cryptographic salted PBKDF2-HMAC-SHA256 hashing (over 100,000 iterations). Raw passwords are never stored in plaintext or logged.

4. Payment Card Processing (PCI-DSS)

All commercial billing, pay-as-you-go credit pack checkouts, and monthly recurring subscription transactions are processed directly by Stripe, Inc. via TLS 1.3 encryption. AdaPDF servers never see, handle, or store raw credit card numbers or security CVVs.

5. European Union General Data Protection Regulation (GDPR) Compliance

For individuals and organizations located in the European Economic Area (EEA), AdaPDF processes personal data in full compliance with Regulation (EU) 2016/679 (GDPR) and UK GDPR:

• Privacy by Design & Data Minimization (Art. 25 & 5(1)(c)): AdaPDF enforces ephemeral data handling. Uploaded documents, remediated outputs, and visual diff previews are never retained indefinitely; they are permanently erased from disk within 60 minutes by our automated scrubber daemon.
• Zero AI Model Training & Secondary Exploitation: In compliance with Art. 5(1)(b) (Purpose Limitation), customer documents are processed solely for the requested technical remediation and are never repurposed, mined, or used to train artificial intelligence or machine learning models.
• Zero Advertising Trackers & Cookie Minimization: AdaPDF uses only strictly necessary HTTP-only session cookies required for authentication and security. We deploy zero third-party advertising trackers, pixel beacons, or behavioral tracking scripts.
• Data Subject Rights (Art. 15–22): EEA residents maintain statutory rights to access, rectify, port, restrict processing of, or request the immediate erasure ("Right to be Forgotten") of their account data. Because document files are purged within 60 minutes, document data is erased automatically by system design.
• International Data Transfers & Sub-Processors: Where data is processed across borders, transfers are protected by standard contractual clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF) via certified enterprise infrastructure and payment processors.