Privacy Policy
Effective date: 26 October 2026
This policy explains what personal data PDFDispatch collects, why, how long we keep it, and what rights you have. We collect as little as we can. We do not sell data, and we do not use advertising, analytics or tracking.
Who we are
The controller of your personal data is Šori rešitve, Daniel Arthur Hawton, s.p., Slovenska cesta 56, 1000 Ljubljana, Slovenia, registration number 7543727000, tax number 28722795. E-mail: support@pdfdispatch.com.
We are a one-person business. We have not appointed a data protection officer, because the law does not require one for a business of our size and type.
What we collect, and why
Your account
Your name, your e-mail address (it is also your login name), your password (stored only as a hash, which cannot be turned back into the password), whether you confirmed the address, your two-factor and passkey settings if you use them, your plan, your settings and your credit balance.
Why: to run your account, log you in, apply your plan, and send you mail about your account and your usage (address confirmation, password reset, notices when your PDFs or credits run low). Legal basis: performance of a contract (GDPR Article 6(1)(b)).
API keys
Each key's name, when it was made, when it was last used and whether it is revoked. The key itself is stored only as a hash; we show it once, when you make it.
Your API requests
For each request, we record which key and account made it, when, the size of the request and of the answer, how long it took, and its result. We do not store the IP address it came from. We count your PDFs from these records.
Why: to apply your plan's limits, bill overage and take credits, answer your questions about your usage, and find and stop abuse. Legal basis: performance of a contract (Article 6(1)(b)).
The files you send
Files sent to the API are kept only while the PDF is made and are not stored afterwards. For the URL routes, the API fetches the page you name, as a browser would.
What you send is up to you. If your files contain other people's personal data, you are responsible for that data, and we process it for you, only to make your PDFs (GDPR Article 28).
Payments and invoices
If you buy a paid plan or credits, you pay on a page of our payment provider, Stripe. Stripe gets your card details, your name, your billing address and, if you give one, your tax number. We never see your card details.
From Stripe we get and store your Stripe customer number, your plan, its status and the date it is paid until. For each payment, we make an invoice in our own accounting system, on our own servers: your name or company name, billing address, tax number if given, e-mail address, what you bought (the plan, the overage with its number of PDFs, or the credits), the amount and the date. Every credit purchase and every use of credits is recorded in your credit history.
Why: to take payments, keep your credit balance and make invoices. Legal basis: performance of a contract (Article 6(1)(b)), and our legal duty to keep invoices (Article 6(1)(c); Slovenian tax and accounting law).
Limits against abuse
To stop floods of requests, our servers count requests per account. These counts are kept only in the servers' memory, for minutes, and are never stored. Legal basis: our legitimate interest in keeping the service running (Article 6(1)(f)).
Server logs
Our servers write technical logs: errors and important events, which can include an IP address, an account number or a request id. The logs are overwritten after a short time (normally within days), and removed when a server is replaced. Legal basis: our legitimate interest in finding faults and stopping attacks (Article 6(1)(f)).
When you contact us
If you e-mail us, we use your address and your message to answer you. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or the contract (Article 6(1)(b)) if it is about your account.
Cookies and storage on your device
We use only the cookies the site and the web app need to work:
| What | Why | How long |
|---|---|---|
Session cookie (pdfdispatch-session) | Keeps you logged in, and protects forms against misuse | 2 hours after your last visit, or until you log out |
Form security cookie (XSRF-TOKEN) | Protects forms against misuse | As the session cookie |
| "Remember me" cookie | Keeps you logged in, only if you choose "remember me" | Until you log out, at most 400 days |
Theme (appearance, a cookie and browser storage) | Remembers your choice of light or dark | One year, or until you clear it |
These are needed for the service you ask for, so we do not ask for consent.
Where we store your data
| Data | Where | Provider |
|---|---|---|
| Accounts, keys, usage, credits, payment status, invoices | Our database servers in Nuremberg and Falkenstein, Germany | Hetzner |
| Files while a PDF is made | Our servers in Germany | Hetzner |
| Database backups (encrypted) | Cloudflare R2 storage, limited to data centers in the EU | Cloudflare |
| E-mail we send and receive | Our mail server in Germany | Hetzner |
| Card details, billing details for payments | Stripe | Stripe |
Who we share data with
We do not sell or rent personal data. We share it only with these providers, and only as far as they need it:
- Hetzner Online GmbH (Germany) runs our servers, databases and mail.
- Cloudflare, Inc. (USA) runs our domain names (DNS) and stores our encrypted backups, in the EU only. Your requests go straight to our servers, not through Cloudflare.
- Stripe Payments Europe, Limited (Ireland) handles payments. Stripe is also responsible for its own processing, for example to prevent fraud and to meet its legal duties, under the Stripe Privacy Policy.
We may give data to authorities when the law requires it.
Transfers outside the EU
Cloudflare and Stripe are part of groups based in the USA, and Stripe may process data there. Such transfers are protected by the EU-U.S. Data Privacy Framework (where the company is certified) or by the European Commission's standard contractual clauses (GDPR Articles 45 and 46).
How long we keep data
| Data | How long |
|---|---|
| Account and keys | Until you delete them or your account |
| Files you send | Only while the PDF is made |
| Records of your requests | As long as we need them for billing and for questions about an invoice, then only as counts per day and month; deleted with your account |
| Credit history | Until you delete your account; purchases also as invoices (below) |
| Payment status | Until you delete your account |
| Invoices | 10 years after the year of the invoice, as Slovenian law requires, also after you delete your account |
| Server logs | A short time, normally days |
| Database backups | Up to 3 years. Deleted data leaves the backups when they expire |
| E-mails with us | As long as we need them for your question, then up to 2 years |
Your rights
Under the GDPR you have the right to access your data and get a copy, to correct it, to delete it, to restrict how we use it, to get it in a machine-readable format, to object to processing that we base on our legitimate interest, and to complain to a supervisory authority.
You can see and delete most of your data yourself in the web app. For everything else, e-mail support@pdfdispatch.com from your account's address. We answer within one month. Using your rights is free.
The supervisory authority in Slovenia is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You can also complain to the authority in the EU country where you live or work.
We do not make decisions about you based only on automated processing that have legal or similarly important effects (GDPR Article 22).
Children
PDFDispatch is not for children under 16. We do not knowingly collect personal data from them. If you think a child under 16 has an account, contact us and we delete it.
Security
We use encrypted connections (HTTPS), hashed passwords and keys, encrypted backups, and restricted server access. No system is perfectly secure. If a data breach is likely to put your rights at risk, we tell you and the supervisory authority as the law requires.
Changes to this policy
When we change this policy, we update the effective date at the top. If a change is important, we tell you by e-mail before it takes effect.