Política de privacidad

1. Conversion in your browser does not upload anything

This is the most important thing in this policy, so it comes first. When you convert a PDF on mypdf2md.com, the file is read from your device by JavaScript running in your browser tab and parsed there. It is not transmitted to us, and we never possess it, store it, or process it.

You can verify this rather than take our word for it: open your browser's developer tools, switch to the Network tab, and run a conversion. No request carries the file or its contents.

This extends to the supporting files. The PDF.js worker and font data are served from mypdf2md.com rather than a third-party CDN, so no outside party learns that a conversion took place.

There is exactly one exception, and it cannot happen by accident: optional cloud OCR for scanned documents, described in the next section. It runs only for a file you specifically ask us to recognise, after a dialog that tells you what will be sent. If you never use it, nothing you convert ever leaves your device.

2. Optional cloud OCR for scanned documents

A scanned page is an image of text, not text. The converter in your browser reads a PDF's text layer, so for a scan it correctly finds nothing. Rather than leave you at a dead end, we offer to recognise the text on our own server — and that is the one operation on this site that sends your file anywhere.

It is opt-in for each individual file. You are shown a dialog naming the file, the number of pages that will be sent, where they go and how long they live, and you have to confirm it. Declining costs you nothing and leaves your local result exactly as it was. We never remember the decision, so a second file means a second explicit consent — there is no setting that turns this on permanently.

What is sent: the pages of that one document, uploaded from your browser directly to our recognition service. They do not pass through the website's own servers.

Who receives it: only us. Recognition runs on our own hardware using our own engine. We do not send your document to Google, Amazon, Microsoft, OpenAI or any other recognition provider, and using this feature adds nobody to the list of processors below.

How long it lives: the document is held in memory while it is being read and is destroyed when the job finishes, fails or times out. It is never written to disk. The recognition service has no database, no object storage and no file system it can persist to, which is what makes this a property of the architecture rather than a promise about our behaviour.

What we keep afterwards: a usage record containing the page count, a timestamp, the recognition language, and either your account identifier or a salted hash of your IP address. That record exists to enforce the daily free allowance and to detect abuse. It never contains the filename, the document, or the text recognised from it. Records are deleted after 30 days.

The legal basis for the upload is your consent, which you give per file and can simply withhold. Withholding it does not degrade the rest of the service.

3. What we do not collect

For every conversion that runs in your browser — which is all of them unless you ask for cloud OCR:

• The contents of any document you convert
• The text extracted from it
• The file itself, in whole or in part, at any point

4. What we do collect

The following is the complete list. If something is not here, we do not collect it.

• Account data, if you sign in. We store your email address so we can authenticate you. Authentication is handled by Supabase on our behalf.
• Local preferences. Your chosen language, light or dark theme, and your cookie consent choice are stored in your browser's local storage. They stay on your device.
• Server logs. Our hosting provider records standard request logs, including IP address, user agent and requested URL, for security and abuse prevention.
• Advertising data, only if you consent. See the advertising section below.
• Analytics data, only if you consent. See the analytics section below.
• Cloud OCR usage records, only if you use that feature. Page count, timestamp, language and a hashed identifier — never the document or its text. See the OCR section above.

5. Cookies and local storage

We use local storage for strictly necessary purposes without asking, because the site cannot function otherwise: remembering your language, your theme, and the consent choice you made on the banner.

Anything beyond that is opt-in. Nothing from Google or any other third party loads until you actively accept advertising cookies on the consent banner. If you decline, or simply ignore the banner, no advertising script is ever added to the page.

You can change your decision at any time using the Cookie settings link in the footer.

6. Advertising

The web version is free and funded by advertising. If you consent, we load Google AdSense, which uses cookies and similar technologies to select and measure ads. In that case Google is an independent controller of the data it collects, governed by its own privacy policy.

Google may use your IP address, browsing activity on this site, and its own cookies for ad personalisation. You can review and adjust this at adssettings.google.com.

Ad code has no access to your documents. Conversion happens before and independently of any ad request, and the converted text never leaves the page.

7. Analytics

If you consent, we load Google Analytics to understand which pages are used and where people run into trouble. It records page views, referring site, approximate location derived from your IP address, and device and browser type. Google acts as our processor for this data.

If you decline, or ignore the banner, the Google Analytics tag is never loaded — no request is made to Google at all, rather than a request that is made and then restricted.

Analytics never receives the contents of a document, its filename, or the Markdown produced from it. This holds for cloud OCR too: no document, no recognised text and no filename is reported to analytics or to any advertising system at any point.

8. Who processes data for us

Cloud OCR is deliberately absent from that list. Recognition runs on our own server rather than a commercial OCR API, so choosing to use it does not hand your document to anyone new. That was the reason for building it this way.

• Supabase — authentication and database hosting, for accounts and site configuration
• Vercel — website hosting and request logging
• Google AdSense — advertising, only after you consent
• Google Analytics — usage statistics, only after you consent

9. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases: contract, for the account data needed to sign you in and provide the service; legitimate interests, for security logging and abuse prevention; and consent, for advertising, for any optional analytics, and for sending a document to cloud OCR. Where we rely on consent you may withdraw it at any time, without affecting processing carried out before withdrawal.

Consent for cloud OCR is given per file and is never stored, so there is nothing to withdraw after the fact — declining the next time is the whole mechanism.

10. International transfers

Our processors may store and process data outside your country, including in the United States. Where required, transfers are covered by the appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

11. Retention

Account data is kept for as long as your account exists. Delete your account and it is removed, along with anything linked to it. Server logs are retained by our hosting provider on their standard schedule, typically no more than 30 days.

We do not retain documents. A locally converted file never reaches us at all. A file sent to cloud OCR exists only in memory for the length of the job and is destroyed when it ends; the usage record that outlives it holds a page count and a timestamp, never content, and is deleted after 30 days.

12. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive it in a portable form, and withdraw consent. To exercise any of these, contact us using the details below.

You also have the right to complain to your local data protection authority.

13. Children

The service is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product changes. The date at the top of this page always reflects the most recent substantive revision. Material changes will be signalled on the site before they take effect.

15. Contact

This service is operated by MyPDF2MD.com, based in Kozhikode, Kerala, India, and MyPDF2MD.com is the data controller for the personal data described above.

For any privacy question, or to exercise any of the rights in this policy, email privacy@mypdf2md.com or use the contact form at mypdf2md.com/en/contact. We acknowledge requests within five working days and answer substantively within thirty days.