Privacy policy

askPDF (askpdf.net) is operated from Rome, Italy. We are the controller of the personal data described here: we decide why and how it is used. You can reach us at [email protected].

• Account data. When you sign up or sign in, our sign-in provider, Kinde, gives us your name, your email address and your Kinde user id. If the account you sign in with has a profile picture, Kinde passes its address on to us. We do not store it, but we show the picture next to your name in the account menu, so your browser loads it from the company that holds it (for example Google).
• Your documents. The PDF files you upload, with their names, the text we extract from them, and the search data we build from that text: the text cut into excerpts, each with a numeric “embedding” that lets us find the excerpts that match a question.
• Your conversations. Your questions, the answers you get with the pages they cite, and any rating or comment you give an answer or the service.
• Usage and plan. Counters such as the documents you uploaded and the questions you asked this month, your plan, and the names of your folders.
• Payment data. When you subscribe, Stripe handles your payment. We keep Stripe’s customer and subscription ids, your plan, its interval (monthly or yearly) and the date your current billing period ends. We never see your full card number.
• Technical data. Our servers log requests and errors, for example the address requested, the time, the browser and the IP address of the connection (Cloudflare’s, for most visits). The address of an upload includes the file’s name, and some error lines hold the id of your account. They are there to keep askPDF secure and working.
• Analytics, only with your consent. If you accept analytics in the cookie banner, PostHog and Google Analytics record how the site is used: the pages visited, the device and browser and an approximate location from the IP address. Outside the app, PostHog also records clicks and may record a visit as a screen recording. In the app, where your documents’ names and your conversations are on screen, we switch off PostHog’s tools that record clicks and what is on screen. See the cookie policy.

• To run the service you asked for (contract): signing you in, storing your documents, answering your questions, billing and support.
• To keep askPDF secure and working (our legitimate interest): logs, preventing abuse and fraud, rate limits, fixing errors and keeping backups.
• To keep the accounting records the law requires (legal obligation): the invoices and payment records of paid plans.
• To measure how the site is used (your consent): analytics cookies and similar technologies. You can say no, and change your mind at any time.

We use these providers to run askPDF. They handle data on our behalf and for the purposes below. We do not sell your personal data, and we do not share it with anyone else except where the law requires it.

Our AI providers receive the text of your documents and your questions. They keep what we send them under their own terms, so deleting a document or your account here does not delete what they already received. Do not upload a document you are not allowed to share with them.

Some of these providers, such as Together AI, OpenRouter and UploadThing, are in the United States, and others may handle data outside the European Economic Area (EEA). When personal data leaves the EEA we rely on the safeguards the provider offers, such as the European Commission’s standard contractual clauses. Write to [email protected] if you want to know more.

• Documents and conversations: until you delete the document or your account. Deleting a document removes the stored file and its conversation at once, and takes its extracted text and its search data out of use at once. Our search store clears the deleted text from its files in a clean-up that runs every month.
• Your account: until you delete it. Deleting it does the same for every document and removes your account data. It also cancels any subscription at once, without a refund of the unused part of the period, and asks Kinde to delete your sign-in profile.
• Backups and logs: copies of our database and search data are kept for up to 30 days, and the database’s own change logs for about as long. Something you delete can therefore still be in a backup or a log for up to 30 days, and is then deleted.
• Server logs: up to 14 days.
• Payment records: Stripe keeps your customer record (name, email, billing details and saved card) and your payment and invoice records for as long as it and accounting law require. Deleting your account cancels the subscription here but does not remove them.
• Analytics and your consent choice: PostHog and Google Analytics keep their data under the retention settings of our accounts with them. The cookie banner remembers your choice until it expires or you change it.

Under the GDPR you have these rights over your personal data:

• Access: ask for a copy of the data we hold about you.
• Rectification: ask us to correct data that is wrong.
• Erasure: delete any document yourself from your library, or your whole account from the menu at the foot of the sidebar (“Delete account”). You can also write to us.
• Portability: export any conversation as Markdown, plain text or PDF with “Export chat” in the document’s menu.
• Objection and restriction: object to processing that is based on our legitimate interest, or ask us to limit it.
• Withdrawing consent: change your analytics choice at any time with “Cookie preferences” (on the cookie policy, in the cookie banner and in the account menu). Withdrawing does not affect what was done before.
• Complaint: you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (opens in a new tab), or to the authority of the EU country where you live.

To use a right, write to [email protected]. We reply within one month.

• New documents are kept in private storage and never at a public address. askPDF checks that a document belongs to your account before it shows it to you, and every search is limited to one document of one account.
• Older documents were stored with UploadThing, at addresses that are long, random and not published, but not protected by a sign-in. We copy them to the private storage above and then remove the copy at UploadThing; until it is removed, anyone who has its address can open it.
• Sign-in is handled by Kinde and card payments by Stripe: we never see your password or your full card number.

No system is perfect. If we learn of a breach that puts your data at risk, we will tell you and the authorities as the law requires.

askPDF is not meant for children, and we do not knowingly collect their personal data. If you think a child has given us data, write to us and we will delete it.

We may update this policy. The date at the top shows the latest version. If a change matters to your rights, we will say so in the app or by email.

Questions about this policy or your data: [email protected].