Privacy Policy
In short
- Page tools work in your browser — those files never leave your device.
- Server tools delete the original right after processing (at most 1 hour) and the result after 1 hour for guests or 24 hours for registered users.
- We do not read your documents, never sell your data and never use your files to train AI.
- An account is optional. We show no advertising.
1. Who is responsible
The Service freepdfmodify.com is responsible for the processing described here. Contact: info@freepdfmodify.com. We answer privacy requests within one month. This policy covers the website in all its languages; if versions differ, the English version prevails.
2. What we process and why
Browser tools. Merging, splitting, rotating and rearranging pages, images to PDF, editing, signing, filling forms and other tools marked "processed in your browser" work on your device. We receive no file data — only the ordinary page request (see "Server logs"). If you choose to save your signature in the signing tool, it is kept only in your browser's local storage on your device, and you can delete it there at any time.
Server tools. To perform the operation you request (for example compression, conversion between PDF and Word, Excel or PowerPoint, PDF to images, password protection or removal, extracting images and, later, text recognition) we process the uploaded file, its name, type, size and number of pages, the processing settings, a random job identifier and a salted hash of your IP address (used to enforce limits; the IP address itself is not stored with the job). Legal basis: performance of the service you request (Art. 6(1)(b) GDPR). Retention: original deleted right after processing and within 1 hour at the latest; result kept 1 hour for guests and 24 hours for registered users. Technical records of guest jobs (without files) are deleted after 24 hours. Documents may contain personal data of you or other people; we process such data only to carry out your instruction and do not read or analyse the content. Passwords you enter to open or protect a PDF and text recognised from scans are not stored after the operation. Macros in Office documents are never run.
Account. The name you give at sign-up (we use it only to address you personally on your account page and in our e-mails; any name or nickname will do), e-mail address, password (stored only as a salted hash), confirmation status, sign-in times and, for your convenience, the history of your operations: tool, date, file name, type, number of pages, file sizes and settings, and the presets you save (a title and settings) — never the files themselves. Legal basis: Art. 6(1)(b) GDPR. Kept until you delete your account; after deletion the data is erased from database backups within 30 days.
Service e-mails. Address confirmation, password reset and important notices about the Service, sent through our e-mail provider Unisender Go. Legal basis: Art. 6(1)(b) GDPR.
News about the Service. We may occasionally e-mail registered users about the Service: new tools and features, important changes, and paid plans or AI features when they appear. Legal basis: our legitimate interest in informing users about the Service they use (Art. 6(1)(f) GDPR) or, where the law of your country requires prior consent for such e-mails, your consent (Art. 6(1)(a) GDPR) — then we send them only after you have given it. Every such e-mail contains an unsubscribe link, and you can also unsubscribe on your account page or by writing to us. If you tick the consent box, we record when and where (sign-up form or account page) you did so. We do not send news to guests, and we never pass your address to others for their advertising.
Server logs. When you open a page our web server records the IP address, time, requested address and browser type to keep the Service secure and fix errors. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). These logs are rotated daily and deleted after 14 days. File names are not written to the logs.
E-mails you send us. Your message and address, used to answer you and kept as long as needed for that. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Statistics. We use Yandex Metrica to count visits and see which pages and tools are used: pages opened, referring site, device and browser type, approximate region, and tool events (tool, language, file type, number of files or pages, success or error). File names and file contents are never sent, and the tool area of every page is masked from recordings. Legal basis: legitimate interest in running and improving the Service (Art. 6(1)(f) GDPR). Session recording (Webvisor) and click maps are switched on only after you click "Accept" in the cookie banner (Art. 6(1)(a) GDPR).
We also use Google Analytics 4 in Consent Mode: until you click "Accept" it sets no cookies and receives only cookieless signals; after you accept it measures visits with cookies (Art. 6(1)(a) GDPR). You can change your choice at any time with "Cookie settings" at the bottom of every page.
Protection against bots. The sign-up, sign-in and password reset forms use Google reCAPTCHA to tell people from bots. reCAPTCHA collects information about your device and browser and sends it to Google for analysis; the Google Privacy Policy and Terms of Service apply. Signed-in users do not see it. Legal basis: legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).
Advertising. The Service does not show advertising. If we decide to show ads, we will update this policy and the cookie banner before they are switched on.
3. Cookies and local storage
| Name | Purpose | Type | Duration |
|---|---|---|---|
csrftoken |
protects forms and uploads against forged requests | necessary | 1 year |
sessionid |
keeps you signed in (only if you log in) | necessary | 2 weeks |
fpm_anon |
random ID linking a guest to their own server jobs, so nobody else can download the results | necessary | 30 days |
fpm_consent |
remembers your cookie choice | necessary | 1 year |
Google reCAPTCHA (_GRECAPTCHA) |
protection against bots on account forms | necessary | 6 months |
Yandex Metrica (_ym_uid, _ym_d, _ym_isad and similar) |
visit statistics | statistics | up to 1 year |
Google Analytics (_ga, _ga_*) |
visit statistics | only with consent | up to 2 years |
| Saved signature (browser local storage) | lets you reuse your signature in the signing tool | only if you choose to save it | until you delete it |
Necessary cookies do not require consent. You can delete cookies and local storage in your browser settings; without necessary cookies, signing in and server tools will not work.
4. Who receives data
- Hosting provider — our servers are rented from a VPS provider and located in Kazakhstan.
- Unisender Go — delivery of service e-mails.
- Yandex — visit statistics (Yandex Metrica).
- Google — Google Analytics (cookies only with your consent) and reCAPTCHA on account forms.
- Authorities — only where we are legally obliged.
We do not sell personal data and do not pass your files to anyone. If the Service is transferred to a successor, the data necessary to continue it will be transferred as well.
5. International transfers
Our servers are located outside the European Economic Area, in Kazakhstan. When you use a server tool or create an account, your data is transferred there because this is necessary to provide the service you request. Google may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Yandex Metrica data is processed by Yandex in Russia and Finland.
6. Security
Connections are encrypted (HTTPS), passwords are hashed, forms are protected against forged requests, job links are random and work only for their owner, processing runs in isolated workers without internet access, and files are deleted automatically. Browser tools keep your files on your device by design. No system is perfectly secure, but we work to protect your data.
7. Your rights
You can request access to your data, its correction or deletion, restriction of processing, data portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to info@freepdfmodify.com — from your account e-mail if the request concerns an account — so that we can verify it is you. You also have the right to complain to a data protection authority in your country. We do not make automated decisions that have legal or similar effects on you.
8. US residents
We do not sell or share personal data for cross-context behavioural advertising, and we honour the Global Privacy Control signal.
9. Children
The Service is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has created an account, contact us and we will delete it. The tools can be used without an account and without giving any personal data.
10. Changes
We may update this policy. The date of the last update is shown on this page; for significant changes we will inform registered users in advance.
Last updated: