1. Overview
HatchMyPDF provides browser-based PDF tools that run locally in your browser. Files are not uploaded to our servers and are not stored by us. We use Google Tag Manager, Google Analytics 4, and Google AdSense. This Policy applies worldwide.
2. Controller and scope
The data controller is 8BIT CLOUD SYSTEMS SRL. This Policy governs personal data processed on hatchmypdf.com and related subpages.
3. What we do not process (PDF contents)
PDF operations (e.g., setting or removing a password) execute locally via WebAssembly/Web Workers. We do not receive your documents, make copies, or recover them.
4. Data processed on the site
- Technical metadata: IP address, user agent, browser/OS, language, approximate location by IP, request timestamps.
- Analytics events: page views, clicks, conversions (via GA4, subject to consent where required).
- Advertising identifiers/cookies: for ads delivery and, if consented, personalization (AdSense).
5. Legal bases (GDPR)
- Consent — analytics, marketing cookies, and ads personalization.
- Legitimate interests — security, fraud prevention, basic service metrics in aggregate.
- Contract/Request handling — replies to your contact requests.
You may withdraw consent anytime via Cookie settings.
6. Cookies and consent management
We use a consent management panel (CMP). You can accept or reject non-essential categories and modify your choices at any time in Cookie settings. Categories: Necessary, Analytics (GA4), Ads/Marketing (AdSense).
California residents may use the Do Not Sell or Share page to opt out of “sale/share” for cross-context behavioral advertising.
7. Cloudflare (infrastructure)
We use Cloudflare for DNS, CDN, TLS, DDoS protection, WAF, caching, and routing. Your requests may be proxied through Cloudflare’s edge network and static assets may be temporarily cached at the edge. For abuse prevention we may challenge, rate-limit, or block suspicious traffic. Cloudflare acts primarily as our processor of request metadata (e.g., IP, user agent). Data may be transferred outside the EEA under appropriate safeguards.
8. Contact form (planned)
If you use the contact form, we process your name, email, subject, and message to respond and manage the thread. We do not use this information for unrelated marketing without your consent.
9. Recipients and roles
- Google Tag Manager — tag orchestration; does not itself collect personal data beyond what providers load.
- Google Analytics 4 — analytics; Google generally acts as our processor under applicable data processing terms.
- Google AdSense — ads delivery; Google may act as an independent controller for ad personalization.
- Cloudflare — infrastructure provider acting as our processor for security and delivery.
We do not sell personal data for monetary consideration. Under CPRA, ads personalization may constitute “share”. Such “share” occurs only with your consent and can be opted out.
10. International transfers
Providers may process data in third countries (including the U.S.). Transfers rely on appropriate safeguards such as Standard Contractual Clauses and provider-specific measures.
11. Retention
- GA4: user and event data retained up to 14 months (as configured).
- Contact requests: retained until the thread is closed and for a reasonable period (typically up to 24 months), unless law requires otherwise.
- Security/technical logs: kept for the minimum necessary period.
12. Your rights (GDPR/UK GDPR)
You may request access, rectification, erasure, restriction, portability, and object to processing. You may withdraw consent at any time via Cookie settings. You can lodge a complaint with your supervisory authority (Romania: ANSPDCP).
13. California rights (CCPA/CPRA)
Rights to know, delete, correct, non-discrimination, and to opt-out of “sale/share”. Use Do Not Sell or Share. We will take steps to verify your request.
14. Security
All traffic is protected via HTTPS. PDF operations run locally; we do not receive files. Perimeter protections include Cloudflare WAF/DDoS. We review and update technical and organizational measures periodically.
15. Children
The site is not intended for children under 13. We do not knowingly collect their data. If you believe a child provided data to us, contact us to delete it.
16. Changes to this Policy
We may update this Policy. The new version applies upon publication. For material changes affecting purposes, providers, or legal bases, we will provide clear notice and, where required, re-gather consent via the banner.
17. Contact
Data requests and questions: [email protected]
Controller: 8BIT CLOUD SYSTEMS SRL, Bucharest, Sector 2, 158 Calea Moșilor, Module 393, Room 4, 4th Floor, Romania