Privacy Policy

1. Who we are

Online2Convert is operated by Carlos Martin and Jorge Recoder ("we", "us", "our"). We provide browser-based file conversion services at online2convert.com.

For any privacy-related questions, contact us at info@online2convert.com.

2. Files you upload

When you use our conversion tools, your files are uploaded to our servers solely to perform the requested conversion. We do not access, read, analyse, or share the contents of your files with any third party.

Files are automatically and permanently deleted after a short retention period depending on your account type:

Once the retention period expires, files are deleted automatically and cannot be recovered. You may also delete your files manually at any time from the download page.

Legal basis: Contract performance (Article 6(1)(b) GDPR).

3. Processing and retention of uploaded files

Data Isolation, Processing, and Variable Retention of Uploaded Files

As a file conversion and utility platform, online2convert.com transiently processes digital files, media, and documents uploaded directly by users. We do not read, open, analyze, scrape, or create permanent backup copies of your uploaded data. All file processing occurs purely programmatically on secure cloud infrastructure, with servers located in the United States.

We enforce strict data minimization practices through a tier-specific automated deletion schedule:

• Anonymous Tier (Unauthenticated Guests): All uploaded files and converted outputs are automatically, permanently, and irreversibly purged from our servers within three (3) hours of the initial upload.
• Free Tier (Registered Users): All uploaded files and converted outputs are automatically, permanently, and irreversibly purged within six (6) hours of the initial upload.
• Premium Subscription Tier: To facilitate convenient user access to recent conversion histories and download queues, files are temporarily cached and are automatically, permanently, and irreversibly deleted exactly twenty-four (24) hours after upload.

Under no circumstances do third parties have access to your uploaded files, and we maintain zero long-term data footprint of your document contents.

Legal basis: Contract performance (Article 6(1)(b) GDPR).

4. Account and profile data

If you create an account, we collect and store the following information:

• Email address — used for authentication and optional notifications.
• Password — stored as a one-way cryptographic hash. Never stored in plain text.
• Subscription tier — free or premium, used to determine retention limits.
• Account creation date and last login — for security and fraud prevention.

We do not collect your name, address, or phone number unless you voluntarily provide it when contacting support.

Legal basis: Contract performance (Article 6(1)(b) GDPR).

5. Usage data and server logs

Our servers automatically record standard access logs when you use the service. These logs may include your IP address, browser type, referring URL, pages visited, and timestamps.

• Detect and prevent abuse, spam, and denial-of-service attacks.
• Enforce rate limiting per IP address.
• Diagnose technical problems and maintain service reliability.

Server logs are retained for a maximum of 30 days and then deleted automatically.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — security and fraud prevention.

6. Email notifications

If you provide your email address and opt in, we may send you a notification when a batch conversion is complete. This is a transactional notification only — we do not send marketing emails without your explicit consent.

You can unsubscribe at any time by clicking the unsubscribe link in any email, or by contacting us directly.

Legal basis: Consent (Article 6(1)(a) GDPR).

7. Payment processing

Premium subscriptions are processed by Stripe, Inc. (a PCI-DSS Level 1 certified payment processor). When you subscribe, your payment card details are entered directly into Stripe's secure form and are never transmitted to or stored on our servers.

We receive from Stripe only a token reference, the last four digits of your card, and the subscription status needed to activate your premium account. For more information see Stripe's Privacy Policy.

Legal basis: Contract performance (Article 6(1)(b) GDPR).

8. Cookies and tracking technologies

We use cookies in three categories. You can manage your preferences at any time via the cookie banner on our site.

Legal basis: Consent (Article 6(1)(a) GDPR) for analytics and marketing cookies. Legitimate interests for strictly necessary cookies.

9. Legal bases for processing (GDPR summary)

For users in the European Economic Area (EEA) and the United Kingdom, we process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — file processing, account management, payment processing.
• Legitimate interests (Art. 6(1)(f)) — server security, abuse prevention, service reliability.
• Legal obligation (Art. 6(1)(c)) — CSAM detection and mandatory reporting.
• Consent (Art. 6(1)(a)) — analytics cookies, marketing cookies, email notifications.

10. Data retention

We retain personal data only for as long as necessary:

• Uploaded files: deleted automatically after 3, 6, or 24 hours depending on account type.
• Account data: retained while your account is active. Deleted within 30 days of account closure.
• Server logs: deleted automatically after 30 days.
• Payment records: retained for 7 years as required by Swiss and EU tax law.
• Cookie consent: stored in your browser for 365 days.

11. Your rights

If you are located in the EEA, the UK, or Switzerland, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data ("right to be forgotten").
• Restriction — ask us to limit processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any of these rights, email info@online2convert.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

12. Third-party services

We use the following third-party services that may process personal data on our behalf:

• Stripe — payment processing. Privacy Policy
• Google Analytics 4 — usage analytics (consent required). Privacy Policy
• Google AdSense — advertising (consent required). Privacy Policy
• Microsoft PhotoDNA — content safety scanning. Privacy Policy

We enter into data processing agreements (DPAs) with all third-party processors as required by GDPR Article 28.

13. International data transfers

Online2Convert is owned and operated from Switzerland, and our service is available to users worldwide. Our hosting infrastructure is currently located in the United States, meaning your personal data — including uploaded files — is transferred to and processed there. Some third-party services we use (including Google, Microsoft, and Stripe) may also transfer data to the United States or other countries outside the EEA. Where this occurs, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and, where the recipient participates, the EU-US Data Privacy Framework (DPF).

14. Fair use policy and automated access restrictions

Fair Use, Automated Exploitation, and Limitation of Liability

The utilities provided on online2convert.com are designed strictly for manual, human interaction via standard web browser interfaces. While the Premium Subscription Tier offers expanded capabilities — including simultaneous multi-file processing — it is subject to an absolute Fair Use policy.

Prohibition of Automated Use: The utilization of automated scripts, web scrapers, command-line tools, cron jobs, bots, or any custom API workarounds to systematically mass-upload or crack our conversion backend is strictly prohibited. Any detected robotic or automated traffic patterns will result in an immediate, permanent IP block and account termination without warning or refund.

Limitation of Functional Liability: online2convert.com is provided on an "as-is" and "as-available" basis. We do not warrant or guarantee 100% accuracy, metadata preservation, or structural integrity across file conversions (e.g., PDF to Word formatting shifts). The platform and its owners hold zero legal liability for any corrupted files, data loss, downtime, or consequential business damages resulting from a failed or incomplete file conversion. Users are entirely responsible for maintaining local copies of their original documents prior to processing.

15. Children's privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@online2convert.com and we will delete it promptly.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users by email. Your continued use of the service after any changes constitutes your acceptance of the updated policy.