Privacy Policy

Who we are

FreePDFRedaction operates freepdfredaction.com. For any privacy question, contact jmcelvanna@gmail.com. [Add registered legal entity name and address before launch.]

The core principle

The service is designed so that we hold as little of your data as possible. Your uploaded PDF is processed in memory and discarded within seconds of your download. We do not store your document, log its contents, or use it to train anything.

What we process

• Your files (transient). Held in memory for the duration of the request, then discarded. Not written to long-term storage.
• OCR sub-processing. Pages without a text layer are sent to AWS Textract solely to locate text so it can be removed. This is our only content sub-processor and it is disclosed on every page of this site.
• Account data. If you sign in with Google we store your Google account identifier, your email address, and the time the account was created.
• Usage records. For signed-in users we record the number of pages processed per job and which plan was in effect, to operate fair use and billing. We do not record what was in the document.
• Payment data. Handled by Stripe. We store a Stripe customer identifier and subscription status. We never see or store card details.
• Analytics. We use Google Analytics to understand which pages people find useful. It records page paths, approximate location, device and referrer. It does notreceive your documents, filenames, or the terms you redact — those never leave the processing path.
• Cookies. A session cookie for sign-in (essential), and Google Analytics cookies used to count visits. [If you serve EU/UK visitors, analytics cookies generally require consent before they are set — see the note below.]

Legal bases (UK/EU GDPR)

Performance of a contract (providing the service you asked for), and our legitimate interests in operating and securing it. Where consent is required, we ask for it.

Sub-processors

• Amazon Web Services — hosting, and Textract for OCR of scanned pages.
• Google — sign-in only; Google sees that you authenticated, not your documents.
• Stripe — payment processing.
• Google Analytics — site usage measurement. It never receives document contents.

[Note for launch: analytics cookies set before consent are a common compliance gap for EU/UK visitors. Either add a consent banner that blocks Google Analytics until accepted, or switch to a cookieless analytics tool, which avoids the requirement entirely.]

Retention

Documents: discarded within seconds. Account and usage records: kept while your account exists. Payment records: retained by Stripe and by us as required for accounting purposes.

Your rights

You may request access to, correction of, or deletion of your account data, and object to or restrict processing. Because we do not retain documents, most requests concern account data only. Write to jmcelvanna@gmail.com.

International transfers

Processing takes place in AWS us-east-1 (United States). [If you serve EU/UK users, confirm the transfer mechanism — e.g. Standard Contractual Clauses — with counsel.]

Security

All traffic is encrypted in transit with TLS. Documents are processed in memory and not written to long-term storage. See Security for detail.

Children

The service is not directed to anyone under 16.

Changes

Changes are posted here with a new “last updated” date.