Vellum PDF

Privacy Policy

Last updated: 19 October 2026 · Applies to vellum-pdf.xyz

The short version. The PDF and image files you open in the tools on this site are processed entirely inside your browser. They are not uploaded, not logged, and not stored on any server we control. This site does not currently use advertising or analytics cookies.

1. Files you open in the tools

The converter on the home page does not send your documents anywhere. When you select a file, your browser reads it from your own disk and passes it to JavaScript libraries running on your device — pdf-lib and PDF.js, both loaded from a public content delivery network. The document is processed in your browser's memory and the result is handed back to you as a download.

Concretely, this means:

  • We do not receive your file, its contents, its file name, or any text or images inside it.
  • We do not copy your file to a server, a backup, a log, or an analytics property.
  • We cannot recover a document after you close the tab, because a copy was never made.
  • Downloads you trigger are saved by your own browser to your own device, under your control.

If you paste an image from your clipboard, it is read from your clipboard in the same way and is likewise never transmitted.

2. Information we collect

The tools themselves collect nothing. The website around them collects only what is needed to serve and secure the pages.

Server logs

Our hosting provider, Cloudflare, records standard request logs, including IP address, user agent, requested URL, timestamp and referrer. These are used to keep the site running, diagnose errors and block abuse. They are retained for a short period and then deleted.

Analytics and advertising

This site does not currently run third-party analytics or display advertising, so no analytics or advertising cookies are set.

3. Cookies and advertising

This site does not currently use advertising cookies or third-party analytics cookies. If that changes, this policy will be updated before any such cookies are set.

Because this site does not currently set advertising or analytics cookies, no consent banner is shown. If advertising or analytics are introduced, a compliant consent mechanism will be used where required.

5. How we use information

  • To operate, secure and maintain the site, including preventing abuse and enforcing our terms.
  • To understand aggregate usage so we can improve the tools.
  • To respond to messages you send us.
  • To comply with legal obligations and enforce our rights.

We do not sell personal information.

Where the GDPR applies, we rely on the following bases:

  • Legitimate interests — for server security, fraud prevention, and keeping the site available.
  • Contract — for responding to your messages or reports about the tools.
  • Legal obligation — where retention is required by law.

7. Your rights

Depending on where you live, you may have the right to:

  • Ask for a copy of the personal information we hold about you.
  • Ask us to correct information that is inaccurate or incomplete.
  • Ask us to delete information we hold about you.
  • Ask us to restrict or object to certain processing.
  • Receive your information in a portable, machine-readable format.
  • Withdraw consent at any time, which stops the processing it covered.
  • Complain to your local data protection authority.

California residents: under the CCPA/CPRA, you have the right to know what personal information is collected, to request deletion, to correct inaccurate information, to opt out of sale or sharing for cross-context behavioural advertising, and to limit use of sensitive personal information. We do not sell personal information. To exercise any of these rights, use the contact details below; we will verify the request and respond within the period the law requires.

8. Retention and security

Server logs are retained for a limited operational period and then deleted. Email you send us is kept while we deal with your message and for a reasonable archive period afterwards.

The site is served over HTTPS. Access to the hosting account is restricted to the people who need it and protected with strong authentication. As a general rule, the less data we hold, the less there is to lose.

9. Children

This site is a general-audience utility and is not directed at children under 13, or the equivalent minimum age in your jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

10. International transfers

We are based in France and use service providers in other countries, including Cloudflare's infrastructure for hosting and content delivery. Where personal information is transferred out of your country, we rely on standard contractual clauses or an equivalent transfer mechanism, together with the safeguards described in this policy.

11. Third-party services

These services are used on this site and are governed by their own privacy policies:

  • Cloudflare — hosting, security and content delivery. Cloudflare's privacy policy.
  • jsDelivr / cdnjs — content delivery for the pdf-lib and PDF.js libraries, which are open source and loaded directly by your browser.

12. Changes to this policy

We update this policy when the site or the law changes. The date at the top of the page always reflects the most recent version, and material changes will be summarised here.

13. Contact

Questions about this policy, or a request to exercise a privacy right, can be sent to privacy@vellum-pdf.xyz. See the about and contact page for postal details and our response time.