# Privacy policy

How html-pdf.com collects, uses and protects personal data, under the EU General Data Protection Regulation (GDPR) and Spanish data protection law.

Last updated: 15 October 2026.

## Who is responsible

The data controller is **Wioks Global, S.L.** (NIF B67621250), Calle Sant Josep 132-134, 08980 Sant Feliu de Llobregat, Barcelona, Spain. For anything related to your data, write to **privacy@html-pdf.com**.

## What we collect

We keep the minimum needed to run the service.

| data | why | legal basis (GDPR art. 6) |
|---|---|---|
| Email address | Your account, login links and service emails | Contract (6.1.b) |
| API keys (stored hashed) | Authenticating your requests | Contract (6.1.b) |
| Credit ledger and purchases | Your balance, receipts and accounting | Contract (6.1.b) and legal obligation (6.1.c) |
| Conversion metadata (time, pages, size, duration, status) | Usage history in your dashboard, abuse prevention | Contract (6.1.b) and legitimate interest (6.1.f) |
| IP address and request logs | Security, rate limiting and debugging | Legitimate interest (6.1.f) |
| Browser ID (`hp_bid`, a random ID in a cookie and local storage) and the IP used when you sign up, log in or use the converter | Preventing abuse of the free credits (one grant per person), kept while your account exists | Legitimate interest (6.1.f) |
| Email, signup source and account events (signups, conversions, purchases) | Internal notifications so we can follow usage and spot problems as they happen | Legitimate interest (6.1.f) |
| Product analytics in your browser (PostHog) | Understanding how the site is used. In the EU, EEA, UK and Switzerland only if you accept; elsewhere on by default with an opt-out in Cookie settings | Consent (6.1.a) in the EU, EEA, UK and Switzerland; legitimate interest (6.1.f) elsewhere |
| Account activity analytics (PostHog, from our server): email, signup source, conversions (pages, source, errors, never content), logins, purchases and credit balance | Understanding how customers use and pay for the service, improving it | Legitimate interest (6.1.f). You can object at any time by writing to privacy@html-pdf.com |

**Document content is not stored.** The HTML or URL you send is rendered in memory and discarded. A PDF is only kept when you ask for a download link (API `response: "url"`, the MCP tools, or the first conversion from a free tool, whose download link we email to you), and it is deleted automatically after 24 hours.

We do not sell personal data and we do not use it for advertising.

## Who processes data for us

These providers process data on our behalf under data processing agreements.

| provider | purpose | location |
|---|---|---|
| Railway Corporation | Hosting of the application and database | USA, with Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments and invoices. We never see your card number. | EU (Ireland), with transfers covered by Stripe's safeguards |
| Resend (Plus Five Five, Inc.) | Sending login links and service emails | USA, with Standard Contractual Clauses |
| Plausible Analytics (Plausible Insights OÜ) | Privacy-friendly visit statistics, no cookies, no personal data | EU (Germany) |
| PostHog Inc. | Product analytics: browser analytics as described above, and account activity sent by our server | EU Cloud (Germany) |
| Discord Inc. | Internal team notifications (account email and account events, never document content) | USA, with Standard Contractual Clauses |

Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

## How long we keep data

- **Account data** is kept while your account exists. Ask us to delete it at any time.
- **Purchase and invoice records** are kept for 6 years, as Spanish tax law requires.
- **Conversion metadata** is kept while your account exists.
- **Server logs** are kept for up to 30 days.
- **Download links** expire after 24 hours, and the PDF is deleted.

## Your rights

You can ask to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Write to **privacy@html-pdf.com** from your account email and we will reply within one month.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) at [aepd.es](https://www.aepd.es).

## Cookies

We use essential cookies to keep you logged in and to prevent abuse of the free credits, and optional analytics only with your consent. See the [cookie policy](https://html-pdf.com/cookies).

## Security

API keys and login tokens are stored hashed, traffic is encrypted with HTTPS, the rendering engine is isolated from private networks, and access to production systems is restricted.

## Changes

We will update this page when our practices change and post a note in the [changelog](https://html-pdf.com/changelog). Material changes are announced by email to account holders.