Privacy notice

Introduction

This Privacy Notice explains how pdf-mcp ("we", "us", "our") collects, uses, and protects your personal data when you use our PDF generation API and related services. We process that data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using our services, you acknowledge that you have read and understood this Privacy Notice. If you do not agree with our practices, please do not use our services.

Data controller

The data controller responsible for your personal data is:

Data we collect

Account information

When you create an account, we collect:

• Email address: used for magic-link authentication, account notifications, and support messages
• Account identifiers: unique identifiers generated to manage your account and API access
• API keys: cryptographically generated keys used to authenticate API requests

Usage information

When you use our API services, we collect:

• API request logs: timestamp, endpoint called, response status, and credit usage
• Credit transactions: records of credit purchases, usage, and balance changes
• Technical metadata: IP address, user agent, and request headers used for security and debugging

Payment information

Payment processing is handled by Stripe. We do not store complete credit card numbers or bank account details. We receive and store:

• Last four digits of payment cards
• Card brand and expiration date
• Billing address (if provided)
• Transaction records and invoices

Document content

pdf-mcp has three storage modes for generated documents:

• By default, generated PDFs are stored with managed storage and configurable retention periods
• With the storage: "memory" parameter, documents are processed in memory only and not persisted
• With Bring Your Own Bucket (BYOB), PDFs are stored directly in your own cloud storage
• You select a storage mode for each request

If you use the "Bring Your Own Bucket" (BYOB) feature, PDFs are stored in your own cloud storage infrastructure, and we retain no copies.

Legal basis for processing

We rely on the following legal grounds under GDPR Article 6 when processing your personal data:

Contract performance (Art. 6(1)(b))

Processing necessary to provide our PDF generation services, manage your account, and fulfill credit purchases.

Legitimate interests (Art. 6(1)(f))

Processing for fraud prevention, security monitoring, service improvement, and technical troubleshooting.

Legal obligation (Art. 6(1)(c))

Processing required to comply with tax, accounting, and other legal requirements.

Consent (Art. 6(1)(a))

Where applicable, for optional marketing communications (you may withdraw consent at any time).

How we use your data

We use your personal data for the following purposes:

• Service delivery: provide and maintain our PDF generation API and MCP server
• Authentication: verify your identity and authorize API access
• Billing: process payments, manage credits, and send invoices
• Support: respond to inquiries and resolve technical issues
• Security: detect, prevent, and respond to fraud, abuse, or security incidents
• Service improvement: analyze usage patterns with aggregated, anonymized data
• Communication: send service notices, updates, and security alerts
• Compliance: meet legal and regulatory obligations

Data sharing and transfers

Third-party service providers

We share data with trusted third parties who assist in operating our services:

International transfers

All primary data processing occurs within the European Union (Germany, Frankfurt region). Where data is transferred outside the EU (e.g., to US-based sub-processors), we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) are in place.

No sale of personal data

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We only share data as described in this Privacy Notice or with your explicit consent.

Data retention

We retain data only as long as necessary for the purposes described. The current retention periods are:

Account data

Retained while your account is active, plus 30 days after deletion request.

API logs

Retained for 90 days for debugging and security purposes, then permanently deleted.

Transaction records

Retained for 7 years to comply with tax and accounting regulations.

Document content

Retention depends on storage mode. With managed storage, retained per your retention settings. With stateless mode (storage: "memory"), processed in memory only and discarded immediately.

Your rights

Under GDPR and applicable data protection laws, you have the following rights:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data ("right to be forgotten")
• Right to restriction: request limited processing in certain circumstances
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at support@pdf-mcp.io. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

Security measures

We use the following technical and organizational measures to protect your personal data:

• Encryption: all data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access controls: strict role-based access controls limit who can access data
• API security: API keys are hashed and stored securely; requests are rate limited
• Infrastructure: hosted on cloud infrastructure with enterprise security certifications
• Monitoring: continuous security monitoring and incident response procedures
• Storage: managed storage, BYOB, or stateless mode (storage: "memory") for in-memory processing only

Cookies and tracking

Our website uses only the cookies needed to operate the service:

Essential cookies

Required for authentication, session management, and security. Cannot be disabled.

Analytics

We may use privacy-respecting analytics to understand site usage. No personal data is collected for analytics purposes.

We do not use third-party advertising cookies or tracking pixels. We do not participate in cross-site tracking or behavioral advertising.

Children's privacy

Our services are not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at support@pdf-mcp.io.

Changes to this notice

We may update this Privacy Notice when our practices or legal requirements change. We will notify you of significant changes by:

• Posting the updated notice on our website with a new "Last updated" date
• Sending an email notification for material changes affecting your rights

Review this Privacy Notice periodically for current information about how we protect your data.

Contact us

Contact our privacy team with questions, concerns, or requests about this Privacy Notice or our data practices:

For general support or other inquiries, see our Imprint for more contact information.