Privacy Policy
Updated on October 25, 2026
This policy explains how we handle personal data at pegapdf.com.br. It follows Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018).
The short version
- No file is uploaded in the PDF and photo tools. The PDFs and photos you use with them are opened and processed in your browser. They never reach our server, and we have no way to see, keep or recover any of them.
- The exception is Word, Excel and PowerPoint to PDF. On those three pages, the document goes to our server, in Brazil, is converted to PDF and deleted right away, without being stored. The PDF comes back only to you.
- There are no accounts. The resume builder asks for your name and contact details to build the PDF, but that data is stored only in your browser.
- Access logs (IP address, date and time, port) are kept for 30 days.
- We count visits without cookies: only daily totals (how many people, device and where they came from), without storing your IP address.
- Ads are from Google and use cookies. You can turn off personalization.
Who is responsible
The data controller is Isabele Morais, an individual based in Brazil who runs the site. For anything about personal data, email [email protected] with the subject “Privacy”.
As a small data processing agent (ANPD Resolution CD/ANPD No. 2/2022), we haven’t appointed a data protection officer. That email address is the official channel for you and for Brazil’s data protection authority (ANPD).
Your files
When you pick a PDF or a photo, your browser reads it from your device and does the work right there: merging, splitting, compressing, converting or organizing. The result is also created on your device. None of this goes through our server or any provider’s server.
- The name, content and exact size of your files aren’t sent to anyone.
- Closing or reloading the page clears everything that was in the tab’s memory.
- Photos turned into a PDF leave out their hidden data, like location.
What your browser downloads from our site is only the tool code (the open-source pdf-lib and PDF.js libraries), the same for everyone.
Word, Excel and PowerPoint to PDF
Turning an Office document into a PDF takes a full office suite, which doesn’t fit in a phone browser. So, on the Word to PDF, Excel to PDF and PowerPoint to PDF pages, the file you pick is uploaded to our server, in Brazil, and converted there by LibreOffice. It’s the only part of the site where a file of yours leaves your device.
- The document sits in a temporary folder of its own, in the server’s memory, and is deleted as soon as the PDF is ready, whether it worked or not. This usually takes a few seconds.
- The PDF goes straight back to your device, in the conversion’s response, and is not stored on the server.
- The file name is not sent: your browser sends only the content and names the PDF on your device.
- Nobody opens or reads the document. The converter has no internet access, and macros are turned off.
- The server log keeps only the format (like DOCX or XLSX), the size range and the conversion time, never the name or the content.
- To limit abuse, we count conversions per IP address, with the address turned into a code that can’t be reversed, deleted within 20 minutes.
The resume builder
The resume builder stores what you fill in in your device’s browser storage (localStorage), so you can continue later. It stays there until you tap Delete my data or clear your browser data, and it never reaches our server. The resume PDF is also created on your device.
Data we handle
| Data | When |
|---|---|
| IP address, date and time, source port and page visited | On every visit (logs) |
| Device type and system, the site you came from (domain only) and a daily code made from your IP and browser | On each page view, to count visits, without cookies |
| Which tool was used and the size range of the file (like “1 to 5 MB”), never its name or content | When a tool finishes, in analytics (Google Analytics) |
| Analytics and advertising cookies and identifiers | On every visit, until you decline in “Cookie preferences” |
| Name, email and message content | When you write to us |
| The Word, Excel or PowerPoint document you convert to PDF | Only during the conversion, on our server |
Why we use it, and the legal basis
| Purpose | Legal basis, in plain words |
|---|---|
| Keep the site secure, investigate abuse and keep logs for 30 days | Legitimate interest: keeping the site secure and being able to defend ourselves in court (Art. 7, IX and VI) |
| Measure our audience (Google Analytics) and show personalized ads | Legitimate interest: keeping the site free, with the right to decline at any time in “Cookie preferences” (Art. 7, IX). In the EEA, UK and Switzerland, only with your consent in Google’s message |
| Count visits without cookies: people per day, device and source | Legitimate interest: knowing whether the site is growing, using daily totals only (Art. 7, IX) |
| Show non-personalized ads, limit repeats and fight fraud | Legitimate interest: keeping the site free (Art. 7, IX) |
| Convert to PDF the document you uploaded | Your request: it’s the service you chose to use (Art. 7, V) |
| Answer messages and requests | Your request and the defense of rights (Art. 7, V and VI) |
| Handle requests about your data | Legal obligation (Art. 7, II) |
How long we keep it
| Data | How long |
|---|---|
| The PDFs and photos you use with the tools | They never reach us. They stay on your device, only while the page is open |
| Word, Excel and PowerPoint to PDF documents | Only during the conversion: deleted as soon as the PDF is ready or fails. The PDF is not kept on the server |
| Your resume data | It never reaches us. It stays in your browser until you delete it |
| Visit counts | Daily totals only, with nothing that points to you. The daily code isn’t stored: it only goes into an approximate counter it can’t be pulled back out of, and it changes every day |
| Access logs | 30 days, encrypted and with restricted access |
| Emails | Up to 12 months after the last reply |
If an authority lawfully asks us to preserve a record, we keep it for the period requested.
Who we share it with
We don’t sell data. Only these providers receive any data, and only to make the site work:
- Cloudflare (USA): site delivery (CDN), DNS and attack protection. It sees your IP address and technical browser data on every visit. Word, Excel and PowerPoint to PDF documents pass through it on the way to our server, without being stored; other files don’t go through it.
- Google (USA): ads (AdSense) and analytics (Google Analytics). For ads, Google is an independent controller of the data it collects. See how Google uses data from partner sites.
- Hosting in Brazil: the servers for the site, the logs and the document converter.
Authorities only receive data with a court order or a request provided for by law. Even then, we don’t have your files to hand over.
International transfers
Cloudflare and Google are US companies and may process data there and in other countries. The transfer is needed to deliver the service you asked for (LGPD Art. 33, IX) or depends on your consent, for analytics and personalized ads (Art. 33, VIII). These providers are also contractually bound to protect the data.
Cookies and ads
The site shows Google AdSense ads.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this site and/or other sites on the Internet.
- You can opt out of personalized advertising in Google Ads Settings.
- Other vendors and ad networks may also show ads here and use cookies. To opt out of their use of cookies for personalized advertising, visit optout.aboutads.info or, in Europe, youronlinechoices.eu.
- Learn more at https://www.google.com/policies/technologies/ads/.
To change your choice, use “Cookie preferences” in the footer. Cookie list, lifetimes and how to block Google Analytics: Cookie Policy.
Your rights
Under the LGPD (Arts. 18 and 20), you can:
- confirm whether we hold data about you, and access and correct it;
- ask us to anonymize, block or delete data that is unnecessary, excessive or handled unlawfully;
- ask for data portability;
- withdraw your consent and have data handled under it deleted;
- learn who we share data with and what happens if you don’t consent;
- object to processing that breaks the law.
How to ask: email [email protected] with the subject “Privacy”. We reply within 15 days.
With no accounts and no stored files, almost nothing we handle points to you: at most, the last 30 days of logs and any messages you sent us. For log requests, give us the IP address, the date and the approximate time. We may ask for more information to confirm the IP address was yours. We release someone else’s records only with a court order.
You can also file a complaint with the ANPD at gov.br/anpd.
Outside Brazil
- EEA, UK and Switzerland: you’ll see Google’s consent message, which asks for your choice before analytics and personalized ads turn on. You have similar rights under the GDPR, the UK GDPR or Swiss data protection law, and you can also complain to your local data protection authority.
- United States: to opt out of targeted advertising under state privacy laws, click “Cookie preferences” in the footer and then “Decline”, or use Google Ads Settings.
Children and teens
The site isn’t made for children. You must be at least 13 to use it.
We don’t ask your age, and we don’t target ads at children or teens. Brazilian law bans profiling minors for advertising (ECA Digital, Law No. 15,211/2025). If you’re under 18, tap “Cookie preferences” in the footer and then “Decline”. You’ll still see ads, just not personalized ones.
Parents and guardians who think we hold data about their child can email [email protected]. We’ll delete whatever we can identify.
Security
- HTTPS across the whole site.
- Files used in the PDF and photo tools never leave your device. Word, Excel and PowerPoint to PDF documents are deleted from the server at the end of each conversion, and the converter has no internet access. There’s no stored file to leak.
- Encrypted logs, accessible only to the person who runs the site.
- No accounts, so no passwords to leak.
If an incident creates a relevant risk, we notify the ANPD (LGPD Art. 48) and post a notice on this page, since we have no way to contact users without accounts.
Changes and contact
When something changes, the “last updated” date changes too. Important changes, such as a new provider, also get a notice on the site. Questions about this policy: [email protected], subject “Privacy”.