Privacy policy

PaperWorksPDF operates the paperworkspdf.com website and its PDF, document and text tools. For the limited personal data we determine the purpose and means of processing, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023, and you are the Data Principal.

This notice is provided in clear and plain language as required by Section 5 of the DPDP Act. On request, it can be made available in English and in the languages listed in the Eighth Schedule to the Constitution of India through the language selector on this site.

PDF editing, conversion, compression, OCR, organisation and security tools run inside your browser using your device's processor and memory. Your document content is not transmitted to us for these tools, and we neither read nor store it.

The only exception is the optional 'send for signature' feature. If you choose it, the document you select is stored in encrypted cloud storage solely to deliver it to the recipient link you generate, and it is deleted after the request expires.

Contact data you send us by email (name, email address, message contents) — processed for certain legitimate uses and on your consent, to answer support, privacy or security requests.

Signature request data (sender and recipient name and email, document name, status timestamps) — processed on your consent for the specific purpose of delivering and tracking that signature request.

Technical data automatically generated when serving the site (IP address, timestamp, request path, browser and device type, error diagnostics) — processed to keep the service secure, available and lawful, including the log retention obligations described below.

Interface preferences (chosen language and light or dark theme) — stored locally in your own browser, not on our servers.

Where processing relies on your consent, that consent is free, specific, informed, unconditional and unambiguous, and is limited to the purpose stated at the point of collection. You can withdraw consent at any time by writing to the grievance officer; withdrawal does not affect processing already carried out lawfully.

In line with Section 9 of the DPDP Act, the service is not directed at children below eighteen years of age. We do not knowingly process a child's personal data without verifiable parental consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

You have the right to obtain a summary of the personal data being processed and the processing activities undertaken, the right to correction, completion, updating and erasure, the right to nominate another individual to exercise your rights in the event of death or incapacity, and the right to readily available grievance redressal.

To exercise any right, email the grievance officer using the address on the contact page with enough detail to identify your request. We acknowledge requests within a reasonable period and ordinarily respond within thirty days. If you are not satisfied, you may approach the Data Protection Board of India.

Personal data is retained only for as long as the stated purpose requires or as long as an applicable law requires. Signature request documents and metadata are erased after the request expires; support correspondence is retained only as long as needed to resolve and evidence the matter.

We apply reasonable security safeguards, including encryption in transit, encryption at rest for stored signature documents, access controls and least-privilege service credentials, to prevent a personal data breach. In the event of a breach we will notify affected data principals and the Data Protection Board of India as required by the DPDP Rules, and report reportable cyber incidents to CERT-In within six hours as required by the CERT-In Directions dated 28 April 2022.

Work in progress lives in your active browser tab's memory. Download finished files before closing the tab, refreshing, clearing browser data or switching devices — a closed session cannot be recovered.

We do not sell personal data and we do not share it for advertising. Limited processing is carried out by hosting, storage and infrastructure providers engaged under contract as Data Processors, strictly on our instructions.

Personal data may be processed on servers located outside India in accordance with Section 16 of the DPDP Act and any restrictions notified by the Central Government. Logs required by the CERT-In Directions are maintained for a rolling period of one hundred and eighty days and, where required, within Indian jurisdiction.

A Grievance Officer is designated under Section 13 of the DPDP Act and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Contact details are published on the contact page.

Complaints are acknowledged within twenty-four hours and resolved within fifteen days of receipt, and information related to unlawful content covered by Rule 3(2)(b) is acted upon within twenty-four hours. Please do not include confidential document contents in a first message.

Material changes to purposes, retention or your rights will be reflected here before they take effect. Continued use after an update means you have had the opportunity to review it; consent-based processing is not extended to a new purpose without fresh consent.