Privacy Policy

In the editor. Documents are laid out on your device. Without an account they stay in your browser. With an account they are also saved to your online library on our servers, with their earlier versions and the images in them, until you delete them or your account.

Downloading a PDF. The document is sent to our servers, printed and sent back. We do not keep the PDF. On Pro and Max we keep nothing of the document either. Without an account and on Free, we keep the document’s source (its HTML and print settings) for 30 days, so that a PDF that came out wrong can be reproduced and fixed, and the source of a print the engine could not make at all for 14 days, to find the engine’s fault; then it is deleted.

Importing a PDF with AI. The PDF is sent to our servers and its pages to Google’s Gemini models, which analyse its structure. We do not keep the PDF file. We keep the rebuilt document (its text, images and fonts) on our servers, filed under a fingerprint of the file, for 180 days after it was last opened, so that the same PDF opens again without a second AI analysis. We also use these rebuilt documents, on our own servers only, as test cases for the import, never to train a model. Ask us and we delete yours sooner.

The AI assistant in the editor (asking AI, writing or translating a document, taking a brand from a website) sends your request and the parts of the document it needs to Anthropic’s Claude models. To take a brand, our servers fetch the website you name.

With “Keep the PDF editable”, the document travels inside the PDF, encrypted with AES-256-GCM. To be printed, the document is sent to our servers as described under “Downloading a PDF”; the encrypted copy inside the file is not kept.

Documents sent to the API at api.reflowpdf.com are printed on our servers and sent nowhere else. On Pro and Max no copy of a print’s source is kept. What a request asks us to hold is kept for its time: a file stored for a link, and a job with its result, 24 hours (a stored file until you delete it, if sooner); an Idempotency-Key with the answer it got and a digest of the request (not the request itself), 24 hours, and the file answered under it, an hour. On Free we also keep a print’s source (its HTML and options, without encryption passwords, attachments’ bytes or an ICC profile) for 30 days, and the source of a print the engine could not make for 14 days. Each print adds a line to your account’s log of prints: when, the sizes of the document and the PDF, its paper, pages, how long it took and whether it succeeded; on Free the line also names the address the request came from, the document’s name and an error’s message. The whole list is in the API’s documentation.

The ReflowPDF Engine — the reflowpdf program and the @reflowpdf/engine package — prints on your own computers, servers and web pages and sends none of your documents to us. It contacts api.reflowpdf.com only to:

• get its license token, sending your license key (on a server, also your API key);
• for a licensed Engine, get a printer profile or a font from our catalogue that a document names, sending the token and that name;
• get its own files, if you load them from our address.

In a web page these requests come from your visitor’s browser and carry its IP address and your page’s origin; the token is kept in that browser’s local storage. Like every request to api.reflowpdf.com, they pass through Cloudflare on their way to us. Our technical logs keep these requests for 14 days; a token request’s line there includes the license key. To see whether a license is used on more installations than it covers, we keep, for each license and for 31 days, the websites its token was requested from and, for a server that requests it with your API key, a keyed one-way hash of that server’s IP address — never the address itself. The license itself — its key, its holder, the domains it covers and its subscription — is kept with your account. The Engine’s terms are the ReflowPDF Engine License.

You can connect an AI assistant — Claude, ChatGPT, Cursor or another — to ReflowPDF at https://app.reflowpdf.com/mcp. The assistant then sends us what it writes for you: the HTML and styles of a document, template data, images, or a PDF to import. What you write in your chat is governed by the privacy policy of the company that provides your assistant (for example Anthropic or OpenAI). We keep:

• The PDFs we print for 24 hours, at a link only the assistant receives.
• The document behind each PDF (its source, data and name) for 30 days after it last changed, so that you can open it in the editor from its edit link and the assistant can change it later. Anyone who has an edit link can open that document — share it as you would a private document link.
• Images the assistant or the editor adds to such a document, for 30 days after the last change of a document that uses them.
• PDFs sent for import for 24 hours.

The connector works without an account: such prints carry a small ReflowPDF mark, and your IP address is used to limit how many requests one address can make. When you sign in from your assistant, or choose “Make it mine” on a document you opened from it, we create an access key for that assistant or that document. You see every key under Account → Connect AI assistants and can revoke it at any time. Prints made with a key count towards your plan like prints from the editor.

Account data: your email address, a securely hashed password, and your subscription status. We use this only to authenticate you and operate your account.

Your documents and images: what you save to your online library, and what you or your assistant send us as described above.

Access keys: for each key, its name, its first characters, when it was made and last used. The key itself is kept only as a hash.

Payment data: handled by Stripe (see below). We store only a Stripe customer reference and your plan status — never full card numbers, CVVs, or card details.

Usage data: counts of pages printed, AI conversions and AI requests, your plan, and timestamps, so we can enforce plan limits and bill accurately. This is metadata about your usage, not the contents of your documents. The log of API prints is part of it: kept with the account, and on Free it includes the address a request came from, the document’s name and an error’s message (on Pro and Max it does not).

Technical logs: IP addresses and request metadata of the requests our servers answer, kept 14 days for security and abuse prevention (the log of API prints, above, is not a technical log).

Payment processing is handled by Stripe, Inc. We do not store credit card numbers, CVVs, or full card details on our servers. Stripe’s privacy policy governs how your payment information is handled: stripe.com/privacy.

We do not use your documents to train AI models, and no document content enters any training dataset of ours. The AI features send content to the model providers named above only to perform your request, through their paid business APIs, whose terms do not allow Google or Anthropic to use that content to train their models.

The providers keep what they are sent for a set time, under their own terms. Google keeps prompts, their context and the outputs for 55 days, to detect and prevent violations of its prohibited use policy and for legal or regulatory disclosures (Gemini API usage policies). Anthropic deletes API inputs and outputs within 30 days; it keeps them up to 2 years only when its systems flag a violation of its usage policy, and longer where the law requires (Anthropic’s retention).

We use Plausible Analytics to count page views. Plausible sets no cookies and stores no personal data; we see totals per page, not individual visitors. Cloudflare Web Analytics also counts page views and load times on our sites and in the editor; it sets no cookies either.

ReflowPDF itself uses only essential cookies: your session when you are signed in, and a cookie that marks the editor as used without an account. No tracking cookies, no advertising cookies, and no Google Analytics or Facebook Pixel. The editor keeps your drafts, images and settings in your browser’s own storage on your device.

We do not sell your data. We share it only with the service providers needed to run ReflowPDF, and only to the extent required to provide the Service: Stripe for payments; Google (Gemini) for AI import of PDFs; Anthropic (Claude) for the AI assistant in the editor; Cloudflare, through which our sites and api.reflowpdf.com are served and which counts page views; Plausible, which counts page views; and our hosting provider in the United States. We may also disclose data if required by law or to protect our rights.

• Documents in your online library: until you delete them or your account.
• PDF files you import: not kept. Their rebuilt documents, with the PDF’s images and fonts: 180 days after they were last opened, or sooner on request.
• From AI assistants: printed PDFs 24 hours; documents by edit link 30 days after their last change; their images 30 days after the last change of a document using them; PDFs sent for import 24 hours.
• Account data: while your account is active; if you delete your account, associated personal data is permanently removed within 30 days, except records we must keep for legal, tax, or accounting purposes.
• The source of a downloaded or API print: not kept on Pro and Max; without an account and on Free, 30 days, and that of a print the engine could not make, 14 days.
• The log of API prints: with the account (see “Usage data”).
• Files the API holds for a request: a file stored for a link and a job with its result, 24 hours; an Idempotency-Key with the answer it got and a digest of the request, 24 hours; the file answered under it, an hour.
• A PDF sent to the accessibility checker on this site: until its check ends; it is written to a temporary file for veraPDF and deleted then.
• Requests of the ReflowPDF Engine (its license token, a printer profile, a catalogue font, its own files): only in the technical logs.
• Technical logs: 14 days.

You can request a copy of the data we hold about you, ask us to correct it, or request deletion of your account and associated data. If you are in the EU/EEA, you have rights under the GDPR (access, rectification, erasure, restriction of processing, portability and objection), and you may complain to your data protection authority; the legal basis for processing account data is performance of our contract with you, and the basis for analytics is legitimate interest. If you are a California resident, you have rights under the CCPA, including the right to know and to delete, and we do not sell personal information. We respond to all requests within 30 days.

We protect your data with encryption in transit (TLS), password hashing, and access controls. Our servers are located in the United States; if you access ReflowPDF from outside the United States, you understand your data is processed there.

ReflowPDF is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the Service evolves; material changes will be communicated by email to registered users. For privacy questions, data requests, or concerns, contact INSEAW LLC at hello@reflowpdf.com or by mail at 301 Corday Lane, Greer, SC 29650, United States.