Privacy notice
PDFCarry is built so that your documents never leave your computer. This notice says exactly what does, where it goes, how long we keep it and how to ask us about it.
The billing service currently runs in Stripe test mode and no live purchases are open. This notice describes the website, billing service and application as built, so it applies to the preview now and to live sales when they open. See the preview status page for what is and is not available today.
At a glance
- ✓Your PDFs, projects, review notes and reviewer names stay on your computer. The application never uploads them; support only receives what you deliberately send.
- ✓No analytics, advertising or tracking code on the website or in the application.
- ✓Billing holds Stripe identifiers, subscription status and hashed credentials. Stripe holds your payment and contact details on its own pages.
- ✓One essential cookie, only on the billing page, for 30 days.
- !Financial records are kept for at least seven years because company law requires it. Everything else is kept only as long as it is needed.
1. The application on your computer
PDFCarry processes documents locally. The PDF engines and the validator are bundled, and there is no cloud account. Everything you import or create is kept in one data folder on your machine:
- The PDFs you import, exactly as received, and every version the application creates.
- Your projects, review records, notes and the reviewer names you type. Those names are local labels, not verified identities.
- Your licence key and trial state, stored separately and protected with Windows Data Protection so that they are bound to your Windows account.
The application makes network requests only for a paid licence: when you activate, about once a day while the application is open and connected, and when you deactivate. Each request carries the licence key and a random installation identifier generated by the application. It carries nothing about your documents, file names, paths, notes or reviewer names. The 14-day trial makes no network requests at all.
The application can produce a support diagnostics file on request. It contains the application and Windows versions, validator availability, licence state and mode, an integrity-issue count and configured limits. It excludes PDFs, file names, paths, reviewer names and licence keys. It is created on your computer and only leaves it if you send it.
"Local" does not mean encrypted. Project files and PDFs rely on the protection your Windows account and device provide.
2. This website
The website has no contact forms, no application analytics and loads no third-party scripts, fonts or images. The interactive example runs in your browser on prepared synthetic data; anything you type into it stays in the tab and is discarded when you leave. The front page, guide and policy pages set no cookies.
The website is hosted by Vercel. Like any hosting provider, Vercel may keep ordinary server request logs, which can include your IP address, the page requested and browser details, under Vercel's privacy policy. We do not add logging of our own to those pages.
3. Billing and the subscription
Checkout, invoices, card details and the customer portal are handled by Stripe on Stripe's own pages. Stripe collects the name, email address, billing address and payment details you enter there under Stripe's privacy policy. Your full card number never reaches us.
Our billing service keeps, in a hosted database:
- Stripe customer, subscription and checkout identifiers; subscription status, paid-term dates and cancellation flags.
- The identifiers of Stripe events we have processed, so that each is applied once.
- Hashed forms of your browser billing session, your licence key, your billing recovery code and your installation identifier. We store the hashes, not the codes.
- When a lost-installation reset was last used.
- Hashed, keyed rate-limit counters derived from network addresses, in hourly buckets. Buckets older than 48 hours are discarded during later requests.
When you start checkout or restore access, the billing page sets one essential cookie that identifies your billing session in that browser for 30 days. It is Secure and HttpOnly, is not used for tracking, and stops working when you restore access with your recovery code from another browser.
The billing service does not receive PDFs, file names, review notes or reviewer names, and it does not use your email address as a credential. Email-based account recovery is not offered.
4. Receipts, support and email
Stripe sends payment receipts and refund confirmations for live purchases to the email address you give at checkout, with replies directed to support@pdfcarry.com. We do not send newsletters or marketing email.
When you email support, we receive whatever you choose to send, including any diagnostics file or document you attach, and keep the correspondence for as long as it is needed to handle the matter and any follow-up. Please do not send confidential customer documents unless we have agreed to receive them. The support mailbox is provided by Namecheap Private Email under Namecheap's privacy policy.
5. Where information is processed
We are an Australian company. The website and billing service are hosted by Vercel, billing records are stored with Neon in its US East region, payments are processed by Stripe, and support email is handled by Namecheap Private Email. These providers may process information outside Australia, including in the United States, under their own policies: Vercel, Neon, Stripe and Namecheap. Your documents are not among the information the application or the billing service sends to any of them.
6. How long we keep it
- Financial records
- Records of payments, invoices, refunds and disputes are kept for at least seven years after the relevant transactions are complete, as Australian company record-keeping rules require. This applies even if you ask us to delete other information.
- Entitlement records
- Subscription status, hashed credentials and installation bindings are kept for as long as they are needed to run the subscription, honour refunds and cancellations, prevent misuse and handle support.
- Support correspondence
- Kept for as long as needed to handle the matter and any follow-up, and to meet legal obligations.
- Rate-limit counters
- Hourly buckets. Once a bucket is older than 48 hours it is removed during a later request, so removal is not instant.
- Hosting logs
- Held by the providers on their own schedules.
Apart from that rate-limit cleanup, nothing is deleted automatically: subscription, entitlement and support records stay until a person reviews them. Deletion requests are reviewed by a person, and we will tell you what we removed and what we must keep and why.
7. How it is protected
All traffic to the website and billing service uses HTTPS. Credentials are stored as hashes. The licence key and trial state on your computer are protected with Windows Data Protection. Card details are handled only by Stripe. Access to the billing database and to Stripe is limited to the people who run PDFCarry.
8. Your requests and complaints
You can ask us what information we hold about you, ask us to correct it, ask us to delete it, or make a complaint about how we have handled it. Write to support@pdfcarry.com. We may need to confirm that you are the person the information relates to, for example by matching a Stripe receipt, before we act.
If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). Nothing in this notice limits rights you have under privacy law where you live.
9. Changes to this notice
If the website, the billing service or the application starts processing anything beyond what is described here, this notice is updated first and the date at the top changes.