This Privacy Policy is incorporated by reference into our Terms of Use. Enterprise and B2B customers whose use of the Service involves processing personal data on behalf of their own customers or employees are also subject to our Data Processing Addendum (“DPA”), which governs our respective obligations as processor and controller in that context. Where the parties have executed a SaaS Agreement, that agreement and its Order Forms govern the commercial relationship and take precedence over these general policies in the event of any conflict.
Scope
This Privacy Policy applies to all information collected through the Service, including through pdffillr.ai and any related web or mobile applications; in email, text, or other electronic communications between you and us; through connected third-party integrations you authorize; and when you interact with our advertising or applications on third-party platforms that link to this Privacy Policy.
This Privacy Policy does not apply to information collected offline or through means not described above, or to third-party websites, services, or applications that may be linked from the Service.
Definitions
The following terms are used throughout this Privacy Policy:
Engineersmind Corp, the legal entity operating and maintaining the Service.
The PDFFillr web-based application and all related features, pages, applications, and infrastructure operated by the Company.
Any individual who creates an account or otherwise accesses or uses the Service.
Information provided during account registration, authentication, and account management, such as name, email address, and login credentials.
Any documents, files, data, or information uploaded, submitted, or generated by a User through the Service.
Any information relating to an identified or identifiable User collected or processed in connection with the Service.
Any operation performed on Personal Data or User Content, including collection, storage, use, modification, and deletion.
External services or providers integrated into the Service for authentication, hosting, analytics, AI processing, or security.
Any confirmed unauthorized access, disclosure, alteration, or destruction of Personal Data or User Content.
Third-party accounts (such as Google Drive, Dropbox, and Microsoft OneDrive) voluntarily connected by a User. Access is initiated and controlled by the User and may be revoked at any time.
Data Controller and Processor Roles
For Users accessing the Service directly, the Company acts as a Data Controller and processes Personal Data as described in this Privacy Policy.
For enterprise and B2B customers who submit Personal Data belonging to their own customers, clients, or employees through the Service, the Customer is the Data Controller and the Company acts as a Data Processor, processing that Personal Data solely for the purpose of providing the Service and in accordance with the Customer's instructions and the DPA. If your Personal Data was provided to the Company by or on behalf of an enterprise customer, you should direct any privacy-related requests to that customer in the first instance.
Contact: Support@pdffillr.ai
Information We Collect
4.1 Account Information
4.2 User Content and Documents
4.3 Usage and Technical Data
4.4 Integration and Authorization Data
4.5 Data Minimization
4.6 Sources of Personal Data
Cloud Storage Integrations
The Service enables Users to import documents from third-party cloud storage providers via file link. Access is initiated exclusively by the User and is limited to the specific document explicitly referenced.
Google Drive
Dropbox
Microsoft OneDrive
How We Use Your Information
We use Personal Data to:
- Analyze documents and populate forms using AI processing;
- Deliver core Service functionality;
- Maintain security, prevent misuse, and monitor system performance;
- Provide support, troubleshooting, and quality assurance;
- Communicate with you regarding your account and the Service;
- Send marketing communications where permitted by law and subject to your opt-out rights;
- Comply with legal obligations and respond to lawful requests;
- Detect, prevent, and address fraud, security issues, or technical problems.
AI Processing and Human Review
The Service uses automated systems, including large language models, to process User Content and generate outputs. Documents and inputs may also be reviewed by authorized Company personnel for support, quality assurance, or security purposes. All such access is subject to role-based access controls and confidentiality obligations.
User Content is not used to train AI models. AI-generated outputs may be inaccurate and should be reviewed by Users prior to any reliance. For more detail on our AI practices, please refer to the Terms of Use.
Legal Bases for Processing (GDPR)
If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your Personal Data based on one or more of the following legal grounds: contractual necessity, to provide the Service you have requested; legitimate interests, such as improving the Service and preventing fraud; your consent, for marketing or optional data collection; and compliance with legal obligations. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
Data Storage, Retention, and Deletion
User data is stored on secure cloud infrastructure operated by the Company. Documents saved by the User are retained for the duration of the active account unless deleted. Operational data such as system logs is retained for limited periods as necessary for functionality, security monitoring, and troubleshooting.
Users may delete their data at any time through the Service. Upon deletion, data is removed from active systems within thirty (30) days and may persist for up to ninety (90) days in encrypted backups. Backup data is not actively accessed and is overwritten in the ordinary course of backup rotation.
Upon termination of a User's account or an enterprise SaaS Agreement, Personal Data and User Content will be made available for retrieval for thirty (30) days following termination, after which it will be deleted from active systems. In determining appropriate retention periods, we consider the nature and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, and applicable legal requirements.
Security Measures
The Company implements appropriate administrative, technical, and organizational measures to protect Personal Data and User Content, including:
- Encryption in transit using TLS and at rest using AES-256 or equivalent;
- Role-based access controls with least-privilege principles;
- Multi-factor authentication for personnel accessing production systems;
- Security logging, monitoring, and alerting;
- Incident response procedures with defined escalation and notification timelines.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
Data Breach Notification
In the event of a Security Incident affecting your Personal Data, we will notify affected Users and, where applicable, the relevant supervisory authority, in accordance with applicable law. For enterprise customers, breach notification obligations are governed by the DPA, which requires notification within seventy-two (72) hours of the Company becoming aware of a confirmed Security Incident.
Notifications will include, to the extent then known, a description of the nature of the incident, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the incident.
Notifications will be sent to the email address associated with your account. Ensure your account email is kept current to receive timely notifications.
Sensitive Personal Data
We process sensitive Personal Data, including health information, financial account data, and government-issued identification numbers, only as necessary to provide the Service, comply with legal obligations, or for other purposes permitted by applicable law. We do not use or disclose sensitive Personal Data for purposes other than those permitted by law unless we obtain your consent where required.
The Service is not designed for the processing of Protected Health Information under HIPAA unless a separate Business Associate Agreement has been executed.
Processing on Behalf of Enterprise Customers
Where the Company processes Personal Data on behalf of an enterprise customer as a Data Processor, we do so in accordance with our contractual obligations and the instructions of the applicable customer as set forth in the Data Processing Addendum. Such processing is subject to the DPA, which governs the parties' rights and obligations with respect to that Personal Data.
No Financial Incentives
We do not offer financial incentives, price differences, or service differences in exchange for the retention, sale, or sharing of Personal Data.
Your Privacy Rights
Depending on your location, you may have the right to access your Personal Data; correct inaccurate information; request deletion of your Personal Data; restrict or object to processing; and request data portability. To protect your privacy and security, we may take reasonable steps to verify your identity before fulfilling a request.
To submit a request, contact us at Support@pdffillr.ai.
Transfer of Information Across Borders
Your information may be processed in the United States or other countries where we or our service providers operate. Where required by applicable law, we implement appropriate safeguards for cross-border transfers, including Standard Contractual Clauses (SCCs) or other legally recognized transfer mechanisms. Enterprise customers' cross-border transfer obligations are governed by the DPA.
California Resident Rights (CCPA/CPRA)
19.1 Right to Know
19.2 Right to Delete
19.3 Right to Correct
19.4 Right to Opt Out of Sharing
19.5 Exercising Your California Rights
19.6 No Discrimination
19.7 Shine the Light
Nevada Resident Rights
Nevada residents may opt out of the sale of certain Personal Data by contacting us at Support@pdffillr.ai with the subject line "Nevada Do Not Sell Request." We do not currently sell Personal Data as defined under Nevada Revised Statutes Chapter 603A.
European, United Kingdom, and Swiss Residents
If you are located in the European Union, United Kingdom, or Switzerland, you have the right to access, rectify, or erase your Personal Data; restrict or object to processing; request data portability; and, where processing is based on consent, withdraw that consent at any time. You also have the right to lodge a complaint with the supervisory authority in your country of residence.
We require only the information reasonably necessary to provide the Service and retain Personal Data only as long as necessary to fulfill the purposes described in this Privacy Policy or to comply with legal obligations. Enterprise customers' GDPR obligations are governed by the DPA.
Children's Privacy
The Service is not directed to children under the age of 13, and we do not knowingly collect Personal Data from children under 13. If we become aware that we have collected such data, we will take prompt steps to delete it. If you believe we may have inadvertently collected information from a child under 13, please contact us immediately at Support@pdffillr.ai.
Linked Websites
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.
How to Opt Out of Marketing Communications
You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at Support@pdffillr.ai. Opting out of marketing communications does not affect our ability to send transactional or account-related communications.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Updates will be posted with a revised "Last Updated" date. Your continued use of the Service after such posting constitutes your acceptance of the updated Privacy Policy.
Enforcement
If you believe the Company has not adhered to this Privacy Policy, please notify us at Support@pdffillr.ai and we will investigate and address the matter in accordance with applicable law.