Privacy Policy

Converterrr (“we”, “us”) runs converterrr.com, a file converter and conversion API. This policy explains what personal data we collect, why, how long we keep it and the choices you have. It applies to the website, the web app, the API and emails we send.

For the purposes of data-protection laws such as the GDPR, Converterrr is the controller of the personal data described here. For files you convert in the cloud on behalf of your own customers through the API, we act as your processor and handle those files only on your instructions.

Browser conversions

When a conversion runs in your browser, which is the default for most formats, your file is read and converted on your own device. The file and the result are never uploaded to us. We only record that a conversion happened (a counter), so we can apply fair-use limits.

Cloud conversions and the API

When you choose a cloud conversion or use the API:

• Your file is uploaded over HTTPS to temporary storage (Vercel Blob).
• It is converted inside an isolated, single-use sandbox that has no access to other customers' files and is destroyed when the job ends.
• The result is stored temporarily for you to download and then deleted automatically: after about 1 hour on the free plan, or after 24 hours to 7 days on paid plans. Source files are deleted at the same time, or within about 1 hour if a job fails or is cancelled.
• We don't open, read, analyze or use your files for any other purpose, including training machine-learning models, and we never sell or share them.

The Security page explains the architecture in more detail.

Account information

• Your name, email address and whether you have verified it.
• A securely hashed password, if you sign up with email. We never store your password in plain text.
• If you sign in with Google: your Google account ID, name, email address and profile photo, as shared by Google.
• Your preferences, such as email notifications and a default webhook URL.

Conversion and usage records

• For cloud jobs: file name, input and output formats, file sizes, status, error messages, credits used, timestamps and whether the job came from the web app or the API.
• For API keys: the key's name, its first few characters, when it was created and last used, and request counts. We store only a hash of the full key.
• Credit balances and credit transactions.

Abuse prevention and security

• Daily usage counters tied to your account or, if you aren't signed in, to a random identifier stored in a signed cookie on your browser.
• A one-way, keyed hash of your IP address, used to stop people from bypassing free limits by switching browsers or creating many accounts. We don't store your raw IP address for this purpose.
• For signed-in sessions: the IP address and browser user agent associated with each session, so you and we can spot suspicious sign-ins, plus short-lived rate-limit records.

Payments

Payments are handled by Stripe. We receive a customer ID, subscription status, the plan you chose and limited billing details such as your country for tax purposes. We never see or store your full card number.

Communications

If you email us, we keep the conversation so we can help you and improve the Service.

We don't use advertising cookies or cross-site tracking, and we don't buy data about you from third parties.

• To provide the Service, including running conversions, showing your history, sending files and notifications you asked for, and processing payments. Legal basis: performance of our contract with you.
• To keep the Service secure and fair, for example by enforcing limits, preventing fraud and abuse, and debugging. Legal basis: our legitimate interest in protecting the Service and its users.
• To communicate with you about your account, security, changes to the Service and these policies. Legal basis: contract and legitimate interests.
• Product updates, only if you opt in. You can unsubscribe from any marketing email in one click. Legal basis: consent.
• To comply with the law, such as tax record-keeping and responding to lawful requests. Legal basis: legal obligation.

We don't make decisions about you based solely on automated processing that produce legal or similar effects.

We don't sell or rent your personal data, and we don't “share” it for cross-context behavioral advertising. We use a small number of service providers (subprocessors) who process data on our behalf under contracts that require them to protect it and use it only to provide their service:

We may also disclose information if required by law or a valid legal process, to protect the rights, safety or property of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your data.

Converterrr is based in the United States, and our providers process data primarily in the United States. If you are outside the US, your data will be transferred there. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Cloud-converted files: about 1 hour (free) or 24 hours to 7 days (paid), then deleted automatically.
• Account data and job history: for as long as your account is open. When you delete your account, we delete your profile, sessions, API keys, preferences and job history within 30 days, except where we must keep records for legal reasons.
• Records of signed-out conversions: up to 30 days, for abuse prevention.
• Daily usage counters (including hashed IP addresses): 14 days.
• Sessions: up to 30 days of inactivity, or until you sign out.
• Payment and tax records: as long as the law requires, typically up to 7 years.
• Backups: deleted data may persist in encrypted backups for up to 30 days before it is overwritten.

Wherever you live, you can:

• Access and correct your account information in Settings.
• Delete your account yourself from Settings at any time.
• Get a copy of your personal data, or ask us to delete or correct something you can't change yourself, by emailing support@converterrr.com.
• Turn off email notifications in Settings. We will still send essential account and security emails.

Depending on where you live, for example in the EU, UK, California or other US states with privacy laws, you may also have the right to object to or restrict certain processing, to data portability, to withdraw consent, and to not be discriminated against for exercising your rights. We honor these rights for all users. We will verify your request using the email address on your account and respond within the time the law requires, usually 30 days. If we decline a request, you can appeal by replying to our decision. You also have the right to complain to your local data-protection authority.

You can make a request through an authorized agent. We may ask the agent for proof of authorization and verify your identity directly.

We use a handful of strictly necessary cookies to keep you signed in, protect sign-in flows and apply fair-use limits, plus local storage to remember your theme. We don't use advertising or third-party analytics cookies. The Cookie Policy lists each one.

We protect data with encryption in transit (HTTPS/TLS everywhere), encryption at rest at our storage providers, isolated conversion sandboxes, hashed passwords and API keys, least-privilege access and automatic deletion. No system is perfectly secure, but we work hard to keep yours safe. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires. See the Security page for details and how to report a vulnerability.

Converterrr isn't directed at children under 16, and we don't knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy when our practices change. For material changes, we will notify you by email or in the app before they take effect. The date at the top shows the latest version.

For privacy questions or requests, email legal@converterrr.com. For help with your account, email support@converterrr.com.