Privacy Policy

Effective date: 01/08/2026
Last updated: October 13, 2026

CookPDF is operated by the CookPDF team ("CookPDF", "we", "us", or "our"). The CookPDF team is responsible, as controller, for the personal data described in this Privacy Policy. We respect your privacy. This Privacy Policy explains how we collect, use, process, disclose, and protect information when you use the CookPDF website, PDF tools, AI-powered features, accounts, subscriptions, and related services (collectively, the "Service").

By using CookPDF, you acknowledge the practices described in this Privacy Policy.

Privacy at a glance

• Your files. Many CookPDF tools work entirely in your browser, and your file is not uploaded to us. When a tool needs our servers, your file is used only to produce the result and is deleted shortly afterwards (see Section 5). We do not use your files to train AI models.

• AI tools. When you use an AI tool, the text of your document and your messages are sent to OpenAI to generate the answer. We do not store your AI conversations on our servers.

• Payments. Payments are handled by Airwallex, PayPal, or Paddle. We do not receive your full card number.

• Advertising. If you buy a subscription after clicking one of our Google ads, we tell Google about the purchase so we can measure our ads. You can opt out at any time (see Section 12).

• No sale of data. We do not sell your personal information for money.

• Your rights. You can ask us to access, correct, or delete your personal data by writing to [email protected].

1. Information We Collect

The information we collect depends on how you use CookPDF.

1.1 Account Information

When you create or use a CookPDF account, we may collect information such as:

• name or display name;

• email address;

• account identifier;

• authentication information;

• account settings;

• subscription status; and

• information associated with your use of the Service.

Passwords, where used, are stored using appropriate security protections and are not stored in plain text.

1.2 Files and Document Content

When you use CookPDF tools, you may provide files, documents, images, text, or other content for processing.

Depending on the feature, processing may occur:

• locally within your browser or device;

• on CookPDF-controlled infrastructure; or

• through third-party service providers necessary to provide the requested feature.

We process your files and document content for the purpose of providing the functionality you request.

We do not claim ownership of your files or document content.

1.3 AI Feature Data

When you use an AI-powered feature, we may process information necessary to perform your request, including:

• prompts;

• instructions;

• text;

• document content;

• extracted document information;

• AI-generated responses; and

• technical information associated with the AI request.

To perform your request, the content you submit to an AI feature (for example, text extracted from your document and your messages) is sent to our AI provider, OpenAI. We do not store your AI conversations on our servers.

The specific handling and retention of information by third-party AI providers may depend on the provider, service configuration, contractual arrangements, and applicable provider policies.

Users should avoid submitting unnecessary sensitive or confidential information to AI-powered features.

1.4 Payment and Subscription Information

If you purchase a paid subscription, payments may be processed by payment providers or a Merchant of Record, such as:

• PayPal;

• Airwallex;

• Paddle; or

• another payment provider displayed during checkout.

Depending on the payment method, these providers may collect information such as:

• name;

• billing address;

• payment method information;

• transaction information;

• country or region;

• tax-related information; and

• fraud-prevention information.

CookPDF generally does not receive or store complete payment card numbers when payment information is collected directly by the applicable payment provider.

We may receive limited payment-related information necessary to manage your subscription, such as:

• transaction identifier;

• subscription identifier;

• payment status;

• subscription status;

• plan;

• billing period;

• currency;

• amount paid;

• renewal status; and

• payment provider.

Where Paddle processes an order as Merchant of Record, Paddle independently processes payment, billing, tax, invoicing, refund, and related transaction information in accordance with its own privacy practices.

1.5 Usage and Technical Information

When you access CookPDF, we may automatically collect certain technical and usage information, such as:

• IP address;

• browser type and version;

• device type;

• operating system;

• language;

• referring page;

• pages or features used;

• timestamps;

• session information;

• error and diagnostic information;

• approximate geographic region derived from technical information; and

• other information necessary for security, analytics, and operation of the Service.

1.6 Cookies and Similar Technologies

CookPDF may use cookies, local storage, SDKs, pixels, and similar technologies for purposes such as:

• authentication;

• maintaining sessions;

• remembering preferences;

• security;

• fraud prevention;

• analytics;

• measuring the effectiveness of our advertising, including whether a purchase followed a click on one of our ads;

• measuring Service performance; and

• other functions described in our Cookie Policy.

Where required by applicable law, non-essential cookies will be used subject to your consent.

For more information, please see our Cookie Policy.

2. How We Use Information

We may use information collected through CookPDF to:

• provide requested PDF and document-processing functions;

• provide AI-powered features;

• create and manage user accounts;

• authenticate users;

• manage subscriptions and access rights;

• process and verify payment status;

• provide customer support;

• respond to user requests;

• maintain and improve Service performance;

• measure the effectiveness of our advertising, including attributing subscription purchases to clicks on our ads (see “Advertising Partners” in Section 4);

• diagnose errors and technical problems;

• monitor reliability and availability;

• protect accounts and the Service;

• detect, investigate, and prevent fraud, abuse, and security incidents;

• enforce our Terms of Service;

• comply with applicable legal obligations; and

• communicate important information regarding accounts, subscriptions, security, or the Service.

Where required by law, we rely on an appropriate legal basis for processing personal data.

3. Legal Bases for Processing

Where laws such as the GDPR or UK GDPR apply, we may process personal data based on one or more of the following legal bases:

Contract

Processing may be necessary to provide the Service you request, manage your account, provide paid features, or perform our obligations under our Terms of Service.

Legitimate Interests

We may process information where necessary for legitimate interests such as:

• securing the Service;

• preventing fraud and abuse;

• maintaining reliability;

• troubleshooting;

• understanding Service performance; and

• improving CookPDF.

• measuring the performance of our advertising, outside the European Economic Area, the United Kingdom, and Switzerland, subject to your right to object as described in “Your Advertising Choices”.

We consider the impact on users' privacy when relying on legitimate interests.

Consent

Where required, we rely on your consent for certain activities, including certain cookies, analytics, advertising measurement, or marketing communications. In the European Economic Area, the United Kingdom, and Switzerland, we use advertising cookies and share purchase information with advertising partners only if you have accepted advertising in our cookie settings.

You may withdraw consent where applicable.

Legal Obligations

We may process information where necessary to comply with legal, regulatory, tax, accounting, security, or law-enforcement obligations.

4. How We Share Information

We do not sell your personal information for money.

We may disclose information to third parties where reasonably necessary to operate CookPDF or comply with applicable law.

These third parties may include:

Service Providers

We may use providers that support:

• cloud infrastructure;

• hosting;

• storage;

• authentication;

• email delivery;

• analytics;

• monitoring;

• customer support;

• security; and

• other technical operations.

  These providers may process information on our behalf as necessary to provide their services.
  
  The main service providers we currently use are:
  
  
  Vultr: server hosting for the Service, including files processed on our servers.

Cloudflare: network security and content delivery. All traffic to our website passes through Cloudflare, which also tells us your approximate country so we can apply the right privacy settings.

Google Firebase Authentication: sign-in (email link, one-time code, and sign-in with Google, Microsoft, or Apple). Receives your email address, name, and account identifier.

OpenAI: AI features. Receives the content you submit to an AI feature.

Airwallex, PayPal, and Paddle: payment processing. Receive your email address, name, account identifier, and plan and payment details.

Google Analytics: website analytics. Receives cookie identifiers, the pages and features you use, and, for purchases, your account identifier and purchase details.

Google Ads: advertising measurement, as described in "Advertising Partners" below.

Our email server: sends sign-in emails and "your file is ready" notifications. Processes your email address, sign-in links and codes, and the name of your file.

Telegram: internal technical alerts to our engineers. An alert may contain technical details such as an IP address, an account identifier, or a file name.

Polotno: image and icon search in the design editor. Receives your search terms from our server, not linked to you.

When you use our website, your browser also downloads fonts and open-source software libraries from Google Fonts, jsDelivr, unpkg, cdnjs (Cloudflare), OpenCV, and SheetJS, and images from Unsplash in the design editor. These providers receive your IP address and browser information when the files are downloaded.

AI Service Providers

When you use AI-powered features, relevant information may be transmitted to AI providers necessary to perform your request.

The information transmitted depends on the feature you use and the content you provide.

Payment Providers

Payment and transaction information may be processed by PayPal, Airwallex, Paddle, or other providers displayed during checkout.

These providers may process information under their own privacy policies and legal obligations.

Advertising Partners

We advertise CookPDF on Google Ads. To measure whether our ads lead to purchases, when you buy a subscription after clicking one of our ads we may share the following with Google:

• the ad click identifier created when you clicked the ad;

• limited information about that visit, such as browser type and the page you landed on;

• a transaction identifier, the purchase amount, the currency, and the time of the purchase;

• your advertising consent status; and

• where your choices and applicable law permit, your email address in a hashed (SHA-256) form. We never send your email address in readable form.

Google uses this information to match the purchase to the ad click and to report and improve the performance of our ads, under the Google Ads Data Processing Terms. We do not share your files, document content, or AI prompts with advertising partners.

Legal and Safety Disclosures

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law or valid legal process;

• respond to lawful requests from public authorities;

• investigate fraud or security incidents;

• protect the rights, safety, and security of CookPDF, our users, or others; or

• establish, exercise, or defend legal claims.

Business Transfers

If CookPDF or the business operating CookPDF is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

5. File Retention and Deletion

Our goal is to retain uploaded and generated files only for as long as reasonably necessary to provide the requested functionality, unless longer retention is necessary for a feature selected by the user, account functionality, security, dispute resolution, or legal obligations.

Different CookPDF features may have different processing and retention requirements.

Where a feature processes a file entirely within the user's browser or device, the file may not be uploaded to CookPDF servers.

Where server-side processing is required, files may be temporarily stored while processing is performed.

Specifically:

In-browser tools: your file stays on your device. To let you resume your work, your browser keeps an in-progress session for up to 24 hours and your most recent result for up to 7 days. These are stored only in your browser, and you can clear them at any time by clearing your browser's site data.

Server-side tools (for example editing, conversion, OCR, and compression): temporary files are deleted as soon as the result is produced. A file you are editing on our servers is held in memory and deleted after 10 minutes without activity.

Results held while you sign in or upgrade: if a result is held for you while you sign in or upgrade, the result file stays in your browser in encrypted form. Our servers keep the key to unlock it and a preview of the first page for up to 1 hour.

Backup systems, security logs, or technical infrastructure may retain limited information for an additional period where reasonably necessary for security, reliability, disaster recovery, or legal compliance.

6. Account and Transaction Data Retention

We retain account information for as long as reasonably necessary to provide and maintain your account.

If you close your account, we may retain limited information where necessary to:

• comply with legal, tax, accounting, or regulatory obligations;

• resolve disputes;

• prevent fraud or abuse;

• enforce agreements; or

• maintain security records.

Transaction and subscription records may be retained for periods required by applicable tax, accounting, payment, or other legal requirements.

To close your account and request deletion of your personal data, write to [email protected] from the email address linked to your account. We will respond within the time limits described in Section 10.

One-time sign-in codes expire after 15 minutes, and links to set a password expire after 1 hour.

7. AI Data Retention

We do not store the content of your AI conversations on our servers. The content you submit to an AI feature is sent to OpenAI only to generate the response.

OpenAI processes this content under its API data terms. Under those terms, OpenAI does not use API data to train its models by default and may retain it for up to 30 days to monitor for abuse, unless a longer period is required by law.

Please avoid submitting passwords or other sensitive information to AI features.

8. International Data Transfers

CookPDF may use service providers located in countries other than the country in which you live.

As a result, personal data may be processed or stored in other jurisdictions.

In particular, Google (Firebase Authentication, Google Analytics, Google Ads, and Google Tag Manager) and OpenAI process data in the United States; Paddle is based in the United Kingdom; and Cloudflare operates a global network.

When personal data of people in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that does not have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK and Swiss addenda where relevant) included in our agreements with these providers, or on the EU-U.S. Data Privacy Framework where a provider is certified under it. You can request more information about these safeguards at [email protected].

9. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include, where appropriate:

• encrypted communications;

• access controls;

• authentication mechanisms;

• infrastructure security;

• monitoring;

• restricted access to production systems; and

• security and operational procedures.

However, no online service, storage system, or method of transmission can guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for protecting access to your devices.

10. Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal data.

These rights may include the right to:

• request access to personal data;

• request correction of inaccurate data;

• request deletion of personal data;

• request restriction of certain processing;

• object to certain processing;

• request data portability;

• withdraw consent where processing is based on consent; and

• lodge a complaint with an applicable data protection authority.

These rights are subject to applicable law and may not apply in every circumstance.

To submit a privacy request, contact us at [email protected].

We may need to verify your identity before processing certain requests.
We respond to requests within one month if you are in the European Economic Area, the United Kingdom, or Switzerland. We may extend this by up to two further months for complex requests, and we will tell you if we do. We respond within 45 days if you are a U.S. resident, extendable once by 45 days where permitted by law. If we cannot fulfil your request, we will explain why and tell you how you can appeal or complain.

11. California and Other U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws.

Depending on the law that applies, these may include rights to:

• know or access certain personal information;

• correct inaccurate personal information;

• delete certain personal information;

• obtain a portable copy of certain information;

• opt out of certain forms of targeted advertising;

• opt out of the sale or sharing of personal information where legally applicable; and

• appeal certain decisions regarding privacy requests.

CookPDF does not sell personal information for monetary consideration. We use Google Ads to measure whether our ads lead to purchases, as described in “Advertising Partners” in Section 4. Under some state privacy laws, this may be considered “sharing” personal information or “targeted advertising”. You can opt out with the “Do Not Sell or Share My Personal Information” link at the bottom of each page, and we treat a Global Privacy Control (GPC) signal as a valid opt-out request. We do not knowingly sell or share the personal information of consumers under 16 years of age.

In the past 12 months, we have collected the following categories of personal information:

Identifiers, such as your name, email address, account identifier, IP address, device identifier, cookie identifiers, and ad click identifiers. Collected from you and your device. Used to provide the Service, keep it secure, and for analytics and advertising measurement. Disclosed to our hosting, sign-in, payment, email, and analytics providers. Ad click identifiers, cookie identifiers, and, where allowed, your hashed email address are shared with Google Ads.

Commercial information, such as your plan, purchase history, and amounts paid. Collected from you and our payment providers. Used for billing, analytics, and advertising measurement. Disclosed to our payment providers and Google Analytics. Purchase amount and transaction identifier are shared with Google Ads.

Internet or other electronic network activity, such as pages visited, features used, and information about the visit that followed an ad click. Collected from your device. Used for analytics, security, and advertising measurement. Disclosed to Google Analytics and Cloudflare, and shared with Google Ads.

Approximate geolocation, namely your country, derived from your IP address. Used to apply the privacy rules for your region. Not shared for advertising.

Account login credentials, namely sign-in tokens. Used only to sign you in. Disclosed to Google Firebase Authentication. Not shared for advertising.

Content you submit, such as files and AI prompts. Used only to provide the feature you use. Disclosed to OpenAI when you use an AI feature. Not shared for advertising.

We do not use sensitive personal information for purposes that would give you the right to limit its use under California law.

12. Your Advertising Choices

How we use advertising technologies depends on where you are, which we determine from your approximate location:

• European Economic Area, United Kingdom, and Switzerland: advertising cookies and advertising measurement are off unless you accept them in the cookie banner. You can change your choice at any time with the “Manage cookie preferences” link at the bottom of each page.

• United States: you can opt out at any time with the “Do Not Sell or Share My Personal Information” link at the bottom of each page. We treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out.

• All other regions: advertising measurement is on by default. You can turn it off at any time with the “Ad preferences: opt out of ad tracking” link at the bottom of each page.

When you opt out, we stop using advertising cookies on your browser, and we do not send your email address, even in hashed form, to advertising partners for purchases you make afterward. Your choice is stored in a cookie on your browser, so you may need to set it again on another browser or device or after you clear your cookies.

You can also manage how Google personalizes ads for you at https://adssettings.google.com, and you can install the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. These settings are controlled by Google, not by CookPDF.

13. European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area, United Kingdom, or Switzerland, applicable data protection law may provide additional rights regarding your personal data.

Where applicable, you may contact us to exercise those rights using the contact information below.

You may also have the right to lodge a complaint with the data protection authority responsible for your country or region.

14. Children's Privacy

CookPDF is not intended for children who are below the minimum age at which they can lawfully consent to the processing of their personal data or enter into the relevant agreement under applicable law.

We do not knowingly collect personal information from children in violation of applicable law.

If you believe a child has provided personal information to CookPDF in violation of applicable law, please contact us so that we can review and take appropriate action.

15. Communications

We may send service-related communications necessary to operate your account or subscription, including:

• account notices;

• security alerts;

• payment or subscription information;

• important Service updates; and

• changes to our legal terms.

These operational communications are not necessarily marketing communications.

Where we send marketing communications, we will provide any opt-out mechanism required by applicable law.

16. Third-Party Links and Services

CookPDF may contain links to or integrate with third-party websites and services.

Their privacy practices are governed by their own privacy policies.

This Privacy Policy does not govern information independently collected or processed by third parties outside CookPDF's control.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• CookPDF features;

• data-processing practices;

• service providers;

• payment arrangements;

• security practices; or

• applicable legal requirements.

When we make material changes, we will provide notice where required by applicable law.

The current version will display the applicable “Last updated” date.

18. Contact Us

If you have questions about this Privacy Policy, how we handle personal data, or would like to exercise your applicable privacy rights, please contact us:

Service: CookPDF
Operated by: the CookPDF team
Privacy:[email protected]
Customer Support:[email protected]