Transparency & Privacy by Design

Comprehensive Privacy Policy

Last Updated: September 2026. Binding commitment to zero data retention, client-side processing, and GDPR/CCPA compliance.

Core Principle: At PDFListo (accessible at https://pdflisto.org), user privacy is not an afterthought or marketing slogan—it is a structural engineering guarantee. We design our software so that your documents never leave your local hardware. Because we never upload, transmit, or store your private files on remote servers, we eliminate data breaches and unauthorized inspections at their root.

1. Data Controller Identification

In compliance with the European Union General Data Protection Regulation (EU GDPR 2016/679), the California Consumer Privacy Act (CCPA), and international privacy conventions, the data controller for this website is:

Project Author & Controller: Darío Torralbo
Official Website: https://pdflisto.org
Official Support Email: soporte@pdflisto.org
Purpose: Providing free, client-side in-browser PDF manipulation and compression utilities under the Local-First architectural paradigm.

2. Zero Document Collection & Client-Side Sandboxing

Unlike legacy cloud converters that stream your files across public networks to remote servers for processing, PDFListo operates entirely inside your local device:

Zero Network Egress: Your PDF documents, images, and text contents are never transmitted across the internet to our servers or third-party cloud buckets.
Volatile Local Memory Execution: All document parsing, vector recombination, and compression execute inside your browser's WebAssembly and JavaScript V8 engine.
No Server-Side File Storage: No temporary staging files or databases exist on our infrastructure. When you close the browser tab, all memory buffers are instantly purged by native garbage collection.
Complete Breach Immunity: Because we never possess or see your files, your financial ledgers, legal contracts, medical charts, and identity credentials can never be leaked from our systems.

3. Server Logs & Technical Navigation Data

When accessing our website, web hosting infrastructure servers (Hostinger) automatically collect standard HTTP connection logs. These entries do not identify individual users and are used solely for network security, DDoS mitigation, and uptime assurance:

Anonymized public IP addresses.
Browser type, engine version, and operating system profile (User-Agent string).
Exact timestamp and HTTP response status codes.
Referring URL and requested static assets (CSS, JS, WebAssembly binaries).

4. Programmatic Advertising & Google AdSense

To provide completely free and unlimited access to all tools without subscription walls, PDFListo partners with Google AdSense (operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Please note the following regarding programmatic advertising:

Advertising Cookies & DoubleClick: Google uses cookies to serve ads based on your prior visits to this website or other destinations across the web.
Third-Party Vendors: Third-party certified advertising networks may place and read cookies or web beacons to measure campaign relevance and performance.
Managing Ad Personalization: You can opt out of personalized advertising at any time by visiting Google Ads Settings. You may also opt out of third-party tracking via aboutads.info or the European Interactive Digital Advertising Alliance.

5. Legal Bases for Processing (GDPR Compliance)

Any minimal technical data processing adheres to the lawful grounds defined under Article 6 of the EU GDPR:

Legitimate Interests (Art. 6.1.f GDPR): Maintaining robust server defense mechanisms, error tracking, and infrastructure uptime.
User Consent (Art. 6.1.a GDPR): Serving personalized advertising or analytics cookies, which users may grant, adjust, or withdraw at any time via cookie consent settings.

6. Your Data Protection Rights

Under international privacy regulations, you are entitled to exercise your fundamental data rights:

Right to Access: Inquire about what technical data is processed.
Right to Rectification: Request correction of inaccurate information.
Right to Erasure ('Right to be Forgotten'): Request immediate purging of any logged communications.
Right to Restrict or Object: Limit the processing of analytical data.
Right to Data Portability: Receive your data in a portable, structured format.

To exercise these rights, please contact our privacy desk at soporte@pdflisto.org. We respond to all verified inquiries within 30 business days.

7. Children's Privacy Protection (COPPA Compliance)

PDFListo does not knowingly harvest personal identifiable data from children under the age of 13 (or under 16 in the EEA). As our utilities require no user registration, the platform is safe for educational use. If you believe a minor has submitted personal info through our support channels, contact us for prompt deletion.

8. Updates to this Privacy Policy

We reserve the right to revise this policy to reflect technological progress, new utility launches, or regulatory updates. Substantive updates will be published here with an updated revision date.

Have questions regarding our client-side privacy architecture?

Contact Our Engineering Team →

4. Technical Architecture: Zero Ingestion & RAM Deallocation

Our core privacy promise is anchored in software architecture rather than legal disclaimers. Because PDFListo compiles all PDF manipulation routines into local WebAssembly binaries executed within the browser's sandbox, file payloads never touch an outbound network interface. When you process a document, the binary byte arrays reside strictly in volatile client memory.

Forensic Security Audit Highlights

Zero Server Logging: No server-side access logs recording file names, byte sizes, or PDF page counts.
Automatic Garbage Collection: Browsers purge memory allocations upon document download or tab closure.
No Third-Party Analytics: No tracking SDKs injecting covert session recording or keylogging scripts.

5. California Consumer Privacy Act (CCPA / CPRA) Rights

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents are entitled to specific disclosures regarding the collection, sale, and sharing of personal data. PDFListo does not sell, trade, or rent personal consumer information to data brokers, analytics providers, or marketing networks.

6. Data Protection Officer (DPO) & Regulatory Inquiries

In accordance with GDPR Article 37 and international data privacy statutes, PDFListo has designated a formal privacy desk responsible for overseeing regulatory inquiries, supervisory authority communications, and cryptographic audit verifications. For all matters relating to privacy, data protection principles, and third-party advertising transparency, you may submit formal communications to privacidad@pdflisto.org.

You possess the statutory right to lodge formal complaints with competent data protection supervisory authorities, including the Spanish Data Protection Agency (AEPD), the UK Information Commissioner's Office (ICO), or your domestic regulatory agency, if you believe that any aspect of our site operation fails to satisfy international privacy benchmarks.