Privacy

Tools that run in your browser

41 of our 47 tools do all of their work on your own device. When you use one, your browser downloads our code and runs it locally; the document is read, changed and saved without ever being sent to us. We could not see it if we wanted to.

This includes Protect PDF and Unlock PDF — the password you type never leaves your device either — and OCR PDF, which reads your scanned pages on your own computer.

Tools that use our server

Some conversions need software that cannot run in a browser. These are: Word to PDF, Excel to PDF, PowerPoint to PDF, HTML to PDF, PDF to Word and PDF to PowerPoint. Each of these pages says so before you start.

When you use one of them:

• Your file is sent over an encrypted connection to our conversion service, which runs on servers operated by Vercel in the United States.
• It is converted in a temporary folder that is deleted the moment the conversion finishes. We do not keep a copy of your file or of the result.
• Files larger than 4 MB are too big to send in one request, so they go through private storage (also Vercel, in the United States): your file is uploaded there, and the converted result is put there for your browser to download. Nobody can open either without a key from our server. The upload is deleted as soon as the conversion finishes, and the result as soon as your browser has downloaded it. Anything left behind — say you close the tab mid-way — is deleted automatically, usually within a day and at most about 25 hours later.
• For HTML to PDF, our server visits the web address you give it, the way a browser would. The website you convert sees a visit from us, not from you.

What we record

When a server conversion runs, our logs record the kind of conversion, the file sizes and how long it took. They never record the file's name, its contents or a web address you converted; if a conversion fails, any web address in the error is removed before it is logged.

If a page breaks in your browser, it sends us a short error report so we can fix it: what went wrong in our code, which page you were on, and your browser type. It never includes your file, its contents or its name.

Like any website, our hosting provider, Vercel, keeps standard request logs — IP address, time, and the page requested — for a limited period, to operate and protect the service. See Vercel's privacy policy.

Cookies and tracking

We do not use social-media scripts or advertising trackers of our own. The site's code, fonts, and the PDF and text-recognition engines all come from our own domain. So that signing in works, each page also loads the sign-in code of our provider, Clerk, which learns that the page was visited. When you sign up or sign in, Clerk may also run Cloudflare Turnstile, a check that tells people from automated sign-ups, which sees your IP address and browser details for that purpose.

We count visits with Vercel Web Analytics, which uses no cookies and does not identify you: it records the page, the site that linked to it, and your country and device type, and Vercel discards the visitor fingerprint within a day. Before a page address is counted we remove anything private from it, such as the code in a signing link. See how Vercel Web Analytics handles data.

On your first visit, your browser also keeps a note of where you came from: a campaign name if the link carried one, the site that linked here, or “direct”. It stays in your browser and is never sent anywhere unless you create an account, in which case it is saved with the account once, and counted with any plan you later buy, so we can tell which of our announcements and ads bring people who stay. We do not keep this note if you have opted out on Your privacy choices or your browser sends a Global Privacy Control signal, or if your device is set to a European time zone, where it would need your consent first. Clearing your browser's site data removes it.

Free pages show ads from Google AdSense. Google's ad code runs on those pages and uses cookies and similar technology to show and measure ads and, where the law allows and you have agreed, to personalise them. Visitors in the European Economic Area, the UK and Switzerland are asked for consent first. You can manage ad personalisation at adssettings.google.com. If you opt out on Your privacy choices, or your browser sends a Global Privacy Control signal, Google is asked for non-personalised ads only. You can also change your cookie and ad consent there. We never send your files to Google, but ad code is third-party code running on the page, so we cannot make the same guarantees about it that we make about our own. That is why the tools for the most private documents (bank statements, redaction, passwords, signatures, email and vehicle sales) show no ads at all, and people on a paid plan see no ads anywhere: no ad code loads for them.

We store whether you chose light or dark mode in your browser, so the site remembers it. If you sign in, our sign-in provider sets cookies that keep you signed in.

Accounts

You never need an account to use the tools. A free account raises your daily allowance of server conversions, and is needed for a paid plan. If you create one, our sign-in provider, Clerk, stores your email address — and, if you sign in with Google, your name and profile picture. We use these only to sign you in and to link your plan to you. You can delete your account at any time from the account menu; doing so also deletes your cloud drafts, your saved signatures and the documents you sent for signature. Emails we send you ourselves — an invitation to create an account, or a document sent for signature — go through Resend, which handles the delivery and keeps the address and delivery record for that purpose only.

Usage limits

Server conversions are limited per day, so we count them in our database (Upstash, in the United States): under your account if you are signed in, or otherwise under a keyed hash of your IP address that changes every day. The raw address is never stored, the hash cannot be turned back into it, and each count expires after a day.

Cloud drafts

The PDF editor works entirely in your browser, with one exception you choose: signed-in users can press Save to cloud to keep a draft under their account and carry on from another device (a free account keeps 2, paid plans more). The first time, the editor asks for your agreement before anything is sent. The document and your edits are then stored in our private storage, readable only by you while signed in, until you delete the draft from the editor's start page or it goes 90 days without a change. We never open, read or process cloud drafts ourselves.

Saved signatures

When you draw or type a signature in the editor while signed in, you can choose to remember it on your account, so you can place it again without redrawing. It is kept as a small picture in our database, readable only by you, until you remove it from the signature window or delete your account.

Documents sent for signature (Signzuma)

When you send a document for signature, we store the document and the details needed to have it signed: each signer's name and email address, the fields you placed, and your message. We email each signer a personal link through Resend, and up to three reminders if they have not signed, unless the sender turned reminders off. If the sender saves a document as a template, we keep a copy of it with its fields (not the signers) until they delete it.

When a signer opens or signs, we record the time, their IP address and their browser, and keep the signature they draw or type and anything they fill in. That record is the audit trail printed on the signature certificate at the end of the signed document; it is what makes an electronic signature hold up, together with the version of the electronic-records disclosure they agreed to. Signers do not need an account.

When the last person signs, we keep the signed document's fingerprint (SHA-256) so that anyone holding a copy can check it at /sign/verify. That page works out the fingerprint in the visitor's browser and sends us only that; a match shows the document's title, reference, completion time and the names of its signers, which the person checking already has in the file. The fingerprint stays after the files are deleted, so a copy can still be checked.

Documents and signatures are kept in our private storage (Vercel, in the United States) and the records in our database (Upstash, in the United States). Nobody can open them without a key from our server, and we never open or read them ourselves. A signing link works for 60 days, and the link sent with the finished document for 90 days. The sender's copy stays until the sender deletes the document or their account. If you signed a document and want your details removed, write to us and we will pass the request to the sender, who decides together with us, because the signed record may be one they are entitled or required to keep.

Signzuma for Dealers

A dealership on the Dealer plan gives us its business details (name, dealer license number, address and phone) for its attestation letters, and the names and email addresses of the staff it adds. For its documents we also keep how each signer proved who they are: for an in-person check, the kind of ID, who issued it and its last four characters, and which member of staff checked it (never a picture or the full number); for an access code, only a one-way fingerprint of the code; for a text code, the signer's mobile number, to which we send the code through Twilio. These details are printed on the signature certificate, because they are what the dealership relies on, and are kept with the document.

Payments

Paid plans and day passes are billed by Stripe. Your card details go straight to Stripe and never reach us; we keep only a reference to your Stripe customer record and your plan's status and renewal date. See Stripe's privacy policy.

Who holds data for us

These companies process information on our behalf, each only for the purpose named:

• Vercel: hosting, temporary file storage, document storage and visit counts (United States).
• Clerk: accounts and sign-in (United States), using Cloudflare Turnstile to stop automated sign-ups.
• Google: signing in with Google, if you choose it.
• Upstash: our database of plans, usage counts, drafts and signature records (United States).
• Stripe: payments (United States).
• Resend: the emails we send (United States).
• Twilio: identity codes texted to signers of dealer documents (United States).
• Google: ads on free pages (AdSense).
• The US National Highway Traffic Safety Administration (NHTSA): when you look up a vehicle on the bill of sale, our server sends the VIN, and nothing else, to NHTSA's public decoder to fill in the year, make and model.

We never sell your information for money. On free pages, Google's ad code may use cookies to personalise ads, which some US state laws call "selling" or "sharing" personal information. You can opt out of that on Your privacy choices, and we treat a Global Privacy Control signal as an opt-out. Otherwise we share information only with the providers above, to run the service, or when the law requires it.

Your choices and rights

You can see and change your account details from the account page, and delete your account and everything stored with it from the account menu. To ask for a copy of what we hold about you, a correction, or a deletion we have not already made possible, write to hello@filezuma.com. We answer within 30 days. If you live in the European Economic Area, the UK, or a US state with its own privacy law, you have these rights by law, and you can also complain to your local data protection authority. Someone you have authorised can make a request for you; we may ask them to show that authorisation. We will not treat you differently for using any of these rights.

If you are in the European Economic Area or the UK: we process your information to provide the service you asked for (the tools, your account, your plan), to meet legal duties such as keeping payment records, and for our legitimate interest in keeping the service secure and understanding which announcements bring people; ads and the first-visit note rely on your consent where the law requires it, and you can withdraw it on Your privacy choices. You can also object to processing based on legitimate interest, and ask for your account data in a portable form. Our providers are in the United States; where the law requires it, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. For documents sent through Signzuma, the sender decides what is sent and why, and we process those documents on the sender's behalf.

Children

Filezuma is not meant for children under 13, and we do not knowingly collect information from them. Paid plans are for adults. If you believe a child has created an account, tell us and we will delete it.

Emailing us

If you write to hello@filezuma.com, we receive your email address and your message, and use them only to reply.

Who we are

Filezuma is operated by BUCKZERO LLC, which is responsible for how the service handles your information. Contact us at hello@filezuma.com.

Changes

If how we handle files changes, this page changes with it, and the date at the top will say when.