1. Data Controller
The data controller for personal data collected through this website is PDFBlack. You can contact us at any time via email at contacto@pdf-black.com or through the contact form on the /contacto page.
2. Data We Collect and Legal Basis
2.1 Registration data (legal basis: explicit consent, Art. 6(1)(a) GDPR): When creating an optional account, we store your email address and a randomly generated password in your browser local storage (LocalStorage). This data is never transmitted to our servers. You can delete your account at any time by logging out.
2.2 Technical data (legal basis: legitimate interest, Art. 6(1)(f) GDPR): We do not collect IP addresses, browser fingerprints, or metadata from PDF files you process. We do not use web analytics services that track your activity. All PDF processing is 100% local in your browser and never leaves your device.
2.3 Cookies and local storage (legal basis: consent, Art. 6(1)(a) GDPR): We exclusively use LocalStorage to store user preferences (language, theme) and session state. We do not use tracking, advertising, or third-party cookies. By accepting our cookie banner, you consent to the use of local storage for functional purposes.
3. PDF File Processing — Zero Transmission
PDFBlack performs all PDF manipulation, editing, conversion, compression, signing, OCR, and encryption operations exclusively within your web browser JavaScript engine (Google Chrome, Firefox, Safari, Edge, etc.) using Web Workers, WebAssembly (WASM), and the Web Crypto API. Your PDF files: (a) are not uploaded to any server; (b) are not stored in any external database; (c) are not accessible by any employee, contractor, or third party; (d) are automatically purged from RAM upon closing or reloading the browser tab. The sole exception is the digital signature service with PKCS#12 certificates, which requires server-side processing via node-forge. In this case, the file is processed ephemerally and not stored.
4. User Rights under GDPR
As a user, you have the following rights under GDPR: Right of access (Art. 15), Right to rectification (Art. 16), Right to erasure (Art. 17), Right to restriction of processing (Art. 18), Right to data portability (Art. 20), and Right to object (Art. 21). Since PDFBlack does not store personal data on servers (except your email in local browser LocalStorage), most of these rights are exercised automatically by logging out or clearing your browser local storage. For any formal request, write to contacto@pdf-black.com. We will respond within 30 calendar days.
5. Data Security — Technical and Organizational Measures
PDFBlack implements the following technical security measures:
- AES-256 encryption for PDF protection per ISO 32000-2:2020 (PDF 2.0).
- RAM-only processing with no disk persistence.
- Communications exclusively via HTTPS/TLS 1.3.
- HTTP security headers: Content-Security-Policy, X-Frame-Options, HSTS, X-Content-Type-Options.
- Process isolation via Web Workers (no access to main DOM).
- True binary redaction (physical removal from document code).
6. International Data Transfers
PDFBlack does not transfer personal data outside the user device, except for the digital signature service. PDF file processing occurs 100% in the user browser, regardless of geographic location. We do not use cloud providers for document processing.
7. CCPA/CPRA — California Privacy Rights
California residents have the right to: (a) know what personal information is collected; (b) request deletion of data; (c) opt out of data sales. PDFBlack does not sell, rent, or share personal information with third parties. As we do not collect personal identifiers (except email for optional registration), we automatically comply with these rights.
8. Changes to This Policy
We reserve the right to modify this privacy policy at any time. Changes will be effective immediately upon posting on this page. The last updated date is reflected at the beginning of this document. We recommend reviewing this page periodically.