What Online PDF Tools Say They Do With Your File: We Read 12 Policies

On 6 October 2026 we read the published pages of 12 online PDF tools. All 12 describe an upload: your file goes to servers run by the company or its host. None says the online tool works inside your browser. Nine give a deletion time, from 90 seconds to two weeks, and three offer a data processing agreement. We report what the pages say. We did not test or audit what the tools do.

How did we choose and read the tools?

We chose well-known tools that people use in English, French and German, and whose own pages we could open. We dropped tools whose pages said nothing readable about uploaded files. Ten of the twelve are mainly PDF tools. CloudConvert and TinyWow are general file toolkits that also handle PDFs.

For each tool we recorded five things, using only its own pages:

• Where your file is processed, as the page states it.
• When uploaded files are deleted, with the exact figure.
• Where the servers are.
• Whether a data processing agreement (DPA) is offered. A DPA is the contract the GDPR asks for when a company handles personal data for you.
• Whether files are used to train or improve models.

A cell says “Not stated” when the pages we read are silent. That tells you nothing either way. We read every page on 6 October 2026 and kept a short quote for every filled cell. We read the pages in English. PDF24’s English page is a machine translation, so we also read its German page, which is the binding version. Policies change, so open the current page before you rely on a row.

What do the 12 tools say about your file?

Some rules change when you sign in, save or share a file. Smallpdf, Adobe, Foxit and Sejda say so, and TinyWow restarts its one-hour clock each time you reuse a file. iLovePDF leaves its signing service out of the two-hour rule.

What patterns does the table show?

• Deletion. Nine pages give a figure, from 90 seconds (Online2PDF, for converted files) to two weeks (Smallpdf, on its DPA page). Sejda, PDF2Go and Adobe give none.
• Location. Five name Europe or Germany as the main location: PDF24, PDF2Go, Smallpdf, iLovePDF and CloudConvert. Three list several regions, TinyWow names only the United States, and three name no location for uploaded files.
• DPA. Three offer one: Smallpdf (for its Team and Business plans), iLovePDF and PDF2Go. The pages we read for the other nine do not offer one.
• Training. Five say files or chats are not used to train models, each with its own scope: iLovePDF, Sejda, PDF2Go, Smallpdf and Foxit. PDF24 and CloudConvert say they do not look at or mine your files. Adobe says it may analyze cloud content, including with machine learning, to improve its services, with opt-out rights. Four say nothing.
• Browser. None says its online tool processes the file in your browser. Two say their desktop software works on your own device. Adobe: “on your local device rather than an external server”. PDF Candy: “All processing happens locally on your PC”.

What can a privacy policy not tell you?

A policy is a promise, not proof. It cannot show that a server deletes your file on time, and we tested none of these claims. Online2PDF’s own page says: “a conversion of highly sensitive and critical files is not recommended.”

You can check one thing yourself: whether a file leaves your computer. Chrome’s developer tools list every request a page sends. These steps use Chrome.

1. Open the tool’s page. Press Ctrl+Shift+J, or Cmd+Option+J on a Mac, to open the developer tools.
2. Click the Network tab. Right-click the table header and select Method. Each row of the Network Log is one resource the page asks for.
3. Add a dummy PDF that holds nothing private. Never test with a real document.
4. Look for a new row whose Method is POST or PUT. Hover over its Name cell to see the full address. Open its Payload tab to see what was sent.
5. Check again when you click the button that starts the work.

What does the GDPR say about uploading a document?

When a company uploads a document with personal data to an online tool, the tool’s maker may act as a processor. Article 28 of the GDPR covers processing “on behalf of a controller”. It says the controller may use only processors with sufficient guarantees, and that the processing is governed by a contract or other legal act. That contract is the DPA.

Whether a tool counts as a processor depends on the facts. The guidelines of the European Data Protection Board on controllers and processors explain how to decide. A server outside the EU adds a second rule. Article 44 says a transfer of personal data to a third country may take place only if the conditions of that chapter are met. Our article on sending documents outside the EU covers that side.

What should you check before you upload a confidential document?

1. Ask whether the file needs to leave your computer at all.
2. Mask names, numbers and addresses before any upload, with a tool that works on your own device.
3. If you must upload, read the tool’s page. Note the deletion time, the server location and whether a DPA exists. Check the date.
4. For work files with personal data, put the DPA in place before you upload.
5. Use the tool’s delete button when it has one. Keep your original.

ONYRI Sanitize takes a different route. A PDF, .docx file or scan is analyzed and masked inside your browser and never uploaded. The server only receives counters: document kind, pages and number of masks. Its limit: it only anonymizes, never merges or compresses, and returns a Word file as a PDF. You rely on the code the site sends to your browser. The Network tab shows what it sends out.

This table is a snapshot from 6 October 2026. Before you rely on a row, open the tool’s page and check its date.

Frequently asked questions

Sources & references