Privacy Policy

KaagazPDF is designed on one simple principle: your documents belong to you. Every PDF and photo tool on this website runs entirely inside your own browser, which means the file you drop onto our page is opened, edited and saved on your device — it is never uploaded to any server we control. This policy explains, in plain language, exactly what information we do collect (for your account), how it is stored, who we share it with, and the rights you have over it.

1. Who we are

KaagazPDF ("we", "us", "our") is a free, browser-based document toolkit operated from India and made for Indian users. Our website is kaagazpdf.in. For any privacy question, comment or request under this policy, you can write to us at [email protected] or use our Contact page. We are the data controller for the account information we hold about you.

2. Our privacy promise — how document processing works

Unlike most "free online PDF" websites, KaagazPDF does not upload your files anywhere. When you drop a file onto a tool (for example "Compress PDF" or "Mask Aadhaar"), your web browser uses JavaScript and WebAssembly to open, transform and save that file entirely on your own device. Your file never travels over the internet to our servers, and it cannot be accessed by us, by our staff, or by anyone else.

You can verify this yourself: after the tool page has loaded, you can disconnect your device from the internet and the tools will continue to work. This is the technical proof that no upload is happening. In every browser we support, the working file lives only in the tab's in-memory sandbox and is automatically discarded when you close the tab or after an hour of inactivity — whichever is sooner.

Because your files never reach us, we cannot recover, resend or view a file for you. If a tool ever produces an unexpected result, please describe what happened in an email rather than attaching the document itself.

3. What information we actually collect

KaagazPDF collects only the small amount of information needed to run your account fairly. In detail:

We do not collect your date of birth, gender, physical address, phone number, government ID numbers, or the contents of any document you process. If a form on this site does not ask for a piece of information, we do not collect it.

4. Cookies and similar technology

A cookie is a small text file that a website places on your device. KaagazPDF uses three categories of cookies. For a full technical breakdown please read our separate Cookie Policy.

• Strictly necessary — session cookies that keep you logged in and remember whether you have accepted this policy. These cannot be turned off without breaking the site.
• Analytics — a lightweight, privacy-respecting analytics cookie that records anonymised page views. It does not track you across other websites.
• Advertising — Google AdSense may set cookies on Free-plan pages to show non-personalised or personalised ads (based on your consent). Pro subscribers see no ads and no ad cookies are set for them. You can adjust your Google ad settings at any time at myadcenter.google.com.

5. Third-party services we rely on

To run a modern web service safely, we use a small number of trusted third parties. We share the minimum information required for each of them to do their job:

• Supabase (database hosting, Mumbai/India region) — stores your account row: name, email, hashed password, plan, download counter.
• Razorpay (payment processing) — collects and stores your card, UPI or netbanking details for the ₹299/month Pro subscription. Razorpay is PCI-DSS certified. We only receive back a confirmation that a payment succeeded, the amount, and the email it applies to. We never see your full card number.
• Google AdSense (advertising on the Free plan) — Google may set cookies to serve advertisements and reads its own cookies to control ad frequency. Their processing is governed by Google's advertising policies.
• Google reCAPTCHA / anti-abuse (only on sign-up and login pages) — a light bot-detection check that reads a Google cookie.
• Cloudflare (DNS & DDoS protection) — sees the IP address of every request to keep the site up; does not store your account data.

We do not sell your personal information to advertisers, data brokers or anyone else. We do not "rent out" your email. If we ever need to send you a marketing email (rare), you can unsubscribe at any time by clicking the link at the bottom.

6. How long we keep your data

We keep your account information for as long as you have an active account. If you close your account (see section 8) we delete your name, email and hashed password within 30 days. Anonymised aggregate analytics (for example, "total downloads in July") is kept indefinitely because it no longer identifies you. Financial records that we are legally required to keep (Razorpay receipts for GST/tax purposes) are retained for 8 years as required by Indian law.

7. Where your data is stored

Your account row lives on servers physically located in Mumbai, India, operated by Supabase. Payment data is stored by Razorpay on their PCI-DSS-certified servers in India. Ad-serving data is processed by Google on their global infrastructure. We do not routinely transfer your personal data outside India, and we never do so without appropriate safeguards.

8. Your rights

You have complete control over the small amount of data we hold for you. At any time you can:

• See it — log into your dashboard to view your name, email and plan.
• Correct it — edit your name or change your email from Settings.
• Export it — email [email protected] and we will send a JSON copy within 30 days.
• Delete it — email us or click "Delete my account" in Settings. Your data is removed within 30 days.
• Object or restrict — you can object to specific processing (for example, analytics) at any time; we will honour genuine objections.
• Withdraw consent — where processing depends on your consent (for example, personalised ads), you can withdraw it in your browser at any time.

If you feel that we have not handled your data properly and cannot resolve it with us, you have the right to complain to a supervisory authority — for Indian users, that is currently the Ministry of Electronics and Information Technology (MeitY) and, once fully operational, the Data Protection Board of India constituted under the Digital Personal Data Protection Act, 2023.

9. Children

KaagazPDF is a general-purpose document utility used by working adults and by students preparing exam applications. We do not knowingly collect personal information from children under the age of 13. Users between 13 and 18 should use the service under the guidance of a parent or guardian. If you believe a child has created an account without permission, please email [email protected] and we will remove it.

10. Data security

We take security seriously because we know the kind of documents Indians process on this site — Aadhaar cards, PAN copies, exam certificates, salary slips. Our defences include: browser-only file processing (so there is nothing to steal from us), HTTPS on every page, hashed and salted password storage (Argon2), least-privilege database access, application-level rate limits, Cloudflare DDoS protection, and regular dependency updates. No system is 100% breach-proof, but the design of KaagazPDF means the sensitive stuff — your files — never even reaches us.

11. Changes to this policy

We may update this policy from time to time — for example, when we add a new tool, a new payment method, or when the law changes. We will always show the "Last updated" date at the top of this page, and for significant changes we will send a notice to your registered email at least 14 days before the change takes effect. You can view the previous version by emailing us and asking for it.

12. Contact us

For any question about this Privacy Policy, or to exercise any of your rights above, please reach out to us at:

• Privacy email: [email protected]
• General support: [email protected]
• Postal / grievance officer: KaagazPDF Grievance Officer, c/o [email protected] — we will provide a postal address on request as required under the IT Rules, 2021.

We aim to reply within 48 working hours, and to fully resolve every valid request within 30 days.