Back to Home

Privacy Policy

Last updated: April 8, 2026

1. Introduction

This Privacy Policy describes how pdftoexcelnow.com ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use our PDF to Excel conversion service. We are committed to handling your data responsibly and in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

By using our service, you agree to the collection and use of information in accordance with this policy. If you have questions or concerns about how we handle your data, please contact us through our contact form or at privacy@pdftoexcelnow.com.

2. What Data We Collect

2.1 Data You Provide Directly

  • Account Information: When you log in with Replit authentication, we receive your name, email address, and Replit user ID. We store these to maintain your account and track your daily conversion usage.
  • Contact Form Submissions: If you contact us via the contact form, we receive your name, email address, and message content. This information is used solely to respond to your enquiry.

2.2 Data Collected Automatically

  • Hashed IP Address: We collect a hashed (one-way cryptographic) representation of your IP address for rate limiting purposes. The hash cannot be reversed to identify your original IP address. We store this hash to enforce the daily conversion limit.
  • Session Identifier: A session ID is assigned when you visit the site. This is used to maintain your session state (e.g., whether you are logged in) and to track your free conversion usage within a session.
  • Usage Statistics: We log anonymized conversion events, including a timestamp, the file size in bytes, the number of pages processed, the number of tables detected, and whether the conversion succeeded or failed. We never log the content of your PDF files or any data from within them.
  • Browser and Device Information: Standard web server access logs include your browser type, operating system, referring URL, and the pages you visit. This information is used for operational monitoring and aggregate analytics.

2.3 Uploaded PDF Files

PDF files you upload for conversion are processed entirely in server memory. They are never written to persistent disk storage. Once the converted Excel file has been generated and sent to your browser, the uploaded PDF is deleted from memory immediately. We have no ability to retrieve, review, or access your PDF files after conversion is complete. We do not log or store the content of your files at any point.

3. How We Use Your Data

We use the data we collect for the following purposes:

  • Service provision: To process PDF to Excel conversions and deliver the output file to you.
  • Account management: To maintain your account and track your daily conversion usage.
  • Rate limiting and abuse prevention: To enforce the daily conversion limit and prevent automated abuse of the service.
  • Service improvement: To analyze anonymized usage patterns, identify errors, and improve conversion accuracy and performance.
  • Communication: To respond to support enquiries and to notify you of significant changes to the service or this policy.
  • Legal compliance: To meet our legal and regulatory obligations, including maintaining transaction records for tax purposes.

We do not use your personal data for automated decision-making or profiling. We do not sell your personal data to any third party.

4. Data Retention

We retain different categories of data for different periods, based on legal requirements and operational necessity:

  • Uploaded PDF files: Not retained. Deleted from memory immediately after conversion. Retention period: 0 seconds after delivery of the converted file.
  • Session data and hashed IP addresses: Retained for 30 days, after which they are automatically purged. This window is used to enforce rate limits and investigate abuse reports.
  • Account information (name, email, Replit ID): Retained for as long as your account is active, plus 90 days after account deletion to allow for account recovery. After this period, your personal information is deleted.
  • Conversion event logs (anonymized): Retained for 12 months for operational monitoring and service improvement. These logs do not contain personal identifiers or file content.
  • Contact form submissions: Retained for 90 days after resolution of the enquiry, then deleted.

You may request deletion of your personal data at any time (see section 6 for how to exercise your rights), subject to any overriding legal retention obligations.

5. Third-Party Services

We use the following third-party services that may receive or process data in connection with your use of pdftoexcelnow.com:

5.1 Replit Authentication

We use Replit's OAuth authentication system to allow users to log in without creating a separate password. When you log in via Replit, Replit shares your name, email address, and Replit user ID with us. Replit's handling of your data is governed by Replit's Privacy Policy. We do not share any of your usage data back to Replit.

5.2 Google AdSense (Advertising)

All users of pdftoexcelnow.com are shown advertisements served by Google AdSense. Google AdSense uses cookies and similar tracking technologies to serve ads based on your browsing behaviour on this and other websites. This is an advertising disclosure required by Google's policies: ads displayed on this site are served by Google AdSense, and Google may use your data to personalise those ads based on your prior web activity.

You can control Google's use of your data for personalised advertising at any time:

5.3 Infrastructure (Replit Cloud)

Our application is hosted on Replit's cloud infrastructure. Server processing — including PDF conversion — takes place on Replit's servers. Data in transit between your browser and our servers is encrypted with TLS (HTTPS). Replit's data centres are located in the United States. If you are accessing the service from the European Economic Area, your data may be transferred to and processed in the United States. Replit operates under appropriate international data transfer mechanisms. For more information, see Replit's Privacy Policy.

6. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies on pdftoexcelnow.com:

Category 1: Strictly Necessary Cookies

These cookies are essential for the service to function. They cannot be disabled without breaking core site functionality. They include:

  • Session cookie: Maintains your login state while you are using the site. Expires when you close your browser or after 7 days of inactivity.
  • Rate-limit cookie: Tracks your free conversion usage within the current 24-hour window. Expires after 24 hours.
  • CSRF protection token: Prevents cross-site request forgery on form submissions. Expires at the end of your session.

Category 2: Analytics Cookies

We collect anonymized, aggregated analytics data to understand how users interact with the service. This data is processed internally and is not shared with third-party analytics platforms. No personal identifiers are included in analytics processing.

Category 3: Advertising Cookies

Google AdSense places third-party cookies on pages viewed by all users. These cookies are used to serve and measure advertisements. They may track your browsing activity across websites. You can opt out of personalised advertising via Google's Ad Settings or by blocking third-party cookies in your browser settings.

Managing Cookies

You can control cookies through your browser settings. The process varies by browser:

Blocking strictly necessary cookies will prevent you from logging in. Blocking advertising cookies will prevent personalised ads but may still result in non-personalised ads being displayed.

7. Your GDPR Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent legislation:

Right of Access

You have the right to request a copy of all personal data we hold about you, along with information about how it is used, where it is stored, and who it has been shared with. We will provide this information within 30 days of receiving a verified request.

Right to Rectification

You have the right to request correction of any personal data we hold about you that is inaccurate or incomplete. If you notice an error in your account information, you can update it directly in your account settings or submit a data request.

Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of all personal data we hold about you. Upon a verified deletion request, we will delete your account data, conversion history, and any associated personal identifiers within 30 days.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV), and to transfer that data to another service. This right applies to data you have provided to us and that we process on the legal basis of consent or contract.

Right to Object

You have the right to object to processing of your personal data for direct marketing purposes or where we rely on legitimate interests as the legal basis for processing. Where you object to legitimate-interest processing, we will stop unless we have compelling legitimate grounds that override your interests.

Right to Restriction of Processing

You have the right to request that we restrict (but not delete) processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or while an objection to processing is being assessed.

Right to Withdraw Consent

Where we rely on your consent as the legal basis for processing (for example, marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority. In the EU, this is the data protection authority of your country of residence. In the UK, this is the Information Commissioner's Office (ICO). We encourage you to contact us first to resolve any concerns directly.

8. How to Exercise Your Rights

To submit a data request — including requests for access, deletion, portability, rectification, or restriction — please contact us through one of the following channels:

Please include the following in your request: your name, the email address associated with your account (if applicable), and a clear description of the request (e.g., "I am requesting deletion of all personal data associated with my account" or "I am requesting a copy of all data held about me").

We will acknowledge your request within 5 business days and provide a substantive response within 30 days. For complex requests, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason for it.

We may need to verify your identity before acting on a data request to ensure we are responding to the correct individual. We will not charge a fee for reasonable data requests.

9. Legal Basis for Processing

Under GDPR, we process personal data on the following legal bases:

  • Contract performance (Article 6(1)(b)): Processing necessary to provide the conversion service you have requested and manage your account.
  • Legitimate interests (Article 6(1)(f)): Processing for rate limiting, abuse prevention, security monitoring, and anonymized service analytics — where these interests are not overridden by your rights.
  • Consent (Article 6(1)(a)): For advertising cookies placed by Google AdSense. You may withdraw this consent at any time through your browser cookie settings.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include:

  • Encryption in transit: All data transferred between your browser and our servers is encrypted using TLS (HTTPS). We enforce HTTPS and reject unencrypted HTTP connections.
  • No file persistence: Uploaded PDFs are never written to persistent storage, eliminating the risk of file data exposure through database breaches or unauthorized access to storage systems.
  • Access controls: Database access is restricted to application processes with minimum necessary permissions. Administrative access to production systems requires multi-factor authentication.
  • Dependency management: We regularly update application dependencies to patch known security vulnerabilities.

No method of electronic transmission or storage is 100% secure. While we take significant measures to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.

11. Children's Privacy

Our service is intended for adults and business users. It is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make significant changes, we will update the "Last updated" date at the top of this page. For material changes affecting your rights, we will provide additional notice, such as a notification in the service or an email to registered users.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact us:

We aim to respond to all privacy-related enquiries within 5 business days.