Privacy Policy

Operator

PDFWhirl is operated by Kotipalli Srikesh in India. Privacy enquiries can be sent to support@pdfwhirl.com.

Information handled

If you create an account, PDFWhirl handles the email address and account identifiers needed to register, authenticate, and display account information. The browser stores the access token and basic user record in local storage after sign-in.

Uploaded files and processing

Files you select are uploaded so the requested tool can process them. File metadata is recorded by the file service, objects are stored in the configured Cloudflare R2-compatible storage, and supported workers temporarily download inputs while performing a job. Worker temporary directories are cleaned up when processing finishes, but this is separate from deletion of stored objects.

Uploads, downloads, and access

The browser sends selected inputs to the file service. The file service issues time-limited signed download URLs, and workers use signed upload URLs when registering generated outputs. Production frontend and gateway configuration uses HTTPS, and the gateway attaches security headers. These controls do not amount to a guarantee that every transmission or system is risk-free.

Authentication

Signed-in requests can include a bearer token. Passwords are hashed by the authentication service. Some current public tool requests can also run as an anonymous guest; users should not treat an anonymous browser session as a private account workspace.

Logs and diagnostics

Backend services produce operational logs and job status records for processing and diagnosis. The repository does not establish a public log-retention period or fully document every production log field.

Cookies, local storage, analytics, and advertising

The audited frontend stores sign-in information and a recent list of document job identifiers, tool names, statuses, timestamps, and output identifiers in browser local storage. A temporary session-storage flag prevents repeated reloads while obsolete service-worker data is removed. No Google Analytics or Google AdSense script was found in the frontend during this review. Hosting providers may apply essential network or security mechanisms outside the Angular code. If analytics or advertising is enabled later, this policy and any required consent controls must be updated before use.

Retention and deletion

No automatic fixed deletion period for uploaded files was verified. The file API supports user-requested deletion, which removes the stored object when possible and marks its metadata as deleted. Account deletion and comprehensive retention controls were not found in the audited public interface.

Service providers and international processing

PDFWhirl uses Railway for application-service hosting and Cloudflare services for site delivery, including Cloudflare R2 for object storage. It also relies on database and queue services. Data may be processed in locations used by those providers. Exact processing locations, contractual roles, subprocessors, and international-transfer disclosures still require confirmation by the site owner.

Your choices and rights

You can clear browser storage, avoid creating an account, and request deletion of individual files where that control is available. Applicable privacy law may provide additional rights. Email support@pdfwhirl.com for a private privacy enquiry.

Privacy requests and account deletion

To request access to, correction of, or deletion of account information, or to withdraw a previous consent, email support@pdfwhirl.com from the address associated with the account. State the type of request and the account email. Do not attach identity documents, passwords, or uploaded PDFs unless support first explains a necessary and secure verification method.

Support may request proportionate information to verify account ownership before acting. The current product does not yet provide a complete in-account deletion workflow, so this published email process is the available request channel. A request does not override records that must be retained under applicable law or information that cannot be reliably linked to the requester.

India and regional privacy requirements

PDFWhirl is operated from India. India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have phased commencement dates. This notice and the request channel above are operational transparency measures; they are not a claim that every provision applies or is already in force. Users in other regions may have additional rights under applicable law, and the site’s advertising consent configuration must be reviewed before ads are enabled in those regions.

The phased commencement is documented in the Government of India commencement notification and the Digital Personal Data Protection Rules, 2025.

Children

PDFWhirl is not presented as a service directed to children. The site owner must confirm the appropriate minimum age and any jurisdiction-specific requirements.

Changes and contact

This notice may change as the product and its data practices change. Material implementation changes should be reflected here. See the Contact page for currently published channels and contact limitations.