Security & privacy
Security and privacy
Where blupdf stores your files, who can access them, which AI services process them, how long data is kept, cookies, and how to report a security issue.
Updated 2026-09-08 · 3 min read
You upload documents that matter to you, so here is exactly what happens to them. This page is the practical summary; the Privacy Policy is the full legal text.
Where files live
Uploaded files, recognised text, edits and saved signatures are stored in blupdf's database and file storage on Supabase, which runs on Amazon Web Services in the US West (Oregon) region. The application itself runs on Vercel in the same region. Data is encrypted in transit with TLS and at rest on the storage layer.
Who can access them
- You, from your account. Every database table is protected by row-level security, so a request can only ever return rows that belong to the signed-in user.
- Files are fetched through short-lived signed URLs created for your session; there are no public links to your documents.
- blupdf staff do not open customer documents in the course of normal operation. Access for support or abuse investigation is limited, logged and requires a specific reason.
- Card details never reach blupdf; Stripe handles payment data.
- Sign-in is through Google only; blupdf stores no passwords.
AI processing
Two kinds of AI work happen, each only when the action calls for it, and each sends only what that action needs to a trusted third-party AI provider acting on blupdf's behalf:
| Action | What is sent |
|---|---|
| Recognising a scanned page (its text, pictures and rules) | The page image |
| blupdf AI edits and Create with AI drafts | The document's text and your messages |
The result comes back, is stored with your document, and that is the end of the exchange. Under the service terms we use, the content is used only to provide the service and is not used to train the provider's models; blupdf does not train models on your documents either. Nothing is sent unless you open a scanned page or make a request in the blupdf AI panel; opening a digital PDF and editing it by hand involves no AI service at all.
Retention
| Data | Kept until |
|---|---|
| Documents, recognised text, edits | 30 days after you last opened or edited the document, or immediately when you delete it or your account |
| Saved signatures | You remove them in Settings, or you delete your account |
| Account profile and credit ledger | Account deletion |
| Billing records | As required by tax law (generally 7 years) |
| Server logs | Up to 90 days |
Deleting a document removes it from your account immediately. Deleting your account under Settings removes every file and row of the account, including documents, drafts, signatures and profile; backups roll off within 30 days.
Your rights
You can view and export your data, correct it, and delete it at any time from the app. Users in the EU, UK and California have additional statutory rights described in the Privacy Policy; write to support@blupdf.com to exercise them.
Cookies and analytics
blupdf sets the cookies needed to keep you signed in, to complete payment on Stripe's pages, and to remember your cookie choice. Google Ads sets measurement cookies so we can tell whether an ad led to a sign-up or a purchase; visitors from the EEA, UK and Switzerland are asked first, and Cookie settings in the footer reopens the choice anywhere. Analytics are cookieless and aggregated. The full list is in the Cookie Policy.
Reporting a security issue
If you find a vulnerability, email support@blupdf.com with the details. Please give us a reasonable time to fix it before disclosing it publicly. We do not pursue good-faith researchers who respect user data and privacy.