Security and privacy

You upload documents that matter to you, so here is exactly what happens to them. This page is the practical summary; the Privacy Policy is the full legal text.

Where files live

Uploaded files, extracted text and exports are stored in blupdf's database and file storage on Supabase, which runs on Amazon Web Services in the US West (Oregon) region. Data is encrypted in transit with TLS and at rest on the storage layer. The website and application are served by Vercel.

Who can access them

• You, from your account. Every database table is protected by row-level security, so a request can only ever return rows that belong to the signed-in user.
• Files are fetched through short-lived signed URLs generated for your session; there are no public links to your documents.
• blupdf staff do not open customer documents in the course of normal operation. Access for support or abuse investigation is limited, logged and requires a specific reason.
• Card details never reach blupdf; Stripe handles payment data.

AI processing

OCR, font matching, Ask and Find & replace use Google's Gemini models. When you trigger one of these actions, the relevant page images or text are sent to the Gemini API, the result comes back, and that is the end of it:

• Content is sent only for the action you requested, and only the parts needed for it.
• Under the API terms we use, your content is not used to train Google's models.
• blupdf does not use your documents to train models either.

Ask and Find & replace are never run automatically; they act only when you invoke them.

Retention

Data	Kept until
Documents, extracted text, exports	30 days after you last opened the document, or immediately when you delete it
Account profile and credit ledger	Account deletion (then removed within 30 days)
Billing records	As required by tax law (generally 7 years)
Server logs	Up to 90 days

Deleting your account from Settings removes your documents and profile; backups roll off within 30 days.

Your rights

You can view and export your data, correct it, and delete it at any time from the app. Users in the EU, UK and California have additional statutory rights described in the Privacy Policy; write to support@blupdf.com to exercise them.

Cookies and analytics

blupdf sets only the cookies needed to keep you signed in and to process payments. Analytics are cookieless and aggregated. Details in the Cookie Policy.

Reporting a security issue

If you find a vulnerability, email support@blupdf.com with the details. Please give us a reasonable time to fix it before disclosing it publicly. We do not pursue good-faith researchers who respect user data and privacy.