blupdf AI PDF editor logo iconblupdf

Privacy Policy

Effective 2026-08-27 · Last updated 2026-08-27

This Privacy Policy explains what information blupdf ("blupdf", "we", "us" or "our") collects when you use the blupdf.com website and the blupdf application (together, the "Service"), how we use and share it, how long we keep it, and the choices and rights you have. It applies to everyone who visits our website or uses the Service. Capitalized terms not defined here have the meaning given in our Terms of Service.

The short version: we collect what we need to run an AI PDF editor — your Google account details, the documents you upload, the edits you make, your credit usage and your billing status. We use your documents only to perform the edits you ask for. We do not sell your personal information, we do not use your documents to train AI models, and we delete documents 30 days after you last open them or immediately when you delete them.

1. Who we are and what this policy covers

blupdf operates the Service and is the controller of the personal information described in this policy. This policy covers information processed through blupdf.com, the blupdf application, our support channels and our communications with you. It does not cover the practices of third-party websites we link to, or of the third-party services you use to reach us (for example, your Google account), each of which has its own privacy policy.

2. Information we collect

Account information. When you sign in with Google, we receive your email address, your name, your profile picture and a stable Google account identifier. We use these to create and identify your blupdf account. We do not receive your Google password.

Documents and edits. The core of the Service is processing the files you upload. We store the PDF files and images you upload, the pages and text blocks we extract from them, the OCR results for scanned pages, the text you type, the fonts and layout properties we detect, AI outputs generated for your document (such as answers to questions or proposed replacements), and the exported files you download. Together we call these "Documents". Documents can contain any kind of personal information, including information about third parties; you are responsible for having the right to upload them.

Usage and credit information. We record the actions you take in the Service — uploads, parses, OCR runs, edits, exports, AI calls — together with timestamps, the number of credits each action consumed, job status and error information, and the resulting credit balance. This is the ledger that shows what you have used and lets us investigate problems.

Billing information. When you buy a plan or a credit pack, our payment processor Stripe collects your payment details directly. We receive and store a Stripe customer identifier, your plan, the status of your subscription, invoice and payment records, and the last four digits and brand of your card for display. We never receive or store your full card number, expiry date or security code.

Technical information. When you use the Service, we and our hosting providers automatically receive your IP address, browser type and version, operating system, device type, language settings, referring pages, the pages you visit and the time of your visit. Our analytics are cookieless (see section 11) and do not build a profile of you across sites.

Support and contact information. If you write to us or use the contact form, we keep your name, email address, the subject and content of your message, a hashed form of your IP address used only for abuse prevention, and our reply.

Information we do not collect. We do not collect precise location data, biometric data, or data from your other Google services beyond the sign-in fields listed above. We do not knowingly collect information from anyone under 18.

3. How we use information

We use the information described above to:

  • Provide and operate the Service — create and maintain your account, store and render your Documents, perform the edits and AI actions you request, meter credits, and deliver exports;
  • Process payments and manage subscriptions — including renewals, failed-payment handling, invoices, refunds and re-credits;
  • Keep the Service secure and prevent abuse — authenticate you, detect and block unauthorized access, rate-limit requests, enforce our Terms, including the document-integrity rules in section 7 of the Terms, and investigate incidents;
  • Support you — answer your questions, troubleshoot problems and respond to requests about your rights;
  • Communicate with you about the Service — account notices, billing notices, security alerts, changes to our terms and policies, and responses to your messages;
  • Improve the Service — analyze aggregated usage to understand which features are used, where errors occur and how performance can be improved. We do this with aggregated and de-identified data, not with the content of your Documents; and
  • Comply with the law — meet legal, tax, accounting and regulatory obligations, and respond to lawful requests.

We do not use your Documents for advertising, profiling or any purpose other than providing the Service to you and complying with law.

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the General Data Protection Regulation ("GDPR") and the UK GDPR:

  • Performance of a contract (Article 6(1)(b)) — processing your account, Documents, usage and billing information is necessary to provide the Service you signed up for;
  • Legitimate interests (Article 6(1)(f)) — securing the Service, preventing fraud and abuse, improving the Service using aggregated data, and communicating with you about the Service, where these interests are not overridden by your rights;
  • Consent (Article 6(1)(a)) — where we ask for it, for example for optional communications. You can withdraw consent at any time without affecting processing that happened before withdrawal; and
  • Legal obligation (Article 6(1)(c)) — keeping billing records, responding to lawful requests and meeting other legal requirements.

5. How we share information

We share personal information only with the service providers we need to run the Service, and in the limited other circumstances described here. Our providers are bound by contracts that restrict their use of your information to providing services to us.

Supabase. Hosts our database, authentication and file storage. Your account information, ledger, and Documents are stored on Supabase infrastructure running on Amazon Web Services in the US West (Oregon) region of the United States.

Vercel. Hosts the website and application, delivers content through its global network, and provides cookieless analytics and performance monitoring. Vercel sees the technical information described in section 2 when it serves pages to you.

Stripe. Processes payments and stores your payment details. Stripe is an independent controller for the payment information it collects; its privacy policy explains how it uses that information, including for fraud prevention.

Google. Provides sign-in through your Google account. Google also provides the Gemini artificial-intelligence models we use for OCR, font matching, document questions and find-and-replace. When you request one of these actions, the relevant page images or text from your Document are sent to the Google Gemini API to perform that action and the result is returned to us. Under the terms that govern our use of the Gemini API, the content we send is used only to provide the service to us and is not used to train or improve Google's models. We send only what is needed for the action you requested, and only when you request it.

Professional advisers and successors. We may share information with our lawyers, accountants, auditors and insurers where necessary, and with a buyer or successor in the event of a merger, acquisition, financing, reorganization or sale of all or part of our business, in which case we will notify you and this policy will continue to apply until it is changed.

Legal requirements. We may disclose information if we believe in good faith that disclosure is required by law, subpoena, court order or other legal process; is necessary to protect the rights, property or safety of blupdf, our users or the public; or is necessary to investigate or address a violation of our Terms, including suspected use of the Service to falsify documents.

With your direction. We share information when you ask us to — for example, when you download an export to share with someone else.

We do not sell personal information, and we do not share it with third parties for their own marketing or for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

6. Data retention

We keep information only as long as we need it for the purposes described in this policy:

  • Documents — deleted 30 days after you last opened or edited them, or immediately when you delete the document or your account. Deleted Documents are removed from live storage promptly and from backups within 30 days.
  • AI processing data — page images and text sent to the Google Gemini API are not retained by us beyond the Document itself; Google's retention for abuse monitoring is governed by its API terms.
  • Account information and credit ledger — kept for the life of your account. When you delete your account, we delete or anonymize account information within 30 days, except for information we must keep for longer.
  • Billing records — invoices, payment records and related account details are kept for as long as required by tax and accounting law, generally seven years.
  • Technical logs — server and security logs are kept for up to 90 days, unless we need to keep a specific record longer to investigate an incident.
  • Support messages — kept for up to two years after the conversation ends so that we can refer back to it if you contact us again.

Backups roll off on a rolling schedule within 30 days. Aggregated or de-identified data that cannot reasonably be linked to you may be kept indefinitely.

7. Security

We use technical and organizational measures designed to protect your information: encryption in transit (TLS) and at rest; row-level security in our database so that each account can only reach its own records; short-lived, signed URLs for file access; least-privilege access for our staff and systems; audit logging of administrative actions; and regular review of our providers' security certifications. Payment details are handled by Stripe and never touch our servers.

No method of transmission or storage is completely secure. If you believe your account has been compromised, or you find a security issue in the Service, contact us at support@blupdf.com and we will respond promptly. If we experience a breach that affects your personal information, we will notify you and the relevant authorities as required by law.

8. Your rights and choices

You control your information. You can view and update your profile, manage your subscription and delete your account and Documents from within the Service at any time. In addition, depending on where you live, you have the rights described below. You can exercise any of them by emailing support@blupdf.com from the email address on your account, or by using the self-service tools in Settings. We will respond within 30 days (or within 45 days where the CCPA allows, with notice if we need an extension). We may need to verify your identity, which we normally do by confirming you control the account email. You will not be discriminated against for exercising your rights.

European Economic Area, United Kingdom and Switzerland (GDPR / UK GDPR). You have the right to: access the personal information we hold about you and receive a copy; rectify inaccurate or incomplete information; erase your information ("right to be forgotten"), subject to legal retention requirements; restrict processing in certain circumstances; receive your information in a portable, machine-readable format; object to processing based on legitimate interests; withdraw consent where processing is based on consent; and lodge a complaint with your local data-protection supervisory authority. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining to an authority.

California (CCPA / CPRA). If you are a California resident, you have the right to: know what personal information we collect, use, disclose and sell or share, and to access it; delete personal information we collected from you, subject to exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information — we do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of; limit the use and disclosure of sensitive personal information — we use sensitive personal information only to provide the Service; and not be discriminated against for exercising these rights. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of authorization and may ask you to verify your identity directly. The categories of personal information we have collected in the preceding 12 months are those listed in section 2; the categories of recipients are those listed in section 5.

Other U.S. states. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws have similar rights of access, correction, deletion, portability and opt-out, which you can exercise in the same way. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal in writing.

All users. You can opt out of non-essential emails by using the unsubscribe link in the email or by contacting us. We will still send service and legal notices that are necessary to operate your account.

9. International data transfers

We are based in the United States and process information there, using the providers listed in section 5. If you use the Service from outside the United States, your information will be transferred to, stored in and processed in the United States and in any other country where our providers operate. For information transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) with our providers, together with the additional safeguards described in section 7, or on other lawful transfer mechanisms.

10. Children

The Service is not directed to, and may not be used by, anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, contact us at support@blupdf.com and we will delete it.

11. Cookies and analytics

We use only cookies that are strictly necessary to operate the Service: the Supabase authentication cookies that keep you signed in, and the cookies Stripe sets on its checkout and billing pages for fraud prevention. We do not use advertising cookies, social-media pixels or cross-site tracking. Our analytics and performance monitoring, provided by Vercel, are cookieless: they record page views and web-vitals metrics without setting cookies or storing personal identifiers. Because we set only essential cookies, we do not show a cookie banner. The full list is in our Cookie Policy.

12. Automated decision-making

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The AI features of the Service act on your Documents only when you ask them to, and their output is shown to you for review before you export or rely on it. Our abuse-detection systems may flag activity for human review; account actions taken as a result are reviewed by a person.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address on your account, by a notice in the Service, or both, before the changes take effect. The "Last updated" date at the top of this page shows the most recent revision. Your continued use of the Service after the effective date of a change means that you accept the updated policy.

14. Contact

If you have questions about this policy, want to exercise your rights, or wish to raise a concern about how we handle your information, email support@blupdf.com. If you are in the European Union or the United Kingdom, please contact us first so that we can try to resolve your concern; you also have the right to lodge a complaint with your local supervisory authority at any time.