Privacy Policy
Short answer: EnjoyPDF processes documents on your computer by default and does not send document content to us. Only when you choose to use cloud AI translation is the text to be translated sent to the third-party provider you chose. We process only the small amount of information needed for website visits, forms and purchases. This policy explains, item by item, what we process, why, how long we keep it, who we share it with, and how you can exercise your rights.
This page is a draft legal text. It will be reviewed by a lawyer before publication.
Effective date: 15 October 2026
This policy explains how the operator of EnjoyPDF (“we”) handles personal information when you use the EnjoyPDF software and this website. We are the controller (personal information handler) of the personal information described in this policy. For privacy questions, contact the privacy email address listed on the Contact us page.
1. Key points
- The documents, keywords, replacement text and passwords you process with the software are not sent to us.
- Optional cloud AI translation sends the text to be translated to the third-party provider you choose (not through us), and asks for your confirmation before the first use of each provider; with a local model, the text does not leave your computer.
- The website uses no tracking cookies, does no cross-site tracking and does not sell personal information.
- The current version of the software goes online only when you click to download a language pack or use cloud AI translation; update checks and error reports are planned and not implemented yet. See section 3.
- You can ask at any time to access, correct or delete the personal information we hold about you.
2. What we do not collect
We do not collect, receive or have access to:
- the content of documents you open, recognize, replace or redact with the software;
- your keyword tables, replacement text, recognition results and operation records;
- document passwords and API keys for AI platforms (keys are stored only on your computer, encrypted with your Windows account);
- file names, file paths and file hashes.
This data stays on your computer. Where it is stored and how to clear it are described in How documents are processed on your computer.
3. Data processed by the software
3.1 Language pack downloads
- Data: the IP address and other ordinary network request data in the download request.
- Recipient: third-party model hosts (ModelScope, GitHub, PyPI), not us; these sites handle the request under their own policies.
- Purpose: to provide recognition model files; the SHA-256 is checked on your computer after download.
- Control: happens only when you click download or confirm installation; you can also download a pack on a connected computer and import it from file.
3.2 AI translation (optional)
- Data: the document text to be translated is sent to the third-party AI platform you choose and configure. It does not pass through us.
- Protection: by default, numbers (including amounts, dates, ID numbers and phone numbers), email addresses and URLs are replaced with placeholders before sending; names, addresses and other ordinary words are sent. You are asked to confirm before text is first sent to a given platform. If you choose a local model (Ollama / LM Studio), the text does not leave your computer.
- Note: that platform’s processing of the data is governed by its own privacy policy; we are not the controller of that processing.
3.3 Planned network features: update checks and error reports
The current version does not have these two features, and the software makes no automatic connections. If we add them in the future, we will first update this policy and Network behavior with the exact fields sent, how long they are kept and how to turn them off, and they will not include document text, keywords, file names, file paths or file hashes.
3.4 Licenses
The current development build does not include licensing or activation yet. The design goal is that activation and validation take place on your computer and send no data to us; this section will be updated when they ship.
4. Data processed by the website
4.1 Visit statistics
The website uses Cloudflare Web Analytics for visit statistics. Cloudflare adds its script to our pages; it sets no cookies and builds no cross-site profiles, and we see only aggregated page addresses, referring websites, country or region, browser and device type. The two browser PDF tools (text layer check, TXT extractor) block this script: their pages load nothing from other services.
The browser PDF tools (text layer check, TXT extractor) process files in your browser. File names, file contents and extracted text are never sent to us or to anyone else, and are never part of statistics.
Tool and download event counts are also off unless the operator turns them on. When enabled, the page sends one short message to this website (not to a third party) when a tool shows a result or an error, or when a download button is clicked. It contains only the event type, the page address without anything after it, the site language, the tool and the result or error category (for example “no text found” or “password-protected”). The website adds 1 to a counter for that day and combination; it does not store individual events, the time of day, your IP address, browser details or any identifier, and sets no cookie. Your IP address is used only briefly in memory to limit the number of messages per minute and is not stored. The daily counters are deleted after 400 days. They are not enabled in the current version of the website.
4.2 Download statistics
When an installer is downloaded, we record the version, file name, country or region, and the language directory of the page where the download was clicked. We do not record IP addresses.
4.3 Forms
The business enquiry, contact and abuse report forms collect the information you enter (such as name, email, company, team size and message), as well as the page submitted from, its language and your country or region. We do not store your IP address.
4.4 Anti-abuse verification
The forms use Cloudflare Turnstile to check whether the submitter is an automated program. Turnstile processes signals from your browser, device and network, and is not used for advertising.
4.5 Browser local storage
The website keeps two items in your browser’s local storage (localStorage): whether you dismissed the language suggestion, and your progress in the pre-sharing redaction checklist. They are stored only in your browser, are not sent to us, and can be deleted by clearing your browser data. The website’s free tools (SHA-256 checker, operation record verifier, ID number tester and others) run in your browser, and the files you choose and the text you paste are not uploaded.
4.6 Hosting and security logs
The website is hosted by Cloudflare. To keep the website secure and prevent attacks, Cloudflare processes technical information such as visitors’ IP addresses under its own policies.
5. Purchases
Once online purchasing opens, orders and payments will be handled by a third-party payment provider. We receive the information needed to issue your license and receipts: name or company name, email, country or region, the product purchased and amount, and tax information. We do not receive full card details.
6. Purposes and legal bases
| Purpose | Data involved | Legal basis |
|---|---|---|
| Providing language pack download links | Download requests handled by third-party hosts | Performance of our contract with you; legitimate interests |
| Responding to enquiries and reports | Form information | Your request; steps taken to enter into a contract; legitimate interests |
| Measuring website use | Aggregated visit data, download counts | Legitimate interests |
| Preventing abuse and attacks | Turnstile signals, security logs | Legitimate interests; legal obligations |
| Licensing, payment and invoicing | Order information | Performance of a contract; legal obligations (tax and accounting) |
Where China’s Personal Information Protection Law (PIPL) applies, the basis for this processing is that it is necessary to enter into or perform a contract to which you are a party, or your consent. Where Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) or the EU General Data Protection Regulation (GDPR) applies, the basis is contract, legitimate interests, legal obligation or your consent, as shown in the table above.
7. Sharing and processors
We do not sell or rent your personal information or use it for third-party advertising. We share only the information needed to provide our services with the following service providers, and require them to protect it as agreed:
- Cloudflare: website hosting, form storage, visit statistics, anti-abuse verification and download distribution;
- Payment provider: processing orders and payments (once online purchasing opens);
- Email provider: sending and receiving email between you and us.
Where the law requires it, or where it is necessary to protect our or others’ lawful rights and interests, we may provide information to law enforcement authorities, courts or regulators, and only to the extent necessary.
8. International transfers
Our service providers may process data in countries or regions outside Malaysia, including outside the country or region where you are. We take the safeguards required by applicable law, such as agreements with service providers that include data protection terms. Where China’s PIPL applies, we will tell you the name and contact details of the overseas recipient, and obtain your separate consent or take other compliance measures as the law requires.
9. Retention
| Data | Retention period |
|---|---|
| Form information | 24 months, then deleted automatically by the system |
| Download counts and visit statistics | Kept in aggregated form, not linked to individuals |
| Tool and download event counters (when enabled) | Daily aggregated counters, deleted automatically after 400 days |
| Order and invoicing information | For the period required by tax and accounting laws in Malaysia and other relevant jurisdictions |
If you ask us to delete data, we will delete it earlier to the extent the law allows.
10. Security
We take reasonable technical and organizational measures to protect personal information, including HTTPS across the whole website, minimizing form data, not storing IP addresses, access controls and regular deletion of expired data. No system can guarantee absolute security. If a security incident occurs that may affect your personal information, we will notify you and the regulators as the law requires.
11. Your rights
Depending on the law where you live, you may have the following rights:
| Jurisdiction and law | Your main rights |
|---|---|
| Malaysia: Personal Data Protection Act 2010 | Access and correct personal data; withdraw consent; ask us to stop processing for direct marketing |
| China: Personal Information Protection Law (PIPL) | Be informed, decide, access, copy, correct, supplement and delete; withdraw consent; ask us to explain our processing rules; portability of personal information |
| Thailand: Personal Data Protection Act B.E. 2562 (PDPA) | Access, obtain a copy, portability, object, erasure, restriction of processing, rectification; withdraw consent; complain to the regulator |
| EU and UK: GDPR | Access, rectification, erasure, restriction of processing, portability, objection; withdraw consent; complain to a data protection authority |
How to exercise your rights: contact us at the privacy email address and describe your request. To protect your information, we may need to verify your identity. We will reply within 30 days, or within any shorter period the law requires. Exercising your rights is generally free of charge.
If you are not satisfied with our reply, you can complain to the personal data protection regulator where you live.
12. Minors
The software and website are intended for professional and business users, not for minors under 18. We do not knowingly collect personal information from minors; if we find that we have collected it by mistake, we will delete it promptly.
13. Changes to this policy
We may update this policy and will update the effective date on this page. We will notify you of material changes on the website or by email before they take effect.
14. Contact us
For privacy questions, requests and complaints, contact the privacy email address listed on the Contact us page.