Privacy
How pdf-a.com handles your data. Last updated: October 9, 2026.
1. Data controller
CAPITA S.R.L., Piazza Lodovico Cerva 43, 00143 Rome (RM), Italy, VAT no. IT17385951003, support@capita.srl. Under the EU General Data Protection Regulation (GDPR), CAPITA S.R.L. is the controller of the personal data collected through pdf-a.com (the «Site»).
2. The core principle
Your documents never leave your device
- The PDF is read, converted and validated entirely in your browser, by code running on your device.
- No file is uploaded to, sent to or stored on the servers of CAPITA S.R.L. or anyone else.
- There is no server-side copy to delete, because none is ever made.
You can verify it: open your browser's developer tools, go to the Network tab and convert a file. No request carries the document.
3. Document contents
Your documents may contain personal data, including about other people. Since processing happens only on your device and CAPITA S.R.L. neither receives a copy nor can access it, CAPITA S.R.L. is neither controller nor processor of that content. Please convert only documents you are entitled to handle.
4. Data we actually process
- Aggregate browsing data — pages visited, device and browser type, country, collected only with your consent (section 5).
- Payment data — if you buy a plan, payment is handled by Stripe; we receive only a customer ID, email address and payment status, never card details.
- Email address — given at checkout, used to send your licence key and answer support requests. Never used for marketing.
5. Analytics
The Site uses Google Analytics 4 in Consent Mode v2, denied by default: until you choose in the banner, no analytics cookie is set and no data is sent. Provider: Google Ireland Limited, with possible transfers to Google LLC (United States). Cookies _ga and _ga_*, only with consent, 2 years. Data retention: 14 months.
6. Payments
Payments are processed by Stripe, acting as processor for the payment and as independent controller for fraud prevention and its own legal obligations. Stripe is PCI DSS Level 1 certified. Policy: stripe.com/privacy.
7. Hosting
The Site is hosted by Vercel Inc., processor for the technical delivery of pages only. Documents never pass through the hosting infrastructure, because they are never uploaded.
8. Cookies and local storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
pdfa_session | Technical cookie | Recognises your purchase and authorises downloads | Depends on the plan |
_ga, _ga_* | Analytics cookies | Aggregate statistics, only with consent | 2 years |
pdfa_cookie_consent | localStorage | Remembers your cookie choice | Until you clear browser data |
pdfa_unlocked_docs | localStorage | Fingerprints (SHA-256) of documents unlocked with a single purchase; the document itself is not stored | Until you clear browser data |
pdfa | IndexedDB | A copy of the original document, on your device only, while you are on the payment page, so it can be converted again when you return | Deleted when you return to the Site |
pdfa_privacy_dismissed | localStorage | Remembers that you closed the local-processing notice | Until you clear browser data |
9. Legal bases
- Technical cookie, payments and licence key: performance of a contract (Art. 6(1)(b) GDPR)
- Accounting and tax records: legal obligation (Art. 6(1)(c))
- Google Analytics: consent (Art. 6(1)(a))
10. Retention
Documents: not retained at all; they exist only in your browser's memory. Purchase data: for the duration of the relationship and, for tax-relevant data, the 10 years required by Italian law.
11. International transfers
Documents are never transferred, because they never leave your device. Possible transfers to the United States concern only our providers' data (Stripe, Google with consent, Vercel), under the EU-US Data Privacy Framework and Standard Contractual Clauses.
12. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR), and may withdraw consent to analytics at any time. Write to support@capita.srl; we reply within 30 days. You may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali) or with the authority of your country.