Privacy Policy

Last updated: August 2026

EasyAccessPDF (“we”, “our”, “us”) provides automated PDF accessibility tagging and compliance verification. This policy explains what personal data we process, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Data Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is the entity listed in our Impressum.

Privacy contact: [email protected]

2. What We Process and Why

We process only the minimum data necessary to provide the service:

• Uploaded documents — processed solely to perform accessibility tagging and compliance analysis. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Account data — email address and password hash if you create an account, plus your API key and credit balance. Legal basis: Art. 6(1)(b) GDPR.
• Payment data — currently processed via SEPA bank transfer; we receive only the payment reference and amount, never your full bank credentials. When card payments via Stripe and PayPal are enabled, those providers act as independent processors under their own privacy terms. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (tax and accounting obligations).
• Server logs — IP address, browser type, and access times, retained for security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• AI Draw usage data — when you use the AI Draw diagram generator, we record the generation time, your IP address, your approximate country (derived from the IP address), your access code (Pro subscribers), the prompt text you entered, and the AI token consumption. This data is used for usage statistics, billing, and abuse prevention. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in operating the service securely).

3. Where Data Is Processed

All documents are processed exclusively on servers located in Frankfurt am Main, Germany (European Union). We do not transfer your documents or personal data outside the European Economic Area.

Our website is fully self-contained: fonts are self-hosted, and no third-party content delivery networks, analytics scripts, or tracking pixels are loaded. Your IP address is therefore not disclosed to third-party service operators when you browse this site.

When you use AI Draw, your prompt is transmitted to our AI model provider (DeepSeek) solely to generate the requested diagram. Prompts are processed for generation only; neither we nor the provider use them to train models.

4. Retention

• Uploaded documents are automatically and permanently deleted within 24 hours of processing. We do not read, share, sell, or mine document content.
• Account data is retained until you delete your account.
• Payment and invoice records are retained for the statutory periods under German tax and commercial law (up to 10 years).
• AI Draw usage data is retained for up to 90 days for usage statistics and abuse prevention, after which it is automatically deleted.

5. Cookies

This website uses only strictly necessary cookies — for example, the WooCommerce cart session and, if you log in, your authentication session. These cookies are exempt from consent under § 25(2) TDDDG (Germany). We do not use marketing, analytics, or third-party tracking cookies.

6. Recipients and Processors

We use a small number of processors bound by data processing agreements under Art. 28 GDPR:

• Hosting provider (server infrastructure, data center in Frankfurt am Main, Germany)
• Payment providers as described in Section 2, only to the extent necessary to process your payment

No other third parties receive your personal data.

7. Your Rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with future effect.

To exercise any of these rights, contact [email protected]. We respond within 30 days.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence or of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden, Germany

9. Changes to This Policy

We may update this policy to reflect legal or technical changes. The current version is always available on this page. Material changes will be announced on the website.