Privacy policy
Last updated: 1 October 2026
This policy clearly explains what data FileXvert processes, why, for how long and how you can exercise your rights.
1. Data controller
While Premium subscriptions are closed, the non-professional data controller is Yang fu, established at 72 rue de l'eglise, 74350 le sappey. No company or paid activity is presented as active.
For any question about your data: contact@filexvert.fr.
2. Your files remain on your device, except flagged office conversions
Video, audio and image conversion, most document conversions and PDF editing run locally in your browser: the content, names and pages of your files are never uploaded, stored or accessed. A few office conversions are the exception (Word, PowerPoint, OpenDocument, RTF or HTML documents converted to PDF or between each other, PDF to Word, Excel or PDF/A): after a notice shown before upload, the file is sent to our server over an encrypted connection, converted, then deleted as soon as the result is returned. This processing is detailed below.
3. Data, purposes, legal bases and retention
FileXvert limits every processing operation to the information needed for its stated purpose.
Account and authentication
Data: email address, name, optional image, sign-in provider identifiers, technical tokens and password hash where relevant.
Purpose: create the account, secure sign-in and provide restricted features.
Legal basis: performance of the contract or pre-contractual steps requested by the user.
Retention: for the life of the account; the account and connected sign-in methods are deleted on request from the Account area, except data subject to a separate legal obligation.
Conversion history
Data: source and target formats, category, size, status and technical duration; never the file or its name.
Purpose: display account history and improve service operation.
Legal basis: performance of the requested service.
Retention: until the account is deleted, which erases this history by cascade.
Office conversions on the server
Data: the uploaded file and its name, solely for the requested conversion; no other data is attached, and neither the name nor the content is logged.
Purpose: producing the requested converted file (Word, PowerPoint, OpenDocument, RTF or HTML documents converted to PDF or between each other, PDF to Word, Excel or PDF/A).
Legal basis: performance of the requested service, after prior notice shown before upload.
Retention: the duration of the conversion, a few seconds: the source file and the result are erased as soon as the response is sent, on success or failure. The conversion service is isolated, has no Internet access and shares nothing with third parties.
Feedback and requests
Data: message, category, related page and optional email address; account identifier when the person is signed in.
Purpose: reply, correct defects and plan improvements.
Legal basis: legitimate interest in improving the service and, where a reply is requested, action taken by the user.
Retention: no more than three years; when an account is deleted, its email address and account link are removed from retained feedback.
First-party audience measurement
Data: visited path, referring domain, optional UTM campaign parameters, anonymous converter steps and a daily pseudonymous digest of the IP address and browser; no file name or content, IP address or user agent is stored.
Purpose: count page views and daily visitors, measure acquisition sources and the conversion funnel, and improve the service without tracking across days or websites.
Legal basis: the publisher's legitimate interest in measuring and improving its own service.
Retention: no more than twenty-five months; the digest changes daily and older rows are automatically purged.
8. Security
Data: pseudonymised counters derived from the IP address, account or entered email address.
Purpose: limit sign-in attempts, spam, excessive requests and fraud.
Legal basis: legitimate interest in protecting users and the service.
Retention: for short windows matching the limits applied, followed by periodic deletion of expired counters.
4. Recipients and providers
Data is accessible only to authorised persons and, depending on the feature used, to the necessary providers:
- the hosting and database providers listed in the legal notice;
- Google for OAuth sign-in;
- Adsterra for ads displayed after your permission or when you voluntarily open a sponsored link;
5. Transfers outside the European Economic Area
Some providers may process data in the United States. These transfers must be covered by an applicable adequacy decision, the EU–US framework for certified entities or the European Commission's Standard Contractual Clauses. The exact safeguards depend on the provider and can be obtained from the contact above.
6. Cookies and local storage
FileXvert uses only necessary storage before your choice. Advertising trackers remain blocked until you consent.
- Auth.js authentication and security: session, redirect and CSRF cookies, limited to the session or the time needed to sign in.
- Language, theme and advertising choice: functional preferences stored on the device; advertising consent or refusal expires after six months.
- FileXvert audience measurement: no cookie and no persistent identifier; a different server-side digest each day prevents long-term tracking.
- Adsterra: its ad scripts load only after your permission. A sponsored link contacts Adsterra only when you click it.
You can refuse as easily as accept, then change or withdraw your choice at any time using the “Cookies” link in the footer.
7. Your rights
Depending on the processing and legal basis, you have the following rights:
- access, correction and restriction of data about you;
- erasure, including through the account deletion button;
- objection to processing based on legitimate interests;
- portability of data you supplied where processing is based on contract or consent;
- withdrawal of consent at any time, without retroactive effect on prior processing.
Send your request to contact@filexvert.fr. Proof of identity may be requested only where there is reasonable doubt. We normally respond within one month.
If you are not satisfied with the response, you may complain to the French Data Protection Authority (CNIL).
8. Security
FileXvert applies data minimisation, access control, encrypted transport, password hashing and request limiting. As no system can be guaranteed risk-free, any confirmed incident is handled in accordance with applicable obligations.
9. Automated decisions and sensitive data
FileXvert makes no decision with legal effect based solely on automated processing and does not request sensitive data. Locally processed files remain under the user's exclusive control.
10. Changes to this policy
This policy is updated when processing activities, providers or applicable rules change. The revision date appears at the top of the page.