Privacy policy
Last updated: 29 August 2026
Template pending review. This text is a starting template, not a final legal document. Have it reviewed by a legal professional and adapt it to your situation (host, jurisdiction, actual processing) before going into production.
This policy clearly explains what data FileXvert processes, why, for how long and how you can exercise your rights.
1. Data controller
While Premium subscriptions are closed, the non-professional data controller is [Nom et prénom du responsable à compléter], established at [Adresse du responsable à compléter]. No company or paid activity is presented as active.
For any question about your data: contact@filexvert.fr.
2. Your files remain on your device
File conversion and PDF editing run locally in your browser. The content, names and pages of your files are never uploaded, stored or accessed by FileXvert or its providers.
3. Data, purposes, legal bases and retention
FileXvert limits every processing operation to the information needed for its stated purpose.
Account and authentication
Data: email address, name, optional image, sign-in provider identifiers, technical tokens and password hash where relevant.
Purpose: create the account, secure sign-in and provide restricted features.
Legal basis: performance of the contract or pre-contractual steps requested by the user.
Retention: for the life of the account; the account and connected sign-in methods are deleted on request from the Account area, except data subject to a separate legal obligation.
Conversion history
Data: source and target formats, category, size, status and technical duration; never the file or its name.
Purpose: display account history and improve service operation.
Legal basis: performance of the requested service.
Retention: until the account is deleted, which erases this history by cascade.
Feedback and requests
Data: message, category, related page and optional email address; account identifier when the person is signed in.
Purpose: reply, correct defects and plan improvements.
Legal basis: legitimate interest in improving the service and, where a reply is requested, action taken by the user.
Retention: no more than three years; when an account is deleted, its email address and account link are removed from retained feedback.
First-party audience measurement
Data: visited path, referring domain and a pseudonymous digest of the IP address and browser, renewed daily; the IP address and user agent are never stored in the audience table.
Purpose: count page views and daily visitors, understand journeys and size the service without tracking across days or websites.
Legal basis: the publisher's legitimate interest in measuring and improving its own service.
Retention: no more than twenty-five months; the digest changes daily and older rows are automatically purged.
8. Security
Data: pseudonymised counters derived from the IP address, account or entered email address.
Purpose: limit sign-in attempts, spam, excessive requests and fraud.
Legal basis: legitimate interest in protecting users and the service.
Retention: for short windows matching the limits applied, followed by periodic deletion of expired counters.
4. Recipients and providers
Data is accessible only to authorised persons and, depending on the feature used, to the necessary providers:
- the hosting and database providers listed in the legal notice;
5. Transfers outside the European Economic Area
Some providers may process data in the United States. These transfers must be covered by an applicable adequacy decision, the EU–US framework for certified entities or the European Commission's Standard Contractual Clauses. The exact safeguards depend on the provider and can be obtained from the contact above.
6. Cookies and local storage
FileXvert uses only necessary storage before your choice. Advertising trackers remain blocked until you consent.
- Auth.js authentication and security: session, redirect and CSRF cookies, limited to the session or the time needed to sign in.
- Language, theme and advertising choice: functional preferences stored on the device; advertising consent or refusal expires after six months.
- FileXvert audience measurement: no cookie and no persistent identifier; a different server-side digest each day prevents long-term tracking.
- Google AdSense: cookies and other trackers are set only after explicit consent, for the purposes shown in the preferences panel.
You can refuse as easily as accept, then change or withdraw your choice at any time using the “Cookies” link in the footer.
7. Your rights
Depending on the processing and legal basis, you have the following rights:
- access, correction and restriction of data about you;
- erasure, including through the account deletion button;
- objection to processing based on legitimate interests;
- portability of data you supplied where processing is based on contract or consent;
- withdrawal of consent at any time, without retroactive effect on prior processing.
Send your request to contact@filexvert.fr. Proof of identity may be requested only where there is reasonable doubt. We normally respond within one month.
If you are not satisfied with the response, you may complain to the French Data Protection Authority (CNIL).
8. Security
FileXvert applies data minimisation, access control, encrypted transport, password hashing and request limiting. As no system can be guaranteed risk-free, any confirmed incident is handled in accordance with applicable obligations.
9. Automated decisions and sensitive data
FileXvert makes no decision with legal effect based solely on automated processing and does not request sensitive data. Locally processed files remain under the user's exclusive control.
10. Changes to this policy
This policy is updated when processing activities, providers or applicable rules change. The revision date appears at the top of the page.