Privacy policy

1. Who is responsible for your data

The controller is Blue One Limited, a private company limited by shares incorporated in Hong Kong, Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong.

The person in charge of the protection of personal information (Quebec Law 25) and contact point for the GDPR can be reached at contact@eflypdf.com.

2. Data we collect

• Account: email address, preferred language, country and display currency.
• Payment: handled by Stripe. We receive the payment status, the plan and the invoices, but we never see your card number.
• Usage: counters (operations, AI pages, words translated) and technical logs. These logs never contain the content of your files, and file names are not stored in plain text.
• Anonymous fingerprint: for visitors without an account, a salted hash of the IP address and of the browser fingerprint, used only to apply quotas and prevent abuse.
• Form-filling profile (optional): details you choose to save to fill in forms faster. It is encrypted and you can delete it at any time.
• Contact messages: what you send us through the contact form or by email.

We do not collect sensitive data on purpose. If your documents contain some, they are processed only to provide the service you request.

3. Your documents

Some tools run entirely in your browser: your file never leaves your device.

Other tools process your file on our servers. The file is uploaded to private storage, scanned by an antivirus, processed in an isolated environment, then deleted automatically. Nobody on our team opens your documents, except at your express request for support.

Details are given on the page how we handle your documents and AI (/en/how-we-handle-your-documents).

4. Purposes and legal bases

Under PIPEDA and Law 25, we collect your personal information only for these purposes, with your consent where required, and we do not use it for other purposes without telling you.

5. The AI assistant

When you use the assistant, the passages needed for your request are sent to an AI provider. We only use paid APIs.

• Anthropic and OpenAI do not train their models on data sent through their APIs.
• Google is used only through its paid offer (billing enabled). The free tier of the Gemini API is excluded, because data sent through it may be used for training.
• We do not train any model on your documents.
• Our usage logs contain no content: user, task, provider, model, number of tokens, cost, status. Never the prompt, the text or the answer.

Under their API terms, providers may keep data temporarily for security and abuse detection, then delete it (retention periods to be checked with each provider).

6. How long we keep data

With a 24-hour pass, your files follow the same rules: up to 30 days, or until you delete them, with a download link valid for 48 hours.

You can delete a file or a conversation earlier at any time. Longer history is available on paid plans, for example 90 days on Pro.

7. Our service providers

We rely on the following providers, bound by contract to process your data only on our instructions and to protect it.

We never sell or rent your personal data.

8. International transfers

Some of our providers are located, or process data, outside the European Union and Canada, in particular in the United States.

These transfers are covered by the European Commission's standard contractual clauses or an equivalent mechanism, such as an adequacy decision (mechanisms to be confirmed for each provider). Under Law 25, we assess the protection offered before any transfer of personal information outside Quebec.

9. Security

• Encryption in transit (HTTPS) and at rest.
• Sensitive fields (conversations, form values, form-filling profile) additionally encrypted at application level.
• Private storage, accessible only through short-lived signed links.
• Strict separation between users: each request is limited to the data of its owner.
• Antivirus scan of every file processed on our servers.
• Automatic deletion of expired files.

In the event of a data breach likely to put you at risk, we will notify the competent authority and inform you, as required by law.

10. Cookies

We only use cookies that are needed for the service to work, with no advertising trackers. See the cookie policy (/en/cookies).

11. Your rights

If you are in the European Union (GDPR), you have the right to:

• access your data;
• correct it;
• have it erased;
• restrict its processing;
• receive it in a portable format;
• object to processing based on our legitimate interest;
• withdraw your consent at any time;
• in France, set instructions for what happens to your data after your death;
• lodge a complaint with the CNIL (France) or with the supervisory authority of your country.

If you are in Canada (PIPEDA) or Quebec (Law 25), you have the right to:

• access your personal information;
• have it corrected;
• withdraw your consent, subject to legal or contractual restrictions;
• file a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, with the Commission d'accès à l'information.

You can export your data and delete your account yourself, at any time, from your account area (/en/account).

For any other request, write to contact@eflypdf.com. We answer within one month. We may ask you to prove your identity.

12. Minors

The service is not intended for children under 15 without the permission of a parent or guardian (age threshold to be confirmed according to the applicable law).

If you believe a child has given us personal data without permission, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The date of the last update is shown on this page. For significant changes, we will inform account holders by email or in the service.

Contact

For any question about your data or this policy, contact us.

• By email: contact@eflypdf.com
• Through the contact form: /en/contact
• By post: Blue One Limited, Suite C, Level 7, World Trust Tower, 50 Stanley Street, Central, Hong Kong