Privacy Policy

Information we collect

We collect information in the following ways:

Information you provide directly

1. Account Information: When you create an account, we collect your name, email address, and password. If you register via a third-party authentication provider (e.g., Google, Apple), we receive your name and email address from that provider.

2. Payment Information: Novitora is currently free to use, so we do not process payments or collect billing or payment card information. If we introduce paid plans in future, we will update this policy to describe the payment information collected and name the payment processor before any such data is collected.

3. Profile Information: Any additional information you choose to add to your profile, such as a profile picture, company name, or job title.

4. Communication Data: When you contact us via email, contact forms, or support tickets, we collect the content of your communications, including any attachments, along with your contact details.

5. Files and Content: When you use our conversion service, you upload files to our servers. We process these files solely for the purpose of performing the requested conversion. See the "File processing" section below for details on how we handle your files.

6. Survey and Feedback Data: If you participate in surveys, provide feedback, or respond to questionnaires, we collect the information you provide.

Information collected automatically

1. Usage Data: We automatically collect information about how you interact with the Service, including:

   • Pages visited and features used.
   • Conversion types and formats selected.
   • Time spent on pages and interaction patterns.
   • Referral URLs and navigation paths.
   • Date and time of access.

2. Device and Browser Information: We collect technical information about your device and browser, including:

   • Device type, operating system, and version.
   • Browser type and version.
   • Screen resolution and display settings.
   • Language preferences.

3. Network Information: We collect:

   • IP address (which may be used to approximate your general location at the city or country level).
   • Internet service provider.
   • Connection type and speed.

4. Cookies and Similar Technologies: We use cookies, web beacons, pixel tags, and similar technologies to collect information. For detailed information about our use of cookies, please refer to our Cookie Policy.

5. Cookie Choices: When you accept, reject or change your cookie choices, we record a random identifier, the time, the version of our cookie policy you were shown, the language of the banner and your choice, so we can show that we asked. We do not store your IP address or details of your browser or device with it.

6. Log Data: Our servers automatically record information ("Log Data") created by your use of the Service, which may include:

   • Request details (URL, method, headers).
   • Response status codes and sizes.
   • Error messages and stack traces (with personal data redacted).
   • Timestamps and request durations.

Information from third parties

1. Authentication Providers: If you sign in using a third-party service (e.g., Google, Apple), we receive profile information from that provider as authorised by you.

2. Payment Processors: Novitora is currently free and uses no payment processor, so we receive no payment or transaction data. This may change if paid plans are introduced, at which point this policy will be updated.

3. Analytics Providers: We may receive aggregated or anonymised analytics data from third-party analytics services.

4. Publicly Available Information: We may collect information about you from publicly available sources to the extent relevant to our business relationship.

File processing

Your files are your property. We process files you upload solely for the purpose of performing the requested conversion. Here is how we handle your files:

1. Upload: Files are transmitted to our servers using encrypted connections (TLS 1.2 or higher).
2. Processing: Files are processed in isolated, secure environments. Most conversions run on software we operate ourselves. Our AI and rendering tools (such as background removal, speech-to-text, image upscaling, and web page capture) run on Modal's computing service in the European Economic Area, and our AI document tools (AI PDF Summarizer, PDF Translator, and Chat with PDF) send the text of your document to OpenAI in the United States. Both are listed in our Subprocessors page. We do not access, read, or analyse the content of your files beyond what is technically necessary for the conversion.
3. Storage: Converted files are temporarily stored on our servers for a limited period to allow you to download them.
4. Deletion: Files are automatically deleted from our servers after the retention period specified in our data retention policy (see "Data retention" section). You may also manually delete your files at any time through the Service.
5. No Content Analysis: We do not use the content of your files for advertising, profiling, training machine learning models, or any purpose other than performing the requested conversion.

How we use your information

We use the information we collect for the following purposes:

Providing and improving the service

1. To process your file conversions and deliver converted files.
2. To create and manage your account.
3. If we introduce paid plans in future, to process payments and manage any subscriptions.
4. To provide customer support and respond to your inquiries.
5. To personalise your experience and provide content relevant to your interests.
6. To improve the Service, including developing new features and functionality.
7. To analyse usage patterns and optimise Service performance.
8. To conduct research and development to enhance our conversion technology.

Communication

1. To send you transactional emails related to your account and conversions (e.g., registration confirmations and conversion completion notifications).
2. To send you service-related announcements (e.g., maintenance notices, security alerts, policy updates).
3. To send you marketing communications about our products and services, where you have consented or where we have a legitimate interest (you may opt out at any time).
4. To respond to your support requests and feedback.

Security and compliance

1. To detect, prevent, and address fraud, security incidents, and technical issues.
2. To enforce our Terms of Service and other policies.
3. To comply with applicable laws, regulations, and legal processes.
4. To protect the rights, property, and safety of Uptraff Ltd, our users, and the public.
5. To conduct audits and internal investigations.

Analytics and business operations

1. To generate aggregated, anonymised, or de-identified data for statistical analysis and business intelligence.
2. To measure the effectiveness of our marketing campaigns.
3. To evaluate and improve our business processes and operations.
4. To make informed business decisions based on usage trends and patterns.

Legal basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), we process your personal data on the following legal bases:

Performance of a contract

We process your personal data as necessary to perform our contractual obligations to you, including:

1. Providing the file conversion service.
2. Managing your account.
3. Processing payments for any paid plans we may introduce in future.
4. Delivering converted files.

Legitimate interests

We process your personal data based on our legitimate interests, provided that these interests are not overridden by your rights and freedoms. Our legitimate interests include:

1. Improving and optimising the Service.
2. Ensuring the security and integrity of the Service.
3. Understanding how users interact with the Service.
4. Preventing fraud and abuse.
5. Marketing our products and services to existing customers (soft opt-in).
6. Administering our business operations.

Consent

Where required by law, we process your personal data based on your consent, including:

1. Sending marketing communications to prospective customers.
2. Setting non-essential cookies and similar technologies.
3. Processing special categories of personal data (if applicable).

You may withdraw your consent at any time by contacting us at privacy@novitora.com or by using the relevant opt-out mechanism. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Legal obligation

We process your personal data as necessary to comply with our legal obligations, including:

1. Tax and accounting requirements.
2. Responding to lawful requests from public authorities.
3. Complying with data protection laws.
4. Maintaining records as required by applicable regulations.

Data sharing and disclosure

We do not sell your personal data. We may share your information in the following circumstances:

Service Providers

We engage trusted third-party companies and individuals ("Service Providers") to perform services on our behalf, including:

1. Cloud Infrastructure: Hosting and storage services for processing and storing files and data.
2. AI Processing: Computing for our AI and rendering tools (Modal) and a language model for our AI document tools (OpenAI).
3. Payment Processing: Not applicable while Novitora is free, so no payments are processed. Any future payment processor will be named here and in our Subprocessor List.
4. Email Services: Sending transactional and marketing emails.
5. Analytics: Analysing Service usage and performance.
6. Customer Support: Providing customer support tools and services.
7. Security: Monitoring and protecting against security threats.

Our Service Providers are contractually bound to use your personal data only for the purposes for which it is disclosed to them and in accordance with our instructions. They are required to implement appropriate security measures to protect your data.

Legal requirements

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities, including:

1. To comply with a legal obligation, court order, or legal process.
2. To protect and defend the rights or property of Uptraff Ltd.
3. To prevent or investigate possible wrongdoing in connection with the Service.
4. To protect the personal safety of users of the Service or the public.
5. To protect against legal liability.

Business transfers

In the event of a merger, acquisition, reorganisation, bankruptcy, or other change of control, your personal data may be transferred to the acquiring entity. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.

With your consent

We may share your personal data with third parties when you have given us your explicit consent to do so.

Aggregated or anonymised data

We may share aggregated or anonymised data that does not directly identify you with third parties for any purpose, including research, marketing, and analytics. Such data cannot be used to re-identify you.

International data transfers

Transfer mechanisms

As our Service is operated from the United Kingdom, your personal data may be transferred to and processed in countries outside the United Kingdom and the European Economic Area (EEA), including countries that may not provide the same level of data protection.

When we transfer personal data internationally, we ensure that appropriate safeguards are in place, including:

1. Adequacy Decisions: Transferring data to countries that have been recognised by the UK Secretary of State or the European Commission as providing an adequate level of data protection.

2. Standard Contractual Clauses (SCCs): Using the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses approved by the relevant authorities to govern transfers of personal data.

3. Supplementary Measures: Implementing additional technical, organisational, and contractual measures where necessary to ensure an adequate level of protection.

Sub-processors

We maintain a public list of the sub-processors who may process your personal data on our behalf, with what each one does and where it processes data, on our Subprocessors page. You can also request it by contacting privacy@novitora.com. Some of them, such as Clerk and OpenAI, process data in the United States; those transfers are protected by the safeguards described above.

Transfer impact assessments

We conduct transfer impact assessments to evaluate the risks associated with international data transfers and to determine whether additional safeguards are necessary.

Data retention

Retention periods

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

1. Account Data: Retained for the duration of your account and for up to 2 years after account closure, unless we are required to retain it longer for legal or regulatory purposes.

2. Uploaded Files: Files you upload for conversion are automatically deleted from our servers within 2 hours of upload for anonymous use, and within 24 hours for authenticated API workspaces, unless you delete them sooner from within the Service.

3. Converted Files: Converted files are available for download for a limited period (as specified in the Service) and are then automatically deleted.

4. Payment Records: Not applicable while Novitora is free. If we introduce paid plans, payment records will be retained for up to 7 years to comply with tax and accounting obligations.

5. Communication Records: Retained for up to 3 years after the last communication to facilitate ongoing support and dispute resolution.

6. Log Data: Retained for up to 90 days for security and troubleshooting purposes.

7. Analytics Data: Visit-level analytics data linked to the Google Analytics cookie identifiers is deleted after 14 months. PostHog keeps the events linked to its random identifiers for one year on our current plan, after which it may delete them. Umami sets no cookies and stores no IP address; it tells visits apart with a one-way hash that changes every month. Aggregated reports, which identify no one, may be kept indefinitely.

8. Cookie Choice Records: Retained while your choice applies (6 months in the European Economic Area, 12 months elsewhere) and for up to 3 years after it ends, so we can show that we asked for and respected your choice.

Deletion

When personal data is no longer needed, we will securely delete or anonymise it using industry-standard methods. Deletion may not be immediate due to technical constraints (e.g., data in backups), but we will ensure that residual data is deleted within a reasonable timeframe.

To delete your account and the personal data held with it, follow the steps on our Data Subject Requests page.

Your rights and choices

Your data protection rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

1. Right of Access: You have the right to request a copy of the personal data we hold about you, along with information about how we process it.

2. Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

3. Right to Erasure ("Right to Be Forgotten"): You have the right to request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

4. Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

5. Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

6. Right to Object: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

8. Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you.

Exercising your rights

Our Data Subject Requests page sets out, step by step, how to ask us for a copy of your data, how to have it corrected, and how to delete your account, including what deletion does and does not remove.

To exercise any of these rights, please contact us at:

Email: privacy@novitora.com

Post: Uptraff Ltd 124 City Road London, England EC1V 2NX

We will respond to your request within one (1) month of receipt. In certain circumstances, we may extend this period by up to two (2) additional months, in which case we will inform you of the extension and the reasons for it.

Identity verification

To protect your privacy and security, we may need to verify your identity before processing your request. We may ask you to provide additional information to confirm your identity.

Limitations

In some cases, we may not be able to fully comply with your request, for example where:

1. It would adversely affect the rights and freedoms of others.
2. We are legally required to retain the data.
3. The request is manifestly unfounded or excessive.

We will inform you of any limitations and the reasons therefor.

Complaints

If you are not satisfied with our response to your request, or if you believe that we are processing your personal data in a manner that is not compliant with data protection law, you have the right to lodge a complaint with:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF United Kingdom Website: https://ico.org.uk Telephone: 0303 123 1113

If you are located in the European Union, you may also lodge a complaint with your local data protection authority.

Children's privacy

Age restrictions

1. The Service is not directed to children under the age of 16.
2. We do not knowingly collect personal data from children under the age of 16.
3. If we become aware that we have collected personal data from a child under 16 without proper parental or guardian consent, we will take steps to delete that information promptly.

Parental rights

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at privacy@novitora.com. We will take reasonable steps to verify the claim and delete the data if confirmed.

Security measures

Technical measures

We implement appropriate technical measures to protect your personal data, including:

1. Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
2. Encryption at Rest: Personal data and files stored on our servers are encrypted using industry-standard encryption algorithms (AES-256).
3. Access Controls: Strict access controls and authentication mechanisms to limit access to personal data to authorised personnel only.
4. Network Security: Firewalls, intrusion detection systems, and DDoS protection.
5. Vulnerability Management: Regular security reviews and vulnerability scanning.
6. Secure File Processing: Files are processed in isolated environments with no cross-contamination between users.
7. Automated Deletion: Automated processes ensure files and data are deleted according to our retention policies.

Organisational measures

1. Staff Training: Regular data protection and security training for all employees.
2. Confidentiality Agreements: All employees and contractors are bound by confidentiality obligations.
3. Access Reviews: Regular reviews of access permissions to ensure the principle of least privilege.
4. Incident Response: A documented incident response plan for handling security incidents and data breaches.
5. Data Protection Impact Assessments: Conducted for high-risk processing activities.
6. Vendor Assessment: Security assessments of third-party service providers before engagement.

Breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

1. Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
2. Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
3. Document the breach, its effects, and the remedial actions taken.

Cookies and tracking

Overview

We use cookies and similar tracking technologies to collect and store information when you visit our website. For comprehensive information about the types of cookies we use, how we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy.

Essential cookies

Some cookies are strictly necessary for the operation of the Service and cannot be disabled. These include cookies for authentication, security, and session management.

Your choices

Novitora currently sets only the cookies that keep the Service working and remember the display theme you choose, so we do not show a cookie banner. You can block or delete cookies in your browser settings.

Please note that disabling certain cookies may affect the functionality of the Service.

Third-party services

Integrated services

The Service may integrate with or link to third-party services. Each third-party service has its own privacy policy, and we encourage you to review them. Key third-party services we use include:

1. Umami (self-hosted): Cookieless, privacy-friendly website analytics that we run on our own infrastructure in the EU, so its data is not shared with a third-party analytics provider. It runs under the same cookie choices as Google Analytics and PostHog.
2. Google Analytics (with Google Tag Manager): Website analytics provided by Google, which acts as our processor. In the UK, the European Economic Area, Gibraltar and Québec, and wherever we cannot tell where you are, it runs only after you accept analytics; elsewhere it runs unless you object. Google signals, advertising features and data sharing with Google are switched off, and it never receives the names or contents of your files. Our Cookie Policy explains what each analytics tool collects, how long it is kept and how to object.
3. Cloud Infrastructure Providers: For hosting and data storage.
4. Email Service Providers: For transactional and marketing emails.
5. PostHog (error monitoring and product analytics): PostHog stores its data in the EU (Frankfurt), receives it from your browser through Cloudflare's network, does not keep your IP address and acts only on our behalf. PostHog is listed in our Subprocessor List.
   • Error monitoring, for every visitor: when our website or its servers hit a software error, a report of it is sent to PostHog: the error message and stack trace, the page address without its query string, your browser and operating system with their versions, your screen size, language and time zone, and a random identifier that lasts only for that page view. Unless you have allowed analytics, reports carry no cookies, uploaded files or account details, and nothing is stored on your device. We rely on our legitimate interest in keeping the Service secure and working.
   • Product analytics, only where your cookie choices allow analytics: PostHog shows us how our tools are used: the pages you visit, and whether you open a tool, upload a file, get a finished or failed conversion and download the result, with the type of a file but never its name or contents. It keeps a random identifier in a cookie and in your browser's storage, so the steps of a visit can be counted in order; while analytics is allowed, error reports carry the same identifiers. We do not record your screen, build a profile of you or tell PostHog who you are. In the UK, the European Economic Area, Gibraltar and Québec, and wherever we cannot tell where you are, it runs only after you accept analytics; elsewhere it runs unless you object. Our Cookie Policy describes it in full.

Social features

If the Service includes social features (e.g., sharing buttons, social logins), interacting with these features may allow the relevant social media company to collect information about you in accordance with its own privacy policy.

External links

Our Service may contain links to external websites. We are not responsible for the privacy practices of these websites and encourage you to read their privacy policies before providing any personal data.

Do Not Track signals

Some browsers offer a "Do Not Track" (DNT) feature that signals to websites that you do not wish to be tracked. There is no universally accepted standard for how to respond to DNT signals. At this time, we do not respond to DNT signals. We do honour Global Privacy Control: if your browser sends it, we treat it as an objection to analytics. You can also make your choices at any time through Cookie preferences in the footer of our website.

Changes to this policy

Updates

1. We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons.
2. When we make material changes, we will:
   • Update the "Last Updated" date at the top of this Privacy Policy.
   • Send an email notification to the address associated with your account.
   • Display a prominent notice on the Service.
3. Material changes will become effective 30 days after notification, unless a shorter period is required by law.
4. Non-material changes will become effective upon posting.

Review

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

Previous versions

Previous versions of this Privacy Policy are available upon request by contacting privacy@novitora.com.

Data protection officer

While we are not required to appoint a Data Protection Officer (DPO) under the UK GDPR, we have designated a privacy contact who is responsible for overseeing our data protection practices. You may contact our privacy team at:

Email: privacy@novitora.com

Post: Uptraff Ltd Attn: Privacy Team 124 City Road London, England EC1V 2NX

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at:

Uptraff Ltd 124 City Road London, England EC1V 2NX

Uptraff Ltd is a private limited company registered in England and Wales under company number 16153901. Its registered office is 124 City Road, London, England, EC1V 2NX.

Email: privacy@novitora.com

General Inquiries: legal@novitora.com

Website: novitora.com

We will make every effort to respond to your inquiry within 30 days.

Additional information for EEA and UK residents

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional provisions apply:

Representative

For individuals in the EEA, our representative can be contacted at privacy@novitora.com.

Supervisory authority

You have the right to lodge a complaint with the supervisory authority in the EEA member state of your habitual residence, place of work, or place of the alleged infringement.

Legal basis summary

By using Novitora, you acknowledge that you have read and understood this Privacy Policy.