Privacy Policy

Last updated: 13 août 2026

This policy describes how Romain Mathieu (“we”, “the data controller”), publisher of PDF Scene, processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Belgian Act of 30 July 2018.

Privacy contact: support@pdfscene.com . Full identity: see our Legal notice .

1. Principles — privacy by design

PDF Scene is designed so your PDFs are processed in your browser. In normal use of the editor (Free or Pro without the AI assistant), we do not have access to the content of your documents. The Pro AI assistant is a voluntary, explicit exception: when you use it, certain context elements (messages and document structure) are sent to an AI provider — see § 3.6. Otherwise, this approach minimises data processed on our servers.

2. Data controller

Romain Mathieu, Personne physique, BCE 1036.553.777, VAT BE1036553777, Rue du Marais 80, 6150 Anderlues, Belgique.

No Data Protection Officer (DPO) has been appointed at this stage (not required for this structure). The GDPR contact point is support@pdfscene.com.

3. Data processed

3.1 Data we do not collect (local Free use)

• Content of your PDF / image files imported for editing
• Mandatory account creation
• Targeted advertising / third-party advertising trackers (current state of the Service)

3.2 Data stored only on your device

The Service may store locally (IndexedDB, localStorage): work-in-progress documents, UI preferences, drawn signatures, local Free/Pro indicators. This data does not leave your device unless you export or transfer it yourself. Legal basis: legitimate interest / performance of the service you request (Art. 6(1)(b) and 6(1)(f) GDPR), under your control.

3.3 Data when contacting support

If you write to us (support@pdfscene.com): identity, email, message content, attachments you choose to send. Legal basis: legitimate interest (support) and/or pre-contractual measures (Art. 6(1)(b)/(f)).

3.4 Data related to the Pro subscription

Payment is processed by Polar. Depending on their role (independent controller and/or processor / Merchant of Record), Polar processes in particular: identity, email, payment methods, transaction history, country/VAT. We may receive purchase confirmation, checkout identifiers, and subscription status to activate Pro. Purchase confirmation is verified via a Polar webhook to our server (checkout identifier only — never the content of your PDFs). We do not store full credit card numbers.

Also see Polar's privacy policy at https://polar.sh .

3.5 Technical hosting data

The site host (Hostinger International Limited) may process technical logs (IP address, date, URL, user-agent) for security, continuity, and proper operation. Legal basis: legitimate interest (Art. 6(1)(f)) — security. If non-essential cookies are added to PDF Scene in the future, your consent will be collected (see Cookies ). Hostinger policy: https://www.hostinger.com/legal/privacy-policy .

3.6 Cloud AI assistant (Pro plan only)

If you use the AI assistant included with Pro, your text instructions and a structured excerpt of the document state are sent from your browser to our API (pdfscene.com/api), then forwarded to OpenAI (processor / model provider) to generate the reply and proposed editing actions. That excerpt may include textual content already present in the editor (annotation labels, field values, detected-text excerpts, colours, positions, page metadata) — not the full binary PDF file. The following may also transit: the session conversation history, tool schemas and tool results returned by the editor, and the Pro checkout identifier used to verify the subscription and debit credits.

On our servers we mainly keep the AI credit balance linked to your Pro subscription (and purchased top-up packs), plus short technical API logs (status, errors, timestamps — without archiving your PDFs as documents). Chat messages are not meant to be kept as a document store with us: they transit to fulfil the request. OpenAI processes this data under its own policy and may retain technical / abuse-prevention records under its terms. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — providing the AI feature you request.

OpenAI privacy policy: https://openai.com/policies/privacy-policy . Do not use the assistant for documents whose transmission to an AI provider would be prohibited (strict professional secrecy, sensitive health data, etc.) without an appropriate legal basis on your side.

3.7 First-party audience measurement

We measure site traffic (page views, click origin, approximate country if provided by the host, and a “payment opened” event) via a first-party script on pdfscene.com. Requests go to our server (Hostinger International Limited); a daily hashed identifier and the URL path (never your PDF content) are then stored on our internal infrastructure (Supabase) to operate the Service. No cookie is set for this measurement. IP address and user-agent are combined with a daily salt and hashed: the IP is not stored, and the identifier changes every day. We never send PDF content, a file name, the editor title, an email, or a checkout identifier. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — understanding audience and improving the Service. You can opt out via Global Privacy Control / GPC (no event is then recorded). See also Cookies .

4. Purposes

• Provide and improve the PDF editing Service
• Manage Pro subscriptions, AI credits, and payment fraud prevention
• Provide the Pro AI assistant (understanding instructions and edit suggestions)
• Provide user support and respond to GDPR requests
• Comply with legal obligations (accounting, tax)
• Secure the infrastructure
• Measure site audience (pages, sources) without document content

5. Recipients

Possible recipients: Polar (payment), Hostinger International Limited (hosting), OpenAI (processing Pro AI assistant requests), Supabase (storage of hashed audience events for our internal dashboard), messaging tools for support, authorities where legally required. No sale of personal data.

6. Transfers outside the EEA

If a processor (e.g. Polar, OpenAI, Supabase, or the host) processes data outside the EEA — including in the United States for OpenAI — appropriate safeguards are put in place (standard contractual clauses, adequacy decision / Data Privacy Framework where applicable, etc.). Request details at support@pdfscene.com.

7. Retention periods

• Local browser data: until you delete it or clear storage
• Support emails: up to 3 years after the last useful contact
• Transaction / billing data: statutory accounting periods (often 7 years in Belgium) via us and/or Polar
• AI credit balances and history: for the Pro subscription period and accounting periods linked to pack purchases
• API / host technical logs: as a rule up to 90 days, unless a longer security need or legal obligation applies
• Audience events (daily hashed identifier, URL path, source): up to 13 months

8. Your rights

You have the rights of access, rectification, erasure, restriction, objection, portability (where applicable), and the right to withdraw consent. To exercise them: support@pdfscene.com. You may also lodge a complaint with the Belgian Data Protection Authority (APD): autoriteprotectiondonnees.be .

For data stored only locally, exercise your rights by deleting it from your browser (site data for pdfscene.com).

9. Security

We implement appropriate measures (HTTPS, minimisation, no upload of the binary PDF file to our servers for local editing). The Pro AI assistant only transmits the structured context needed for the request, over HTTPS. No system is infallible: protect your device and your exports, and avoid sending unnecessary secrets via the AI (passwords, API keys, etc.).

10. Minors

The Service is not intended for children under 16 without a holder of parental authority. Paid subscriptions are reserved for persons with legal capacity to contract.

11. Changes

This policy may be updated. The date at the top of the page is authoritative. In case of a material change, notice may be displayed on the site.

12. Contact

support@pdfscene.com — Romain Mathieu, Rue du Marais 80, 6150 Anderlues, Belgium.