Privacy Policy

1. Who is responsible?

FileMorph is operated by Lennart Seidel, Reetwerder 25b, 21029 Hamburg, Germany. Contact: privacy@filemorph.io. See Impressum for full contact details. We have not appointed a data protection officer; the law does not require one for a business of our size (§ 38 BDSG).

2. What data we process

2a. Uploaded files: Files you upload exist on our server only as temporary files while they are processed and are deleted immediately afterwards. We keep no file content and write none to a log; the audit log holds only a checksum (SHA-256 hash) of the resulting file (§ 2h). On the way to our server and back, they pass through Cloudflare (see § 4). Legal basis: Art. 6(1)(b) GDPR — we carry out the conversion you ask for under our terms of use, with or without an account; for personal data of other people in a file, Art. 6(1)(f) GDPR — your and our legitimate interest in that conversion.

2b. User accounts (Cloud Edition): If you register an account, we store your email address, a bcrypt hash of your password (never the plaintext), your subscription tier (and, if you have had a paid plan, its latest status), your role (user or admin), whether the account is active, your account creation timestamp, your preferred language for account emails, the timestamp your email address was verified (once you complete that step), and — once you start a paid checkout — the Stripe customer identifier that links your account to Stripe. We also record one row per API/conversion request you make — the endpoint, the file size, when it ran and how long it took, never the file content — to enforce your monthly quota. Account data is persisted in our PostgreSQL database for the lifetime of your account. You can delete your account at any time through the dashboard's "Delete account" flow, or by request to privacy@filemorph.io. On deletion we erase your password hash and API keys, and cancel any active paid subscription. Conversion-job records are anonymised — your account ID is removed — and the resulting anonymous rows are retained for aggregate service-quality analytics; under GDPR Art. 4(1), they no longer relate to you. Stripe transaction records are retained by Stripe under their own tax-retention obligations. For accounts that have made at least one payment, German tax law (HGB §257, AO §147) obliges us to retain a minimal invoice-link record — your email address, Stripe customer identifier, and last billing tier — for 10 years from the end of the calendar year of your last payment; all other personal data is erased on deletion. This retention is the legal-obligation exception under GDPR Art. 17(3)(b); the data is held solely for tax audit and is hard-deleted at the end of the retention period. Erasure otherwise complies with GDPR Art. 17.

2c. Transactional emails: When you register, we send a verification link to your email address (valid for 7 days). When you request a password reset, we generate a separate single-use token (valid for 30 minutes) and send it as a reset link. Outgoing messages are delivered from no-reply@filemorph.io via our email provider (see § 3a). We do not send marketing emails.

2d. Server logs: When you call up a page or use the API, our server writes a line to its access log: your IP address, the time, the HTTP method, the path you requested (without the part after "?") and the response status code. The application also logs events such as password-reset requests, emails sent and errors — with your account ID where there is one and, for email events, only the domain of the address (for example "example.com"), never the address itself. We use these logs only to keep the service secure, detect misuse and fix errors. They are deleted automatically after 30 days at the latest; if a log shows an attack, we keep the entries concerned until it has been dealt with. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working service.

2e. API keys: If you generate an API key (via the dashboard or command-line tool), we store only the SHA-256 hash of your key, together with the label you give it, when it was created, when it was last used and when it expires. The plaintext key is shown to you exactly once at creation time and is never persisted on our servers.

2f. Contact form and email: If you use the contact form (also linked from our Impressum), we process your message text, your email address, and an optional name solely to handle your inquiry. The message is not stored in our database — it is delivered to the operator by email (via the provider in § 3a) and kept only as long as needed to deal with your request. Legal basis: Art. 6(1)(f) GDPR (handling inquiries), or Art. 6(1)(b) GDPR where it concerns an existing contract. We do not use it for marketing. If you write to us by email, for example to privacy@filemorph.io, we process your address, your message and any personal data it contains, likewise only to answer you. Contact-form messages and emails end up in our mailbox at Zoho (see § 3a). We delete them once your request has been dealt with, unless a statutory retention period applies (for example to business letters under German commercial and tax law).

2g. Online cancellation (Cloud Edition): If you cancel a paid plan with the “Cancel contracts here” form, we process what you enter — email address, contract, type of cancellation, a reason if you give one, and the requested end date — to find your contract, end it through Stripe (see § 3a) and email you the confirmation required by § 312k BGB. Our tamper-evident audit log records the time of receipt, the contract, the type of cancellation, the requested end, whether an account matched and how the cancellation was handled (the end date set, or why it went to manual handling), linked to your account if one matches; your email address, your IP address and the reason are not recorded there. Cancellations we have to handle by hand, including the reason, are sent to our operator mailbox. Legal basis: Art. 6(1)(b) and (c) GDPR; for the audit record, Art. 6(1)(f) GDPR (proof that and when a cancellation arrived).

2h. Audit log (Cloud Edition): So that we can prove afterwards how the service handled requests, we keep a tamper-evident audit log in which each entry is chained to the previous one by a SHA-256 hash. Every entry records the event type and the time and, for actions tied to your account, your account ID. For a single-file conversion or compression it adds the file format (source and target format for a conversion), the size of the uploaded and of the resulting file, the SHA-256 hash of the resulting file (not its content), your plan tier and the request's data-classification label (by default "internal"); a failed attempt records the error code instead of the sizes, the hash and the tier. Account and billing events — registration, login, email verification, password reset, account deletion, the withdrawal waiver you give at checkout, subscription and payment changes — add details such as your plan tier, the subscription status, an invoice's ID and amount; what an online cancellation records is set out in § 2g. New entries record your email address in no form: not the address, not a hash of it, not its domain. A failed login, a registration with an address that is already taken, a password-reset request and an online cancellation are linked to the account the entered address belongs to, if there is one — also when someone else entered it. A contact-form message records only the language (German or English) we derive from your browser's language settings. Entries written up to and including 12 October 2026 may still contain a SHA-256 hash of an email address or, for an account deletion, the domain of an email address; they are kept like all other entries. The audit log no longer records IP addresses; we are removing the addresses still stored in older entries. Audit entries are currently kept without a time limit; we plan to delete them automatically after a fixed period and will update this notice once that is in place. If you delete your account, your account ID is removed from these entries; the entries themselves are kept (older ones including any email-address hash or domain in them). If your account has to be kept for tax reasons (see § 5), the entries stay linked to that retained record. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in being able to prove how the service handled requests and in detecting misuse.

3. Legal basis (GDPR Art. 6)

Converting and compressing your files, creating and running your account, paid subscriptions and transactional emails are based on Art. 6(1)(b) GDPR (performance of a contract). Server logs, rate limiting, abuse prevention, the audit log, the connection through Cloudflare, handling inquiries you send us and admin access are based on our legitimate interest (Art. 6(1)(f) GDPR) in operating a secure and reliable service; you can object to these (see § 5). We do not ask for your consent and process no data on that basis. Data we must keep because a law requires it (such as invoice records, § 2b, or business letters, § 2f) we process under Art. 6(1)(c) GDPR.

3a. Who receives data (processors)

We use the following service providers. Zoho, Hetzner, Cloudflare and Stripe process data for us as processors, as we instruct (Art. 28 GDPR), and receive only what their task needs. Stripe and Cloudflare also process part of the data under their own responsibility — Stripe, for example, to prevent fraud and money laundering, Cloudflare to protect its network. Hetzner and Cloudflare are described in § 4. We pass data to no one else, unless the law obliges us to.

Zoho (email): Zoho Corporation GmbH (Germany), our contracting partner, delivers our account emails (via smtp.zoho.eu) and hosts our mailbox, where contact-form messages and the emails you send us arrive. Zoho receives the recipient address and the content of these emails, including any reset link. The data is stored in Zoho's EU data centres. In rare cases, staff of Zoho's Indian group company may access it to provide technical support; the EU Standard Contractual Clauses cover this (Art. 46(2)(c) GDPR). Legal basis: Art. 6(1)(b) GDPR for account emails, Art. 6(1)(f) GDPR for the mailbox. See Zoho's privacy policy.

Stripe (payments — only while we offer paid plans; currently we do not): When you start a paid checkout, we create a Stripe customer record containing your email address and an internal user identifier, then redirect you to checkout.stripe.com to complete payment. Stripe handles all card details directly — FileMorph never sees or stores your card data — and returns a customer identifier, which we store to manage your subscription. Our contracting partner is Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe also processes data in the USA; Stripe, LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and Stripe's data processing agreement also contains the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR. See Stripe's privacy policy.

You can get a copy of the EU Standard Contractual Clauses named in this notice from privacy@filemorph.io.

5. Your rights (GDPR)

You have the following rights regarding your personal data. To exercise them, write to privacy@filemorph.io; we answer without undue delay and within one month at the latest (extendable by two months for complex requests, Art. 12(3) GDPR).

• Access (Art. 15 GDPR): which of your data we process and how.
• Rectification (Art. 16 GDPR) of incorrect data.
• Erasure (Art. 17 GDPR) — for your account, see below.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): the data you gave us, in a common machine-readable format.
• Objection (Art. 21 GDPR) — see the box below.
• Complaint (Art. 77 GDPR) to a data protection authority, in particular in the EU country where you live or work or where the alleged infringement took place. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

Account deletion: You can delete your account at any time from the dashboard ("Delete account" in the Danger zone). The flow asks you to re-enter your email, password, and the word DELETE before deletion proceeds. Deletion permanently erases your password hash and API keys; cancels any active paid subscription; and anonymises your conversion-job history (your account ID is stripped, the records are retained for analytics). Stripe retains transaction records independently to comply with its own tax-retention obligations. If your account has made at least one payment, we additionally retain a minimal invoice-link record — email, Stripe customer ID, and last billing tier — for 10 years (HGB §257, AO §147, permitted under GDPR Art. 17(3)(b)); after that period the record is permanently deleted. Free accounts that never issued a payment are erased in full. If you prefer, you can also request deletion by emailing privacy@filemorph.io.

6. No cookies, no tracking

FileMorph sets no cookies on its own domain and runs no tracking or analytics scripts. German law (§ 25 TDDDG) treats your browser's localStorage the same as cookies, so the few keys we write there while you are signed in are listed in full:

• fm_access_token / fm_refresh_token — your JWT session tokens; strictly necessary to keep you signed in.
• filemorph_api_key — legacy; current versions no longer write it, but a value saved by an older version is still read. Cleared on logout and when you delete your account.
• fm_cookie_notice_dismissed — remembers that you closed the informational cookie notice shown to first-time visitors, so it appears only once. The only key ever written while you are not signed in.

All of them are strictly necessary for the function you asked for, so they fall under the exemption in Art. 5(3) ePrivacy Directive / § 25 Abs. 2 Nr. 2 TDDDG — no consent banner is required. The cookie notice we show first-time visitors is informational only: it asks for no consent because none is needed. If you are not signed in, nothing is stored in your browser until you dismiss that notice — and then only the dismissal flag listed above.

One exception: if Cloudflare suspects an attack and shows a security check, it stores the cookie cf_clearance once you pass it; that cookie is strictly necessary (§ 25 Abs. 2 Nr. 2 TDDDG).

If you start a paid checkout or open the billing portal (only while we offer paid plans), you are redirected to Stripe on the stripe.com domain, which sets its own cookies. That is outside FileMorph's control and is governed by Stripe's privacy policy.

Our pages load nothing from other domains: all CSS, JavaScript, fonts and images come from filemorph.io itself — delivered through Cloudflare like every request (see § 4).

7. Rate limiting & abuse prevention

We apply in-memory rate limits to protect the service from abuse — set per route, from 5 contact-form messages per hour up to 120 requests per minute. Several account routes count the limit per signed-in account rather than per IP address, and failed API-key attempts get a separate per-IP budget. IP addresses and account identifiers used by the rate limiter are processed transiently in memory only and are never written to disk or logs. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in service stability and security.

8. Changes to this policy

We update this policy when the service changes. Accounts are live; we currently offer no paid plans. The date at the top indicates the current version.

9. Admin access (transparency)

Anyone with the admin role can open an internal cockpit that lists registered email addresses in plaintext, together with plan tier, role, whether the account is active, the account creation date, the Stripe customer ID and, for an account kept for tax reasons, the deletion date — strictly for service operation, abuse response and support. Admin actions (tier changes, role changes, deactivations) are recorded in the application log (see § 2d) with the admin's user identifier, the target user's identifier and the change performed. Legal basis: Art. 6(1)(f) GDPR.

10. Required data and automated decisions

You can use the converter without an account; apart from the technical data in § 2d and § 4 we then need nothing from you. To open an account you need an email address and a password — without them we cannot create one. Beyond that, you are under no legal or contractual obligation to give us personal data. We make no automated decisions within the meaning of Art. 22 GDPR, and we do not profile you.