Data handling
Your documents stay yours.
Plain answers to what your legal and IT teams will ask. Last updated 2026-11-05. Each statement says whether it describes how the service works today or what the draft legal documents commit to.
Status. The Terms, DPA, Privacy Policy, Subprocessor List and Acceptable Use Policy are drafts for legal review and are not yet in force. Where this page says "Implemented", the behaviour exists in the service code. Where it says "Draft commitment", it is stated in the draft legal documents.
Where is rendering hosted?
On EU infrastructure at Hetzner Online GmbH in Nuremberg, Germany. Draft commitment (DPA section 6 and Subprocessor List). Every other service we use is on the Subprocessor List.
Do you store our documents?
No, by default. A render requested with delivery=pdf returns the PDF in the response and keeps nothing. Renders that return a link (delivery=link, and every MCP render) keep a temporary file only so the link can be downloaded. Implemented.
How long do temporary files last?
One hour by default. The download link stops working at expiry and a maintenance job (hourly by default) deletes the expired file. Implemented.
Is there a document history?
A list only. Each render adds a row with its title, date, source, page count, locale and profile name, so your team can see what was made. The document itself is not kept. Rows are deleted after 365 days. Implemented.
What do you log?
Metadata only. Each render writes a row with time, the user or key, the action and small facts such as page count, size, locale, profile id and content type. Never the document text. Audit rows are deleted after 12 months. Implemented.
Who can use our API and MCP?
Only signed-in users of your company or scoped API keys your manager creates. Keys are shown once, stored only as a SHA-256 hash and can be revoked. The company and its status are checked on every request, so revoking a key or deactivating a company takes effect immediately. Implemented.
What about a prepared sample account?
A prepared account has no API or MCP access until a verified manager accepts the Terms and activates it. Unclaimed prepared accounts are deleted after 30 days. Implemented in the account code; the sample request flow itself is described in the Privacy Policy draft.
Do you train AI on our content?
No. The draft Terms (section 8.3) and DPA (section 2.3) state that Customer Content is not used to train AI models.
Does any of our text go to an AI provider?
Only if you ask for it. The optional cleanup setting sends the text to an AI model provider (the code calls Anthropic) to repair formatting, and falls back to your original text if the result changes the content. It is off by default. The provider is not yet listed in the Subprocessor List, which is an open item. Implemented as opt-in.
Which remote images are fetched?
Only from image hosts your manager has allowed. With none allowed, no remote image is fetched. Implemented.
Retention at a glance
| Data | Retention | Basis |
|---|---|---|
| Rendered PDF returned in the response | Not stored | Implemented |
| Temporary file behind a download link | 1 hour by default, then deleted | Implemented (downloads service) |
| Audit log (metadata only) | 12 months | Implemented (audit service) |
| Unclaimed prepared account and its data | 30 days, then erased | Implemented (retention service); Terms 2.3 and Privacy Policy draft |
| Unconfirmed sample requests | 30 days | Privacy Policy draft |
| Account data after termination | Export for 30 days, then deleted within a further 30 days | DPA draft, section 9.2 |
| Backups | Overwritten within 35 days | DPA draft, section 9.2 |
| Billing records | As required by tax law | Privacy Policy draft |
When a company is erased, a record is kept that holds only a hash of the domain, the reason and the time, with no personal data. Implemented.
Contract commitments (draft)
- Pretty PDF acts as processor for Customer Content and the customer is the controller (DPA, section 1).
- Subprocessor changes are announced at least 30 days in advance (DPA, section 5.2).
- Personal data breaches are notified without undue delay and within 48 hours of becoming aware (DPA, section 8.1).
- No sale of personal data and no AI training on Customer Content (DPA, section 2.3).
- Special-category data (Art. 9 GDPR) is not intended and needs a written agreement (DPA, Annex I).