Privacy policy

1. Who is responsible for your data

The controller of personal data processed through FileKiwi (filekiwi.com, the Service) is BDK Media Daniel Bihun, a sole proprietorship (jednoosobowa działalność gospodarcza) with its place of business at Partyzantów 12, 05-816 Michałowice, Poland, NIP PL5342518257, entered in the Polish Central Register and Information on Economic Activity (CEIDG), where its full registration details are publicly available (we, us). For any privacy question or request, write to contact@filekiwi.com with the subject "Privacy". We have not appointed a data protection officer, because the law does not require one for our activities. You can contact us directly about any data protection matter.

This policy explains what data we process, why, on what legal basis, for how long, who receives it and what rights you have. It meets the information duties of Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and also covers users in the United Kingdom, the United States and other countries.

2. Your files

2.1 Browser processing (most tools)

Most tools, including image conversion, image to PDF, PDF to image, merge, split, rotate and delete PDF pages, JPG and WebP compression, resize, crop, PDF to Word, PDF to text, background removal, white background, background blur and face blur, do the actual conversion or editing in your browser, with code that runs on your device. The AI models used by background removal and face blur are downloaded to your browser and run there. A copy of every file you add to these tools is nevertheless uploaded to our server and stored, as described in section 2.3.

2.2 Server processing (a few tools)

The following jobs need our server: PDF compression (including the "compress PDF to a size" tools), Protect PDF and Unlock PDF, Black and White PDF, Repair PDF, PDF to PDF/A, Word to PDF, Excel to PDF, EPUB to PDF, TXT to PDF, TIFF to PDF, animated GIF and WebP conversion, ICO input, PNG compression (also inside "compress image" when the result is a PNG), conversion to ICO, TIFF input, and, as a fallback, image formats that your browser cannot read or create (for example TIFF, ICO, GIF, BMP, AVIF, or WebP in browsers without WebP support). Each tool page says which way it works, right below the upload button. Passwords you type into Protect PDF or Unlock PDF are sent with the file over HTTPS, used only for that one job and never stored or logged.

When a server is used:

• the file travels over an encrypted HTTPS connection;
• it is saved under a random name in a private temporary folder that is not reachable from the internet;
• it is processed automatically by software, with no human involved;
• the temporary working files (the working copy and the result) are deleted immediately after the result is sent back to you; a safety job removes any temporary file left behind by an error within one hour;
• we do not create download links or public copies of your files. Only your browser receives the result.

The stored copy of your original file described in section 2.3 is kept separately.

2.3 Storage of the files you add

Whenever you add a file to any FileKiwi tool (by choosing it, dropping it or pasting it), your browser uploads the original file to our server in the background over an encrypted HTTPS connection, together with its file name and the name of the tool. We store:

• the original file, under a new name made of the time, a random code and the original file name;
• a log entry with the date and time, the tool, the original file name, the file size, the storage location and a random code that groups the files you added together.

We do not store your IP address with the file. The results you create and download are not stored. Files larger than 110 MB are not stored.

Stored files are kept in a private folder on our server that is outside the public part of the website and cannot be opened through the internet. Only we, the operator, can access them. They are deleted automatically after 30 days. Copies may remain in the backups of our hosting provider for a short additional period until those backups are overwritten in the normal cycle.

We keep these copies to investigate and stop abuse of the Service and illegal content, to handle complaints, notices and requests from authorities, and to find and fix conversion errors and improve the quality of our tools. We do not sell or share your files, we do not use them to train AI, and we do not make them public.

If you do not want a copy of a file to be stored, do not add it to FileKiwi. You can ask us to delete a stored file before the 30 days are over by writing to contact@filekiwi.com with the file name and the approximate date and time you added it.

2.4 Personal data inside your files

Your files may contain personal data, for example faces in photos or names in documents. Such data is stored together with the file for 30 days as described in section 2.3. See section 14 below if you process other people's data.

3. Data we process

We do not ask you to give us any personal data in order to use the Service. Providing data in an email is voluntary.

4. What we do not do

• No user accounts and no registration.
• No advertising, no advertising networks, no retargeting.
• No tracking pixels and no advertising cookies. Analytics cookies are used only as described in section 3 and in our Cookie Policy.
• No social media widgets and no third party fonts. All files of the website, including fonts and AI models, are served from our own server; the only external scripts are the statistics scripts of Ahrefs Web Analytics and Google Analytics, loaded after the page has finished loading. Your files are never sent to them.
• No profiling and no automated decision making within the meaning of Article 22 GDPR.
• No selling or sharing of personal data.

5. Who receives data

• Hosting provider. Our website, servers and content delivery network are provided by Hostinger, which processes data on our behalf as our processor under a data processing agreement. Our servers are located in the European Union.
• Statistics provider. Ahrefs Pte. Ltd., 16 Raffles Quay #33-03, Hong Leong Building, Singapore 048581, provides our cookieless visit statistics (Ahrefs Web Analytics) and processes the data described in section 3 on our behalf.
• Analytics provider. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, provides Google Analytics and processes the data described in section 3 on our behalf under the Google Ads Data Processing Terms.
• Email provider. Messages you send to us are stored by the provider of our mailbox, which acts as our processor.
• Authorities and advisers. We disclose data to courts, law enforcement or other authorities only where the law requires it or where it is necessary to establish, exercise or defend legal claims, and to our legal or tax advisers bound by confidentiality where needed.
• Business transfer. If the Service is transferred to another company, the data described here may be transferred with it, under the same protections.

6. Transfers outside the European Economic Area

Our website, servers and files are hosted in the European Economic Area. Visit statistics are processed by Ahrefs Pte. Ltd. in Singapore, a country without an adequacy decision of the European Commission; this transfer is protected by the Standard Contractual Clauses adopted by the Commission (Decision 2021/914) that Ahrefs offers in its data processing terms, and the data concerned is minimal (no stored IP address, no cookies, no identifiers that persist beyond one day). Google Analytics data may be processed by Google LLC in the United States, which is certified under the Data Privacy Framework between the EU and the United States (adequacy decision of the European Commission of 10 July 2023); Google also offers Standard Contractual Clauses in its data processing terms. If any other processor ever transfers personal data to a country outside the EEA, we make sure the transfer is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses approved by the Commission, together with any additional measures needed. You can ask us for a copy of the safeguards.

7. Security

We protect data with measures appropriate to the risk, including: HTTPS encryption with HSTS for all connections; random file names and private storage outside the web root that cannot be reached from the internet; immediate deletion of temporary working files and automatic deletion of stored copies after 30 days; restricted access to the server; request validation, file type and size checks and rate limiting; and security headers. No system is perfectly secure, so we also run a vulnerability disclosure programme. If a personal data breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, as the GDPR requires.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20), where processing is based on a contract or consent and carried out by automated means;
• object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21);
• withdraw consent at any time, if we ever ask for it, without affecting earlier processing;
• lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, Warszawa, uodo.gov.pl). You can also contact the authority in the country where you live or work.

To use your rights, email contact@filekiwi.com. We reply within one month, which can be extended by two further months for complex requests (we will tell you if so). We may ask for information to confirm your identity. Please note that we have no accounts and do not store your IP address with your files, so to find a stored file we need its file name and the approximate date and time you added it. For log data, the IP address you used and the approximate time of your visit help us find it.

9. Users in California and other US states

In the last 12 months we have collected only the following categories of personal information: identifiers and internet activity information (IP address and technical connection data as described in section 3), the files you add to our tools together with their file names (kept for 30 days, see section 2.3), and the content of emails you send us. We collect them for the business purposes described above: providing and securing the Service and answering you. We do not sell personal information and we do not share it for cross context behavioural advertising, and we have not done so in the last 12 months. We do not use or disclose sensitive personal information. You have the right to know, to delete, to correct and to not be discriminated against for using your rights. Send requests to contact@filekiwi.com; an authorised agent may act for you with proof of authorisation. Because we do not track you across websites, we treat Global Privacy Control and Do Not Track signals as already respected.

10. Users in the United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 give you rights equivalent to those described in section 8. You can complain to the Information Commissioner's Office (ico.org.uk).

11. Cookies and browser storage

FileKiwi never sets advertising cookies. Google Analytics cookies are set only with your consent in the EU, EEA, UK and Switzerland, and can be switched off everywhere in Cookie settings (also linked at the bottom of every page). A necessary cookie remembers your choice. Details, including every cookie and how long it lasts, are in our Cookie Policy.

12. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you are a parent or guardian and believe a child has sent us personal data, for example by email, contact us and we will delete it.

13. Links to other websites

Our pages may link to other websites. Their owners decide how they process data, and this policy does not apply to them.

14. If you process other people's data with FileKiwi

If you use FileKiwi for your business and your files contain personal data of others (for example customers or employees), you are responsible for having a legal basis for that processing. Please note that a copy of every file you add is stored on our server for 30 days, as described in section 2.3, whichever tool you use. Do not add files with other people's personal data unless you have a legal basis that covers this storage. If your organisation needs a data processing agreement under Article 28 GDPR, contact us.

15. Changes to this policy

We will update this policy when our processing changes, for example if we ever introduce advertising or change the statistics tool. We will publish the new version here with a new date and, where the law requires it, ask for your consent before any new processing starts.

16. Contact

BDK Media Daniel Bihun
Sole proprietorship entered in CEIDG (Poland)
Partyzantów 12
05-816 Michałowice, Poland
NIP (VAT ID): PL5342518257
Email: contact@filekiwi.com

FileKiwi is a brand of BDK Media.